I run it that way on my windows machines, the image is downloaded and executed directly.

This ties into a funny example: k8s manages my vm's via kubevirt, those then have a minimal k8s version installed that runs my jobs. The implementation simply mounts the extracted image to a virtual fs and executes it there, then deletes the file system.

You can use VMs instead. I don't think the distinction matters very much though.

It is impossible.