You run a gluetun container and a qBittorrent container on which you set the "network mode" to the gluetun container. Then you put your *arr software and the gluetun container in the same (virtual) network so they can communicate internally. All containers using gluetun as their "network mode" have their ports available on the gluetun container. You can also put the qBittorrent container in your virtual internal network but then you have to make sure that the network is marked as internal to avoid traffic leaking.

Here's an example docker-compose.yaml for gluetun with Nordvpn and qBittorrent"

version: "3"
services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      # this makes qBittorrent's web UI accessible on localhost:8080
      - "127.0.0.1:8080:8080"
    environment:
      # See https://github.com/qdm12/gluetun-wiki/tree/main/setup#setup
      - VPN_SERVICE_PROVIDER=nordvpn
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=aGFoYWltbm90dGhhdGR1bWJnb2RkYW1taXQ=
      - TZ=Europe/Berlin
      # Server list updater
      # See https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list
      - UPDATER_PERIOD=
      - SERVER_COUNTRIES=Germany
      - SERVER_REGIONS=p2p
  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent
    network_mode: "service:gluetun"
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Berlin
      - WEBUI_PORT=8080
    volumes:
      - ./config:/config
      - ./downloads:/downloads
      - ./torrents:/torrents
    restart: unless-stopped

You can use qBittorrent's API (enable it in the settings) to add magnet links. I have a small wrapper tool for that, so I can just click on a magnet link in the browser and it gets added to the queue.