Sharing the network space with another container is the way to go IMHO. I use podman and just run the main application in one container, and then another VPN-enabling container in the same pod, which is essentially what you’re achieving with with the network_mode: container:foo directive.
Ideally, exposing ports on the host node is not part of your design, so don’t have any --port directives at all. Your host should allow routing to the hosted containers and, thus, their exposed ports. If you run your workloads in a dedicated network, like 10.0.1.0/24, then those addresses assigned to your containers need to be addressable. Then you just reach all of their exposed ports directly. Ultimately, you then want to control port exposure through services like firewalld, but that can usually be delayed. Just remember that port forwarding is not a security mechanism, it’s a convenience mechanism.
If you want DLNA, forget about running that workload in a “proper” container. For DLNA, you need the ability to open random UDP ports for communication with consuming devices on the LAN. This will always require host networking.
Your DLNA-enabled workloads, like Plex, or Jellyfin, need a host networking container. Your services that require internet privacy, like qBittorrent, need their own, dedicated pod, on a dedicated network, with another container that controls their networking plane to redirect communication to the VPN. Ideally, all your manual configuration then ends up with a directive in the Wireguard config like:
PostUp = ip route add 192.168.1.0/24 via 192.168.19.1 dev eth0
Wireguard will likely, by default, route all traffic through the wg0 device. You just then tell it that the LAN CIDR is reachable through eth0 directly. This enables your communication path to the VPN-secured container after the VPN is up.
I feel like most people base their decision on license purely on anecdotes of a handful of cases where the outcome was not how they would have wanted it. Yet, most people will never be in that spot, because they don’t have anything that anyone would want to consume.
If I had produced something of value I want to protect, I wouldn’t make it open in the first place. Every piece of your code will be used to feed LLMs, regardless of your license.
It is perfectly fine to slap MIT on your JavaScript widget and let some junior in some shop use it to get their project done. Makes people’s life easier, and you don’t want to sue anyone anyway in case of license violations.
If you’re building a kernel module for a TCP reimplementation which dramatically outperforms the current implementation, yeah, probably a different story