What I'm doing is using a dedicated VPN Gateway container. The instances running delicate services have a static default route to the GW-container.
This is an extra step, but allows me add easily route other services or clients or even whole networks through my VPN without additional setup or specialized containers bundling both.
Wanna use it on the phone? Change the gateway address. Wanna use it from my Linux machine? Add a static default route. Etc...
Works flawlessly!
What were the biggest pains? What was surprisingly easier than expected?