> Perhaps I will write a docker2squash, so we can mount and run these images immediately after download.

Well, if you already have a rootfs tarball, I guess the bulk of the work is done. The tarball can be directly piped into tar2sqfs[1] or sqfstar[2].

[1] https://manpages.debian.org/unstable/squashfs-tools-ng/tar2s...

[2] https://manpages.debian.org/testing/squashfs-tools/sqfstar.1...