You can't inspect encrypted packets, what China does is network traffic analysis - examining headers and figuring out patterns based on metadata. They don't care much about what's being transmitted if using a VPN alone is enough to land you in trouble.
Excuse my ignorance, but in this case what would be the benefit of having the wireguard server run inside a Docker? Wouldn’t running the server directly on the remote VM achieve the same result?