Started on a PR: https://github.com/vyos/vyos-1x/pull/3288

My specific use case is a container that requires --sysctl=net.ipv4.conf.all.forwarding=1

I don't think the commit comment adequately justifies why we can't pull the image from the internet when starting the container if it does not exist within the on-disk store shared between VyOS images.

Started a PR for this: https://github.com/vyos/vyos-1x/pull/1702