Allow sideloading vppdebs, tighten enabled modules in docker startup.conf, noting that clab generates its own

README.md

@@ -115,6 +115,30 @@ docker buildx build --push --build-arg REPO=2510 --platform linux/arm64,linux/am
   --tag $IMG:$TAG -f docker/Dockerfile docker/
 ```
 
+#### Sideloading locally built VPP packages
+
+Instead of pulling VPP from packagecloud, you can sideload locally built `.deb` packages using
+Docker buildx's `--build-context` flag. This is useful for testing unreleased VPP builds or
+working around version-specific issues (for example, VPP 25.10 fails to start on kernels that
+do not expose NUMA topology via sysfs, such as OrbStack on Apple Silicon; VPP 26.06+ fixes this).
+
+Point `--build-context vppdebs=<path>` at a directory containing `libvppinfra_*.deb`,
+`vpp_*.deb`, and `vpp-plugin-core_*.deb`. If the context is not provided, the build falls back
+to packagecloud as normal. The `.deb` files are bind-mounted during the build and never stored
+in an image layer.
+
+```bash
+# Build from locally compiled VPP packages (e.g. from ~/src/vpp after make build):
+IMG=git.ipng.ch/ipng/vpp-containerlab
+docker buildx build --load --platform linux/arm64 \
+  --build-context vppdebs=~/src/vpp/build-root \
+  --tag $IMG:latest -f docker/Dockerfile docker/
+
+# Build from packagecloud as normal (no --build-context needed):
+docker buildx build --push --platform linux/arm64,linux/amd64 \
+  --tag $IMG:latest -f docker/Dockerfile docker/
+```
+
 ### Testing standalone container
 
 ```bash

docker/Dockerfile

@@ -1,3 +1,8 @@
+# Default empty stage for local VPP debs. Override at build time with:
+#   --build-context vppdebs=/path/to/debs  (e.g. ~/src/vpp/build-root/)
+# If not overridden, falls back to installing VPP from packagecloud (ARG REPO).
+FROM scratch AS vppdebs
+
 FROM ubuntu:noble
 ARG DEBIAN_FRONTEND=noninteractive
 ARG VPP_INSTALL_SKIP_SYSCTL=true
@@ -7,10 +12,19 @@ RUN apt-get update && apt-get -y install curl procps tcpdump iproute2 iptables \
   iputils-ping net-tools git python3 python3-pip vim-tiny openssh-server \
   mtr-tiny traceroute && apt-get clean
 
-# Install VPP
+# Install VPP - sideload from local debs if --build-context vppdebs=<path> is provided,
-RUN mkdir -p /var/log/vpp /root/.ssh/ && \
+# otherwise install from packagecloud. Debs are bind-mounted and never stored in a layer.
+RUN --mount=type=bind,from=vppdebs,target=/tmp/vpp-debs \
+    mkdir -p /var/log/vpp /root/.ssh/ && \
+    if ls /tmp/vpp-debs/vpp_*.deb 1>/dev/null 2>&1; then \
+      apt-get -y install /tmp/vpp-debs/libvppinfra_*.deb \
+                         /tmp/vpp-debs/vpp_*.deb \
+                         /tmp/vpp-debs/vpp-plugin-core_*.deb; \
+    else \
       curl -s https://packagecloud.io/install/repositories/fdio/${REPO}/script.deb.sh | bash && \
-    apt-get -y install vpp vpp-plugin-core && apt-get clean
+      apt-get -y install vpp vpp-plugin-core; \
+    fi && \
+    apt-get clean
 
 # Build vppcfg
 RUN pip install --break-system-packages build netaddr yamale argparse pyyaml ipaddress && \

docker/files/etc/vpp/startup.conf

@@ -34,11 +34,16 @@ statseg {
 }
 
 plugins {
-  plugin default { enable }
+  plugin default { disable }
-  plugin dpdk_plugin.so { disable }
+  plugin acl_plugin.so { enable }
+  plugin geneve_plugin.so { enable }
+  plugin gre_plugin.so { enable }
+  plugin ipip_plugin.so { enable }
   plugin linux_cp_plugin.so { enable }
   plugin linux_nl_plugin.so { enable }
   plugin sflow_plugin.so { enable }
+  plugin tap_plugin.so { enable }
+  plugin vxlan_plugin.so { enable }
 }
 
 linux-cp {