Closes#3202. I've tested in a VM detached from the public internet.

The experience here isn't fantastic, but it's better we have the path officially documented. For a number of reasons outlined in the Dockerfile snippet, it's necessary to build a custom image based on the use case.

Most enterprises in offline scenarios will already have a container registry and a Ci/CD platform for pushing images to the registry, but it is an extra step vs. just importing an image. I created#4643 to discuss improvements that can be made but nothing feels intuitive to me at this point.