I believe it's just aliased as "wg". Kernel wireguard would be unable to run in the docker container