Hi @Evgeny Shvarov 
You inspired me to extend the standard Dockerfile sequence by this line

RUN --mount=type=bind,src=.,dst=. \
    iris start IRIS && \
    iris session IRIS < zpm.script && \
    iris session IRIS < iris.script && \
    iris stop IRIS quietly

and zpm.script is basically the version-independent one-liner sliced to readable pieces

zn "%SYS"
 ;; from onezpm
hang 3
write !,"from onezpm",!
set r=##class(%Net.HttpRequest).%New()
set r.Server="pm.community.intersystems.com"
set r.SSLConfiguration="ISC.FeatureTracker.SSL.Config"
do r.Get("/packages/zpm/latest/installer")
do $system.OBJ.LoadStream(r.HttpResponse.Data,"c")
ZPM "repo -r -n registry -url https://pm.community.intersystems.com/ -user """" -pass """""
zpm "enable -community"
hang 2
Write !,"ZPM ready",!
halt

This makes me independent from the limits of intersystemsdc/.....
and I can use images from 
containers.intersystems.com/intersystems/****-community
with a minimal invasive approach without touching any other part of the repo

In most cases, I've seen working before
the real message was "community license expired."
You see it only in the builder log. OR
using  docker compose --progress plain build  from command line.
workaround:
use instead.  intersystemsds/iris-community or intersystemsdc/irishealth-community  
:latest is always the default

Yeah!
If there is a reference of how to add -ml- functionality to available intersystemsds/iris-community and intersystemsdc/irishealth-community 
The other possibility could be to change to NON-intersystemsdc versions
and add the single-line installation for ZPM.  Not my favorite.