The VPN client comes off the laptops

The vendor's admin panel lives on their private network, reachable only over their WireGuard. So nine laptops run the VPN client, and nine laptops intermittently lose Slack, DNS, or the will to print.

Move the client off the laptops. One container runs the provider's config file with wg-quick: the config file, not the desktop app, because an app's kill switch drops inbound traffic. Hoody keeps replies to inbound proxy traffic on the path they arrived on, so the container's terminal and service URLs keep answering while the tunnel is up. The team opens those URLs; the container reaches the vendor. If someone runs the app anyway and the URLs go dark, SSH still works: the host brokers it outside the container's network entirely.

Nine VPN clients become zero; the tunnel becomes a bookmark.