I've no experience with Zerotier, but I use a combo of WG and Openvpn. I use OpenVPN inside the Docker containers since it's easier to containerize than WG.

Inside the Docker container, I have the following logic:

1. supervisord starts openvpn along with the other services in the container (yeah, yeah, it's not "the docker way" and I don't care)
2. OpenVPN is configured with an "up" and "down" script
3. When OpenVPN completes the tunnel setup, it runs the up script which does the following:

# Get the current default route / Docker gateway IP
export DOCKER_GW=$(ip route | grep default | cut -d' ' -f 3)

# Delete the default route so the VPN can replace it.
ip route del default via $DOCKER_GW;

# Add a static route through the Docker gateway only for the VPN server IP address
ip route add $VPN_SERVER_IP via $DOCKER_GW; true
ip route add $LAN_SUBNET via $DOCKER_GW; true

LAN_SUBNET is my local network (e.g. 192.168.0.1/24) and VPN_SERVER_IP is the public IP of the VPS (1.2.3.4/32). I pass those in as environment variables via docker-compose.

The VPN server pushes the default routes to the client (0.0.0.0/1 via and 128.0.0.0/1 via

Again, sorry this is all generic, but since you're using different mechanisms, you'll need to adapt the basic logic.