As I understand it, push only goes to a registry. So even with an ssh tunnel to the docker host tcp port, there's no obvious way to transport the image from your localhost.

You should be able to "docker build" the image on the remote host that way. Downside there is that you are transporting the entire build context rather than just the layers. IMO most cases will be less efficient.