I mean seriously? No one runs wireguard on balena?
Found Wireguard client in container?, which basically contains the answer above (obviously copied…) So I guess the right (and the most efficient) way to run Wireguard on raspberry pi is using PiVPN project… 
That’s unfortunate…