I was genuinely surprised how easy this was, provided your source and target systems are the same processor architecture.

Package up the Docker image

Docker comes with a handy save command which will package up a container and spit it out in tar format on STDOUT. To create a gzipped (since copying this around it going to take time, I want to minimise space) tar archive:

IMAGE_NAME=mbentley/omada-controller
docker pull $IMAGE_NAME  # If it is not already fetched locally
docker save $IMAGE_NAME | gzip > $( basename $IMAGE_NAME ).tar.gz

Unpackage image

After copying over to the isolated network (I used a USB thumb drive), importing is the reverse of the save process using the load command:

zcat omada-controller.tar.gz | docker load