well nevermind. On proxmox 7.2 with nesting enabled, an unprivileged container just works using wireguard. That is awesome.