We’ve been hesitant to deploy directly from private Docker registries because we need to pull images to launch new VMs. We can make sure our registry stays up, but don’t trust third party registries as much. 
You can pull a private image and then flyctl deploy -i <tag> to push it to us, though. That might help!
Agreed about the environment variables! I frequently need to deploy the same app to different environments. @michael is working on some stuff to make this easier.