Each container, by default, runs in a separate network namespace. You can use docker CLI to create specific networks that can be shared with other containers, or use docker-compose for it. Technically, for processes outside containers you can still use the same network of that container by running the inside the network namespace of the ‘VPN’ container (for example running them with unshare). However, I wouldn’t recommend this, as containers are supposed to run mostly isolated workload and not for this kind of use-case. But yeah, technically it’s feasible.