table ip vyos_filter {

vyos@r15:~$ show version all | match podman
ii  podman                               4.9.5                            amd64        Engine to run OCI-based containers in Pods
vyos@r15:~$ 
vyos@r15:~$ 
vyos@r15:~$ show container image 
REPOSITORY                         TAG         IMAGE ID      CREATED      SIZE
localhost/vyos-flowspec-netfilter  1.0         2b8b95eddb07  2 weeks ago  91.5 MB
docker.io/adguard/adguardhome      v0.107.52   6543abecfa41  4 weeks ago  71.4 MB
vyos@r15:~$ 
vyos@r15:~$ 
vyos@r15:~$ cat /etc/containers/policy.json 
{
    "default": [
        {
            "type": "insecureAcceptAnything"
        }
    ]
}
vyos@r15:~$ 
vyos@r15:~$ 
vyos@r15:~$ show version 
Version:          VyOS 1.4-rolling-202408051021
Release train:    sagitta
Release flavor:   iso

vyos@server:~$ show dhcpv6 server leases 
Traceback (most recent call last):
  File "/usr/libexec/vyos/op_mode/dhcp.py", line 438, in <module>
    res = vyos.opmode.run(sys.modules[__name__])
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/vyos/opmode.py", line 263, in run
    res = func(**args)
          ^^^^^^^^^^^^
  File "/usr/libexec/vyos/op_mode/dhcp.py", line 265, in _wrapper
    return func(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^
  File "/usr/libexec/vyos/op_mode/dhcp.py", line 322, in show_server_leases
    return _get_formatted_server_leases(lease_data, family=family)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/libexec/vyos/op_mode/dhcp.py", line 175, in _get_formatted_server_leases
    end =  _utc_to_local(end).strftime('%Y/%m/%d %H:%M:%S')
           ^^^^^^^^^^^^^^^^^^
  File "/usr/libexec/vyos/op_mode/dhcp.py", line 47, in _utc_to_local
    return datetime.fromtimestamp((datetime.fromtimestamp(utc_dt) - datetime(1970, 1, 1)).total_seconds())
                                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
TypeError: 'NoneType' object cannot be interpreted as an integer
vyos@server:~$

$ git diff
diff --git a/data/templates/zabbix-agent/10-override.conf.j2 b/data/templates/zabbix-agent/10-override.conf.j2
index 7c296e8fd..0acf775be 100644
--- a/data/templates/zabbix-agent/10-override.conf.j2
+++ b/data/templates/zabbix-agent/10-override.conf.j2
@@ -1,3 +1,4 @@
+{% set zabbix_command = 'ip vrf exec ' ~ vrf ~ ' ' if vrf is vyos_defined else '' %}
 [Unit]
 After=
 After=vyos-router.service
@@ -7,7 +8,9 @@ ConditionPathExists=/run/zabbix/zabbix-agent2.conf
 [Service]
 EnvironmentFile=
 ExecStart=
-ExecStart=/usr/sbin/zabbix_agent2 --config /run/zabbix/zabbix-agent2.conf --foreground
+ExecStart={{ zabbix_command }}/usr/sbin/zabbix_agent2 --config /run/zabbix/zabbix-agent2.conf --foreground
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_RESOURCE CAP_BPF CAP_DAC_OVERRIDE CAP_FOWNER
+AmbientCapabilities=CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_RESOURCE CAP_BPF CAP_DAC_OVERRIDE CAP_FOWNER
 WorkingDirectory=
 WorkingDirectory=/run/zabbix
 Restart=always
diff --git a/interface-definitions/service_monitoring_zabbix-agent.xml.in b/interface-definitions/service_monitoring_zabbix-agent.xml.in
index 3754e9145..e44b31312 100644
--- a/interface-definitions/service_monitoring_zabbix-agent.xml.in
+++ b/interface-definitions/service_monitoring_zabbix-agent.xml.in
@@ -185,6 +185,7 @@
                 </properties>
                 <defaultValue>3</defaultValue>
               </leafNode>
+              #include <include/interface/vrf.xml.i>
             </children>
           </node>
         </children>