

Alternatively a server-only qBittorrent (controllable via the web-interface only) without docker (package: qbittorrent_nox) behind an always on VPN, configured to only bind to the network interface of the VPN so that it doesn’t send any data outside the VPN does the same but it’s much lighter so you can put it in shitty-shit hardware.
This is what I have in the cheap mini-PC which I use as Homeserver/NAS/TV Media Player.





You can run qBittorrent outside docker and configure it to only bind to the network interface for the VPN (in Tools->Options->Advanced->Network Interface).
Unless for some strange reason your VPN connection is constantly renaming the network interface when it starts, this should work fine and make sure qBittorrent never sends any data outside the VPN connection.
This is Linux, so there’s usually more than one way to get the same result.