Right now I have a docker container with a VPN that provides it's connection to the other services.

I thought about adding a VPN connection on the host system to basically create a multihop over different providers. Would that work?

As far as I understood the one inside the docker should be the "better" one as that's the one that's exposed first and the one on host would only see the VPN-encrypted traffic anyway? How about port forwarding? That should only be necessary on the one inside docker, too - or is there something I'm missing?

What are the disadvantages to do that (other than the lower speed)? Could I actually add risk of exposure if just one of them is compromised?

Or would it be smarter to spin up another docker and route the traffic through that one?