when running wireguard on a docker build host with a wg peer configured as the default gateway ( AllowedIPs =  0.0.0.0/0 )
some (not all) networking connections during a docker build fail. this occurs with pip installs and curl in some cases
an example curl error inside the container is:
OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to  repo.saltstack.com:443

I believe this only happens with some specific hosts
for example, I can curl http and https for google.com, but not repo.saltstack.com from inside the container

wget also fails, for both http and https , and gives the following output inside the container:
wget http://repo.saltstack.com
--2018-06-22 00:24:26--  http://repo.saltstack.com/
Resolving repo.saltstack.com (repo.saltstack.com)... 138.197.226.47, 2604:a880:400:d0::2:e001
Connecting to repo.saltstack.com (repo.saltstack.com)|138.197.226.47|:80... connected.
HTTP request sent, awaiting response...

 wget https://repo.saltstack.com
--2018-06-22 00:24:39--  https://repo.saltstack.com/
Resolving repo.saltstack.com (repo.saltstack.com)... 138.197.226.47, 2604:a880:400:d0::2:e001
Connecting to repo.saltstack.com (repo.saltstack.com)|138.197.226.47|:443... connected.

(Notice no "HTTP request sent" on the https request)

these same requests succeed on the same host when not run in the container. 
these same requests succeed in the same container on the same host when wireguard is down

does anyone have a suggestion for further debugging I could do to understand whats happening?