my guess (and it is just a guess) is that for some reason, wireguard tried to create a node on the server with a listen port that was outside of the range that is forwarded to the container. Why it would do this, no idea.