Containers from slow registries start

Reading a container's image allows 5 seconds for each request rather than for the whole read, accepts index.docker.io and registry.hub.docker.com as Docker Hub, and refuses an image built only for arm64 at create instead of failing later.