Пустить трафик docker в обход Wireguard

На машине (Debian 11) работают несколько докер-контейнеров. Как настроить ее в качестве клиента Wireguard, чтобы трафик от докер шел в обход Wireguard? Или наоборот, трафик от хоста не заворачивался в Wireguard, а только от docker? Сейчас настройки такие:

2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether d0:50:99:95:24:47 brd ff:ff:ff:ff:ff:ff
    inet 172.16.30.47/24 brd 172.16.30.255 scope global noprefixroute enp3s0
       valid_lft forever preferred_lft forever
    inet6 fe80::d250:99ff:fe95:2447/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: wg0-client: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    link/none 
    inet 10.8.0.4/32 scope global wg0-client
       valid_lft forever preferred_lft forever
4: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:b1:bf:ea:7c brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:b1ff:febf:ea7c/64 scope link 
       valid_lft forever preferred_lft forever
6: vethb61f48e@if5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default 
    link/ether e6:1a:c9:76:98:07 brd ff:ff:ff:ff:ff:ff link-netnsid 1
    inet6 fe80::e41a:c9ff:fe76:9807/64 scope link 
       valid_lft forever preferred_lft forever
8: veth4ba7c36@if7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default 
    link/ether 3e:7a:6c:60:f3:df brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet6 fe80::3c7a:6cff:fe60:f3df/64 scope link 
       valid_lft forever preferred_lft forever

$ ip route

default via 172.16.30.10 dev enp3s0 proto dhcp metric 100 
169.254.0.0/16 dev enp3s0 scope link metric 1000 
172.16.30.0/24 dev enp3s0 proto kernel scope link src 172.16.30.47 metric 100 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1

/etc/wireguard/wg0-client.conf

[Interface]
ListenPort = 51479
FwMark = 0xca6c
PrivateKey = <key>

[Peer]
PublicKey = <key>
AllowedIPs = 0.0.0.0/0
Endpoint = <ip-server>:51820
PersistentKeepalive = 21