Tailscale is an excellent answer here. They use wireguard as the vpn protocol, but add layers of extra control.
You can use it in sidecar config for each container, or setup a subnet router, which lets you route any IP over the VPN. Just target that IP with a /32 cidr, i.e tailscale up --advertise-routes:192.168.1.100/32.
Most soup kitchens will take packs of socks, sleeping bags, tampons, dog food/etc and make care packages for people that come in.