Allow sideloading vppdebs, tighten enabled modules in docker startup.conf, noting that clab generates its own

README.md

@@ -115,6 +115,30 @@ docker buildx build --push --build-arg REPO=2510 --platform linux/arm64,linux/am
   --tag $IMG:$TAG -f docker/Dockerfile docker/
 ```
 
+#### Sideloading locally built VPP packages
+
+Instead of pulling VPP from packagecloud, you can sideload locally built `.deb` packages using
+Docker buildx's `--build-context` flag. This is useful for testing unreleased VPP builds or
+working around version-specific issues (for example, VPP 25.10 fails to start on kernels that
+do not expose NUMA topology via sysfs, such as OrbStack on Apple Silicon; VPP 26.06+ fixes this).
+
+Point `--build-context vppdebs=<path>` at a directory containing `libvppinfra_*.deb`,
+`vpp_*.deb`, and `vpp-plugin-core_*.deb`. If the context is not provided, the build falls back
+to packagecloud as normal. The `.deb` files are bind-mounted during the build and never stored
+in an image layer.
+
+```bash
+# Build from locally compiled VPP packages (e.g. from ~/src/vpp after make build):
+IMG=git.ipng.ch/ipng/vpp-containerlab
+docker buildx build --load --platform linux/arm64 \
+  --build-context vppdebs=~/src/vpp/build-root \
+  --tag $IMG:latest -f docker/Dockerfile docker/
+
+# Build from packagecloud as normal (no --build-context needed):
+docker buildx build --push --platform linux/arm64,linux/amd64 \
+  --tag $IMG:latest -f docker/Dockerfile docker/
+```
+
 ### Testing standalone container
 
 ```bash