[ThreatSystems]

Why not look at Packer? I use it quite significantly for creating base VMs.

Provisioner scripts can effectively be broken down from the Dockerfile RUN layers as Bash or Powershell scripts. Then output as a vagrant box or hypervisor VM export VM of choice. For exposing ports, just run an iptables or powershell New-NetFirewallRule.

Whilst you can't get volume mounts can use the file provisioner to embed local files on build.

Then import it and create a default snapshot. Want it back to its original state? Revert snapshot and done!