Allow sideloading vppdebs, tighten enabled modules in docker startup.conf, noting that clab generates its own

docker/Dockerfile

@@ -1,3 +1,8 @@
+# Default empty stage for local VPP debs. Override at build time with:
+#   --build-context vppdebs=/path/to/debs  (e.g. ~/src/vpp/build-root/)
+# If not overridden, falls back to installing VPP from packagecloud (ARG REPO).
+FROM scratch AS vppdebs
+
 FROM ubuntu:noble
 ARG DEBIAN_FRONTEND=noninteractive
 ARG VPP_INSTALL_SKIP_SYSCTL=true
@@ -7,10 +12,19 @@ RUN apt-get update && apt-get -y install curl procps tcpdump iproute2 iptables \
   iputils-ping net-tools git python3 python3-pip vim-tiny openssh-server \
   mtr-tiny traceroute && apt-get clean
 
-# Install VPP
-RUN mkdir -p /var/log/vpp /root/.ssh/ && \
-    curl -s https://packagecloud.io/install/repositories/fdio/${REPO}/script.deb.sh | bash && \
-    apt-get -y install vpp vpp-plugin-core && apt-get clean
+# Install VPP - sideload from local debs if --build-context vppdebs=<path> is provided,
+# otherwise install from packagecloud. Debs are bind-mounted and never stored in a layer.
+RUN --mount=type=bind,from=vppdebs,target=/tmp/vpp-debs \
+    mkdir -p /var/log/vpp /root/.ssh/ && \
+    if ls /tmp/vpp-debs/vpp_*.deb 1>/dev/null 2>&1; then \
+      apt-get -y install /tmp/vpp-debs/libvppinfra_*.deb \
+                         /tmp/vpp-debs/vpp_*.deb \
+                         /tmp/vpp-debs/vpp-plugin-core_*.deb; \
+    else \
+      curl -s https://packagecloud.io/install/repositories/fdio/${REPO}/script.deb.sh | bash && \
+      apt-get -y install vpp vpp-plugin-core; \
+    fi && \
+    apt-get clean
 
 # Build vppcfg
 RUN pip install --break-system-packages build netaddr yamale argparse pyyaml ipaddress && \