From my point of fiew, looks interesting.
The proposed structure and behaviour doesn't look that different than what is currently in geoip filtering: external URLs with data, and sync from time to time.

Maybe a simplified and interactive cli, as when adding new image? So user can decide what to do with other images and containers.

PR: https://github.com/vyos/vyos-1x/pull/1626

PR: https://github.com/vyos/vyos-1x/pull/1603

+1 for @Viacheslav proposal.

At least on my lab, with one of the latest 1.4, this is working for me:

PR: https://github.com/vyos/vyos-1x/pull/1560

PR for Jump: https://github.com/vyos/vyos-1x/pull/1553

Since jump action was added, It would be good to also add "return" action

PR https://github.com/vyos/vyos-1x/pull/1546

Interesting article on how and when to match ipsec options: https://thermalcircle.de/doku.php?id=blog:linux:nftables_demystifying_ipsec_expressions

Do you have a proposed cli format?

PR: https://github.com/vyos/vyos-1x/pull/1525

PR: https://github.com/vyos/vyos-1x/pull/1522

From kernel 5.13, hardware offload is supported (if nic supports it).
Info: https://www.kernel.org/doc/html/v5.13/networking/nf_flowtable.html#hardware-offload

PR: https://github.com/vyos/vyos-1x/pull/1502

PR: https://github.com/vyos/vyos-1x/pull/1492

What version you are using?

As remarked and as expected, this option is not enable by default.
Proofs:

• Fist scenario: no ping-check option introduced in configuration:

PR: https://github.com/vyos/vyos-1x/pull/1461

Currently thinking on how to implement this.
One option could be:

Moving in from forwardto prerouting doesn't seem to be a good idea. Filtering in prerouting will also filter local traffic.
Also, as remarked in previous entry, I would try to avoid using marks in mangle, since it may lead to mayor problems/incompatibilities when PBR also present in configuration.

Agree that both options are not available in cli.. But, you can use source-address:

Modyfing file pointed by @Viacheslav , makes ipv6 peer option available.
But while testing config, it's not possible to insert an ipv6 address: validator rejects input.
Validator used: syntax:expression: exec "/opt/vyatta/sbin/vyatta-policy.pl --check-peer-syntax $VAR(@)"; "peer must be either an IP or local"

PR: https://github.com/vyos/vyos-1x/pull/1369

PR for 1.4: https://github.com/vyos/vyos-1x/pull/1367

Since in previous version set protocols nhrp tunnel tun0 cisco-authentication "" was allowed, a migration script is required. Otherwise, when upgrading, configuration fails.

Extra checks are needed not only when attaching a policy route to an interface, but also when attaching firewall.
For example:

vyos@vyos# set firewall name FOO rule 10 action accept 
[edit]
vyos@vyos# set firewall name FOO rule 10 destination group address-group NOAG
[edit]
vyos@vyos# commit

PR: https://github.com/vyos/vyos-1x/pull/1355