The easiest way that I can think of is that you generate the container on a more permissible environment.
Then backup the docker image, and import it inside the more restrictive environment.
At one point or another you need internet access to get the dependencies, so you might as well use the power of docker.
as to upgrades and updates, this is a different story.