network namespaces provide a clean host/vpn split.

https://blog.thea.codes/nordvpn-wireguard-namespaces/

I just built the same thing using `systemd-nspawn --directory=/ -b`. The nice part about using nspawn is that you have access to all of the normal network configuration tools like systemd-networkd to configure the devices and networks, rather than using a python script. It also provides a nice place for running services inside of the container, since process management is also included.