Merge pull request #1841 from vyos/yuriy/convert-images-to-webp

perf: convert all images to WebP with PDF fallback

20 files changed, 366 insertions, 252 deletions

diff --git a/docs/configuration/firewall/bridge.rst b/docs/configuration/firewall/bridge.rst
index d0847801..53775514 100644
--- a/docs/configuration/firewall/bridge.rst
+++ b/docs/configuration/firewall/bridge.rst
@@ -50,13 +50,13 @@ chain is **forward**, and its base command for filtering is ``set firewall
 bridge forward filter ...``, which happens in stage 4, highlighted with red
 color.
 
-.. figure:: /_static/images/firewall-bridge-forward.png
+.. figure:: /_static/images/firewall-bridge-forward.*
 
 For traffic destined to the router itself or that needs to be routed
 (assuming a layer3 bridge is configured), the base chain is **input**, and the
 base command is ``set firewall bridge input filter ...`` and the path is:
 
-.. figure:: /_static/images/firewall-bridge-input.png
+.. figure:: /_static/images/firewall-bridge-input.*
 
 If it's not dropped, then the packet is sent to **IP Layer**, and will be
 processed by the **IP Layer** firewall: IPv4 or IPv6 ruleset. Check once again
@@ -67,7 +67,7 @@ For traffic that originates from the bridge itself, the base chain is
 **output**, and the base command is ``set firewall bridge output filter
 ...``, and the path is:
 
-.. figure:: /_static/images/firewall-bridge-output.png
+.. figure:: /_static/images/firewall-bridge-output.*
 
 Custom bridge firewall chains can be created with the command ``set firewall
 bridge name <name> ...``. To use such a custom chain, a rule with action jump
@@ -557,6 +557,8 @@ And op-mode commands:
 
 Inspect logs:
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
       vyos@BRI:~$ show log firewall bridge
@@ -567,3 +569,5 @@ Inspect logs:
       vyos@BRI:~$ show log firewall bridge forward filter
       Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0
       Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0
+
+.. start_vyoslinter
diff --git a/docs/configuration/firewall/flowtables.rst b/docs/configuration/firewall/flowtables.rst
index 152a4380..f996a59e 100644
--- a/docs/configuration/firewall/flowtables.rst
+++ b/docs/configuration/firewall/flowtables.rst
@@ -31,7 +31,7 @@ Flowtables let you define a fastpath through the flowtable datapath.
 Flowtables support layer 3 (IPv4 and IPv6) and layer 4 (TCP and UDP)
 protocols.
 
-.. figure:: /_static/images/firewall-flowtable-packet-flow.png
+.. figure:: /_static/images/firewall-flowtable-packet-flow.*
 
 After the first packet successfully traverses the IP forwarding path (black
 circles path), you can offload subsequent packets to the flowtable through your
diff --git a/docs/configuration/firewall/index.rst b/docs/configuration/firewall/index.rst
index dc5af26f..c4b3c808 100644
--- a/docs/configuration/firewall/index.rst
+++ b/docs/configuration/firewall/index.rst
@@ -20,7 +20,7 @@ packet flow.
 This diagram provides an overview of how packets are processed and the
 possible paths traffic can take.
 
-.. figure:: /_static/images/firewall-gral-packet-flow.png
+.. figure:: /_static/images/firewall-gral-packet-flow.*
 
 The main points regarding packet flow and terminology in VyOS firewall
 are:
@@ -264,4 +264,4 @@ As the following example image shows, you must configure rules to allow or block
 traffic to or from the services running on the device that have open
 connections on that interface.
 
-.. figure:: /_static/images/firewall-zonebased.png
+.. figure:: /_static/images/firewall-zonebased.*
diff --git a/docs/configuration/firewall/ipv4.rst b/docs/configuration/firewall/ipv4.rst
index 0bac7e92..efd0fe18 100644
--- a/docs/configuration/firewall/ipv4.rst
+++ b/docs/configuration/firewall/ipv4.rst
@@ -53,7 +53,7 @@ For transit traffic, which is received by the router and forwarded, the base
 chain is **forward**. The following is a simplified packet flow diagram for
 transit traffic:
 
-.. figure:: /_static/images/firewall-fwd-packet-flow.png
+.. figure:: /_static/images/firewall-fwd-packet-flow.*
 
 The base firewall chain for configuring filtering rules for transit traffic is
 ``set firewall ipv4 forward filter ...``, which occurs in stage 5, highlighted
@@ -64,7 +64,7 @@ the router originates, the base chain is **output**. A simplified packet flow
 diagram is shown next, which shows the path for traffic destined to the router
 itself and traffic the router generates (starting from circle number 6):
 
-.. figure:: /_static/images/firewall-input-packet-flow.png
+.. figure:: /_static/images/firewall-input-packet-flow.*
 
 The base chain for traffic towards the router is
 ``set firewall ipv4 input filter ...``
diff --git a/docs/configuration/firewall/ipv6.rst b/docs/configuration/firewall/ipv6.rst
index b1249e3d..d31ceb6f 100644
--- a/docs/configuration/firewall/ipv6.rst
+++ b/docs/configuration/firewall/ipv6.rst
@@ -54,7 +54,7 @@ For transit traffic that the router receives and forwards, the base chain is
 **forward**. The following diagram shows a simplified packet flow for transit
 traffic:
 
-.. figure:: /_static/images/firewall-fwd-packet-flow.png
+.. figure:: /_static/images/firewall-fwd-packet-flow.*
 
 Use ``set firewall ipv6 forward filter ...`` to configure filtering rules for
 transit traffic. This command corresponds to stage 5 and is highlighted in red
@@ -65,7 +65,7 @@ router generates, use the **output** chain. The following diagram shows the
 packet flow for traffic destined to the router and traffic generated by the
 router (starting from circle number 6):
 
-.. figure:: /_static/images/firewall-input-packet-flow.png
+.. figure:: /_static/images/firewall-input-packet-flow.*
 
 Use ``set firewall ipv6 input filter ...`` to configure traffic destined to
 the router.
diff --git a/docs/configuration/interfaces/bonding.rst b/docs/configuration/interfaces/bonding.rst
index e0a374c3..7637790c 100644
--- a/docs/configuration/interfaces/bonding.rst
+++ b/docs/configuration/interfaces/bonding.rst
@@ -62,20 +62,23 @@ Bond modes
       :widths: 20 80
 
       * - **Description:**
-        - IEEE 802.3ad Dynamic Link Aggregation. Groups only member interfaces with 
-          the same speed (e.g., 1 Gbps) and duplex settings. Member interfaces with 
-          different speed and duplex settings are not included in the active bond.
-
-          Provides load balancing and fault tolerance. Uses the :abbr:`LACP (Link 
-          Aggregation Control Protocol)` to negotiate the bond with the switch.  
+        - IEEE 802.3ad Dynamic Link Aggregation. Groups only member
+          interfaces with the same speed (e.g., 1 Gbps) and duplex
+          settings. Member interfaces with different speed and duplex
+          settings are not included in the active bond.
+
+          Provides load balancing and fault tolerance. Uses the
+          :abbr:`LACP (Link Aggregation Control Protocol)` to
+          negotiate the bond with the switch.
       * - **Traffic distribution:**
-        - Traffic is distributed according to the **transmit hash policy** 
-          (default: XOR). 
-
-          The bonding driver applies an XOR operation to specific packet header fields, 
-          generating a hash value that maps to a particular member interface. This 
-          ensures the same network flow is consistently transmitted over the same member 
-          interface. 
+        - Traffic is distributed according to the **transmit hash
+          policy** (default: XOR).
+
+          The bonding driver applies an XOR operation to specific
+          packet header fields, generating a hash value that maps to
+          a particular member interface. This ensures the same network
+          flow is consistently transmitted over the same member
+          interface.
         
           The transmit hash policy is configured via the ``hash-policy`` option.
       * - **Failover:**
@@ -92,15 +95,16 @@ Bond modes
       :widths: 20 80
  
       * - **Description:**
-        - Provides fault tolerance. Only one member interface is active at a time. 
-          Other member interfaces remain in a standby mode.  
-      * - **Traffic distribution:**         
-        - All traffic (incoming and outgoing) is routed via one active member interface.
-      * - **Failover:**         
-        - If the designated member interface fails, all traffic is routed to
-          another member interface. The bonding driver sends a Gratuitous ARP 
-          to update the peer's MAC address table, linking the bond's MAC address 
-          to another physical port.
+        - Provides fault tolerance. Only one member interface is active
+          at a time. Other member interfaces remain in a standby mode.
+      * - **Traffic distribution:**
+        - All traffic (incoming and outgoing) is routed via one active
+          member interface.
+      * - **Failover:**
+        - If the designated member interface fails, all traffic is
+          routed to another member interface. The bonding driver sends
+          a Gratuitous ARP to update the peer's MAC address table,
+          linking the bond's MAC address to another physical port.
 
    * ``broadcast``
 
@@ -109,11 +113,12 @@ Bond modes
  
       * - **Description:**
         - Provides maximum fault tolerance by duplicating traffic.
-      * - **Traffic distribution:**         
-        - Every packet is duplicated and transmitted on **all** member interfaces.
-      * - **Failover:**         
-        - Traffic flow is not interrupted as long as at least one member interface 
-          remains active.
+      * - **Traffic distribution:**
+        - Every packet is duplicated and transmitted on **all** member
+          interfaces.
+      * - **Failover:**
+        - Traffic flow is not interrupted as long as at least one
+          member interface remains active.
 
    * ``round-robin``   
 
@@ -122,12 +127,13 @@ Bond modes
  
       * - **Description:**
         - Provides load balancing and fault tolerance.
-      * - **Traffic distribution:**         
-        - Packets are transmitted in sequential order across the member interfaces 
-          (e.g., packet 1 > interface A, packet 2 > interface B, etc.).
-      * - **Failover:**         
-        - If a member interface fails, the sequence skips the failed interface and 
-          continues with the remaining active members.
+      * - **Traffic distribution:**
+        - Packets are transmitted in sequential order across the member
+          interfaces (e.g., packet 1 > interface A, packet 2 >
+          interface B, etc.).
+      * - **Failover:**
+        - If a member interface fails, the sequence skips the failed
+          interface and continues with the remaining active members.
 
    * ``transmit-load-balance``   
 
@@ -136,14 +142,15 @@ Bond modes
  
       * - **Description:**
         - Provides adaptive transmit load balancing and fault tolerance.
-      * - **Traffic distribution:**         
-        - **Outgoing:** Distributed across all active member interfaces based on 
-          the current load.
+      * - **Traffic distribution:**
+        - **Outgoing:** Distributed across all active member interfaces
+          based on the current load.
 
-          **Incoming:** Received by a designated member interface (active receiver).
-      * - **Failover:**         
-        - If the active receiver fails, another member interface takes over as the new 
-          active receiver.
+          **Incoming:** Received by a designated member interface
+          (active receiver).
+      * - **Failover:**
+        - If the active receiver fails, another member interface takes
+          over as the new active receiver.
 
    * ``adaptive-load-balance``
 
@@ -151,75 +158,88 @@ Bond modes
       :widths: 20 80
 
       * - **Description:**
-        - Provides adaptive transmit load balancing identical to 
-          ``transmit-load-balance``, receive load balancing for IPv4 traffic, and fault 
-          tolerance for both incoming and outgoing traffic.
+        - Provides adaptive transmit load balancing identical to
+          ``transmit-load-balance``, receive load balancing for IPv4
+          traffic, and fault tolerance for both incoming and outgoing
+          traffic.
       * - **Traffic distribution:**
         - **Outgoing:** Identical to ``transmit-load-balance``.
 
-          **Incoming:** Distributed based on ARP manipulation. For both local and remote
-          connections, the bonding driver intercepts ARP traffic and changes the source
-          MAC address to the MAC address of the least loaded member interface. 
+          **Incoming:** Distributed based on ARP manipulation. For
+          both local and remote connections, the bonding driver
+          intercepts ARP traffic and changes the source MAC address
+          to the MAC address of the least loaded member interface.
 
-          All traffic from that peer is then routed to the chosen member interface.
+          All traffic from that peer is then routed to the chosen
+          member interface.
       * - **Failover:**
-        - If a member interface's state changes (fails, recovers, is added, or excluded),
-          the traffic is redistributed among all active member interfaces.
+        - If a member interface's state changes (fails, recovers, is
+          added, or excluded), the traffic is redistributed among all
+          active member interfaces.
 
-   * ``xor-hash``: Provides load balancing and fault tolerance based on a hash formula. 
-     Distributes traffic and handles failover identically to ``802.3ad``, but operates 
-     without the :abbr:`LACP (Link Aggregation Control Protocol)`.
+   * ``xor-hash``: Provides load balancing and fault tolerance
+     based on a hash formula. Distributes traffic and handles
+     failover identically to ``802.3ad``, but operates without
+     the :abbr:`LACP (Link Aggregation Control Protocol)`.
 
 .. cfgcmd:: set interfaces bonding <interface> min-links <0-16>
 
-   **Configure how many member interfaces must be active (in the link-up state) to 
-   mark the bonding interface UP (carrier asserted).**
+   **Configure how many member interfaces must be active (in the
+   link-up state) to mark the bonding interface UP (carrier
+   asserted).**
 
-   This command applies only when the bonding interface is configured in 802.3ad 
-   mode and functions like the Cisco EtherChannel min-links feature. It ensures 
-   that a bonding interface is marked UP (carrier asserted) only when a specified 
-   number of member interfaces are active (in the link-up state). This helps 
-   guarantee a minimum level of bandwidth for higher-level services (such as 
-   clustering) relying on the bonding interface. 
+   This command applies only when the bonding interface is configured
+   in 802.3ad mode and functions like the Cisco EtherChannel min-links
+   feature. It ensures that a bonding interface is marked UP (carrier
+   asserted) only when a specified number of member interfaces are
+   active (in the link-up state). This helps guarantee a minimum level
+   of bandwidth for higher-level services (such as clustering) relying
+   on the bonding interface.
 
-   The default value is 0. This marks the bonding interface UP (carrier asserted) 
-   whenever an active LACP aggregator exists, regardless of the number of member 
-   interfaces in that aggregator. 
+   The default value is 0. This marks the bonding interface UP
+   (carrier asserted) whenever an active LACP aggregator exists,
+   regardless of the number of member interfaces in that aggregator.
 
-   .. note:: In 802.3ad mode, a bond cannot be active without at least one active 
-      member interface. Therefore, setting min-links to 0 or 1 has the same result: 
-      the bonding interface is marked UP (carrier asserted).
+   .. note:: In 802.3ad mode, a bond cannot be active without at
+      least one active member interface. Therefore, setting min-links
+      to 0 or 1 has the same result: the bonding interface is marked
+      UP (carrier asserted).
 
 .. cfgcmd:: set interfaces bonding <interface> lacp-rate <slow|fast>
 
-   **Configure the rate at which the bonding interface requests its link 
-   partner to send** :abbr:`LACPDUs (Link Aggregation Control Protocol Data 
-   Units)` **in 802.3ad mode.**
+   **Configure the rate at which the bonding interface requests its
+   link partner to send**
+   :abbr:`LACPDUs (Link Aggregation Control Protocol Data Units)`
+   **in 802.3ad mode.**
 
-   This command applies only when the bonding interface is configured in 
-   802.3ad mode.
+   This command applies only when the bonding interface is configured
+   in 802.3ad mode.
 
    The following options are available:
 
-   * **slow (default):** Requests the link partner to transmit LACPDUs every 30 seconds.
+   * **slow (default):** Requests the link partner to transmit
+     LACPDUs every 30 seconds.
 
-   * **fast:** Requests the link partner to transmit LACPDUs every 1 second. 
+   * **fast:** Requests the link partner to transmit LACPDUs every
+     1 second.
 
 
 .. cfgcmd:: set interfaces bonding <interface> system-mac <mac address>
 
    **Configure a specific MAC address for the bonding interface.**
 
-   This sets the 802.3ad system MAC address, which is used for :abbr:`LACPDU (Link 
-   Aggregation Control Protocol Data Unit)` exchanges with the link partner. 
-   You can assign a fixed MAC address or generate a random one for these 
-   :abbr:`LACPDU (Link Aggregation Control Protocol Data Unit)` exchanges. 
+   This sets the 802.3ad system MAC address, which is used for
+   :abbr:`LACPDU (Link Aggregation Control Protocol Data Unit)`
+   exchanges with the link partner. You can assign a fixed MAC address
+   or generate a random one for these
+   :abbr:`LACPDU (Link Aggregation Control Protocol Data Unit)`
+   exchanges.
 
 
 .. cfgcmd:: set interfaces bonding <interface> hash-policy <policy>
 
-   **Configure which transmit hash policy to use for distributing traffic across 
-   member interfaces.**
+   **Configure which transmit hash policy to use for distributing
+   traffic across member interfaces.**
 
    The following policies are available:
 
@@ -229,10 +249,12 @@ Bond modes
         :widths: 20 80
 
         * - **Description:**
-          - Routes all traffic destined for a specific network peer through the same 
-            member interface. The policy is 802.3ad-compliant.
+          - Routes all traffic destined for a specific network peer
+            through the same member interface. The policy is
+            802.3ad-compliant.
         * - **Hash inputs:**
-          - Source MAC address, destination MAC address, and Ethernet packet type ID. 
+          - Source MAC address, destination MAC address, and Ethernet
+            packet type ID.
         * - **Formula:**
           - .. code-block:: none
 
@@ -245,13 +267,16 @@ Bond modes
         :widths: 20 80
 
         * - **Description:**
-          - Similar to ``layer2``, routes all traffic destined for a specific network 
-            peer through the same member interface and is IEEE 802.3ad-compliant. Uses 
-            both Layer 2 and Layer 3 information to provide a more balanced traffic distribution.
+          - Similar to ``layer2``, routes all traffic destined for a
+            specific network peer through the same member interface
+            and is IEEE 802.3ad-compliant. Uses both Layer 2 and
+            Layer 3 information to provide a more balanced traffic
+            distribution.
         * - **Hash inputs:**
-          - * Source MAC address, destination MAC address, and Ethernet packet type ID.
-            * Source IP address, destination IP address. IPv6 addresses are first hashed 
-              using ``IPv6_addr_hash``. 
+          - * Source MAC address, destination MAC address, and
+              Ethernet packet type ID.
+            * Source IP address, destination IP address. IPv6
+              addresses are first hashed using ``IPv6_addr_hash``.
         * - **Formula:**
           - .. code-block:: none
 
@@ -269,18 +294,21 @@ Bond modes
         :widths: 20 80
 
         * - **Description:**
-          - Routes different connections (flows) destined for a specific network peer 
-            through multiple member interfaces, but ensures each individual flow is 
-            routed through only one member interface.
-
-            .. note:: This policy is not fully 802.3ad-compliant. When a single TCP 
-               or UDP flow contains both fragmented and unfragmented packets, the 
-               algorithm may distribute them across different member interfaces. This 
-               may result in out-of-order packet delivery, violating the 802.3ad standard.
+          - Routes different connections (flows) destined for a
+            specific network peer through multiple member interfaces,
+            but ensures each individual flow is routed through only
+            one member interface.
+
+            .. note:: This policy is not fully 802.3ad-compliant.
+               When a single TCP or UDP flow contains both fragmented
+               and unfragmented packets, the algorithm may distribute
+               them across different member interfaces. This may
+               result in out-of-order packet delivery, violating the
+               802.3ad standard.
         * - **Hash inputs:**
           - * Source port, destination port (if available).
-            * Source IP address, destination IP address. IPv6 addresses are first hashed 
-              using ``IPv6_addr_hash``. 
+            * Source IP address, destination IP address. IPv6
+              addresses are first hashed using ``IPv6_addr_hash``.
         * - **Formula:**
           - .. code-block:: none
 
@@ -290,8 +318,9 @@ Bond modes
                hash = hash XOR (hash RSHIFT 8)
                member interface number = hash modulo member interface count
 
-            For fragmented TCP or UDP packets and all other IPv4 and IPv6 traffic, the 
-            source and destination port information is omitted.
+            For fragmented TCP or UDP packets and all other IPv4 and
+            IPv6 traffic, the source and destination port information
+            is omitted.
 
             For non-IP traffic, the formula is the same as for ``layer2``.
  
@@ -299,29 +328,33 @@ Bond modes
 
    **Configure the primary member interface in the bond.**
 
-   The primary member interface remains active as long as it is operational; 
-   alternative member interfaces are used only if it fails. 
+   The primary member interface remains active as long as it is
+   operational; alternative member interfaces are used only if it
+   fails.
 
-   Use this configuration when a specific member interface is preferred, 
-   such as one with higher throughput.
+   Use this configuration when a specific member interface is
+   preferred, such as one with higher throughput.
 
-   This command applies only to ``active-backup``, ``transmit-load-balance``, and 
-   ``adaptive-load-balance`` modes.
+   This command applies only to ``active-backup``,
+   ``transmit-load-balance``, and ``adaptive-load-balance`` modes.
 
 .. cfgcmd:: set interfaces bonding <interface> arp-monitor interval <time>
 
-   **Configure the ARP monitoring interval, in seconds, for the bonding interface.**
+   **Configure the ARP monitoring interval, in seconds, for the
+   bonding interface.**
 
-   ARP monitoring periodically assesses the health of each member interface by 
-   checking whether it has recently sent or received traffic (this criterion 
-   varies depending on the bonding mode and the member interface’s state). ARP 
-   probes are sent to the IP addresses specified with the arp-monitor target option.
+   ARP monitoring periodically assesses the health of each member
+   interface by checking whether it has recently sent or received
+   traffic (this criterion varies depending on the bonding mode and
+   the member interface’s state). ARP probes are sent to the IP
+   addresses specified with the arp-monitor target option.
 
-   When ARP monitoring is used with EtherChannel-compatible modes (such as 
-   ``round-robin`` or ``xor-hash``), the switch should be configured to distribute 
-   traffic across all member interfaces. If the switch distributes traffic using 
-   an XOR-based policy, all ARP replies will be received on one member interface, 
-   causing other member interfaces to be incorrectly marked as failed. 
+   When ARP monitoring is used with EtherChannel-compatible modes
+   (such as ``round-robin`` or ``xor-hash``), the switch should be
+   configured to distribute traffic across all member interfaces. If
+   the switch distributes traffic using an XOR-based policy, all ARP
+   replies will be received on one member interface, causing other
+   member interfaces to be incorrectly marked as failed.
 
    Setting this value to 0 disables ARP monitoring.
 
@@ -331,13 +364,13 @@ Bond modes
 
    **Configure the IP addresses for ARP monitoring requests.**
 
-   The bonding driver sends ARP requests to these IP addresses to check the 
-   state of member interfaces.
+   The bonding driver sends ARP requests to these IP addresses to
+   check the state of member interfaces.
 
-   To enable ARP monitoring, configure at least one IP address (up to 16 per 
-   bonding interface). 
+   To enable ARP monitoring, configure at least one IP address (up to
+   16 per bonding interface).
 
-   By default, no IP addresses are configured. 
+   By default, no IP addresses are configured.
 
 :abbr:`VLAN (Virtual Local Area Network)`
 =========================================
@@ -381,40 +414,46 @@ discriminator, or an Ethernet Segment Identifier Name (ESINAME).
 The following two commands generate a 10-byte Type-3 ESI by combining the 
 system MAC and local discriminator: 
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set interfaces bonding <interface> evpn es-id <1-16777215|10-byte ID>
 .. cfgcmd:: set interfaces bonding <interface> evpn es-sys-mac <xx:xx:xx:xx:xx:xx>
 
-  Alternatively, assign an ESINAME directly as a 10-byte Type-0 ESI using the 
-  following format: 00:AA:BB:CC:DD:EE:FF:GG:HH:II.
+  Alternatively, assign an ESINAME directly as a 10-byte Type-0 ESI
+  using the following format: 00:AA:BB:CC:DD:EE:FF:GG:HH:II.
 
   **BGP-EVPN route usage**
 
-  EVPN-MH uses BGP-EVPN route types 1 and 2 for ES discovery and MAC-IP 
-  synchronization:
+  EVPN-MH uses BGP-EVPN route types 1 and 2 for ES discovery and
+  MAC-IP synchronization:
 
-  * **Type 1 (EAD-per-ES and EAD-per-EVI)** routes advertise the locally 
-    attached ESs and discover remote ESs in the network. 
-  * **Type 2 (MAC-IP advertisement)** routes are advertised with a 
+  * **Type 1 (EAD-per-ES and EAD-per-EVI)** routes advertise the
+    locally attached ESs and discover remote ESs in the network.
+  * **Type 2 (MAC-IP advertisement)** routes are advertised with a
     destination ESI, enabling MAC-IP synchronization between ES peers.
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set interfaces bonding <interface> evpn es-df-pref <1-65535>
 
-  **Configure the** :abbr:`DF (Designated Forwarder)` **preference (1-65535) for 
-  the interface. A higher value indicates a higher preference to become the** 
-  :abbr:`DF (Designated Forwarder)`. **The** :abbr:`DF (Designated Forwarder)` 
+  **Configure the** :abbr:`DF (Designated Forwarder)` **preference (1-65535) for
+  the interface. A higher value indicates a higher preference to become the**
+  :abbr:`DF (Designated Forwarder)`. **The** :abbr:`DF (Designated Forwarder)`
   **preference is configured per-ES.**
 
-  The DF election process determines which interface in a specific ES forwards 
-  :abbr:`BUM (Broadcast, Unknown Unicast, and Multicast)` traffic from the EVPN 
-  overlay to the connected CE device. EVPN Type-4 (Ethernet Segment) routes are 
-  used to elect the DF, implementing the preference-based election method defined 
+  The DF election process determines which interface in a specific ES forwards
+  :abbr:`BUM (Broadcast, Unknown Unicast, and Multicast)` traffic from the EVPN
+  overlay to the connected CE device. EVPN Type-4 (Ethernet Segment) routes are
+  used to elect the DF, implementing the preference-based election method defined
   in RFC 9785.
 
-  Interfaces not elected as the DF drop any BUM traffic from the EVPN overlay 
-  using non-DF filters. Similarly, traffic received from ES peers via the EVPN 
-  overlay is blocked from forwarding to the CE device to maintain split-horizon 
+  Interfaces not elected as the DF drop any BUM traffic from the EVPN overlay
+  using non-DF filters. Similarly, traffic received from ES peers via the EVPN
+  overlay is blocked from forwarding to the CE device to maintain split-horizon
   filtering with local bias.
-  
+
+.. start_vyoslinter
+
 .. cmdinclude:: /_include/interface-evpn-uplink.txt
    :var0: bonding
    :var1: bond0
@@ -442,13 +481,14 @@ subinterface.
   set interfaces bonding bond0 member interface eth1
   set interfaces bonding bond0 member interface eth2
 
-.. note:: If you are running this configuration in a virtual environment like 
-   EVE-NG, ensure the e1000 driver is chosen for your VyOS NIC. The default 
-   drivers, such as ``virtio-net-pci`` or ``vmxnet3``, are incompatible with 
-   this configuration. Specifically, ICMP messages will not be processed correctly.
+.. note:: If you are running this configuration in a virtual environment like
+   EVE-NG, ensure the e1000 driver is chosen for your VyOS NIC. The default
+   drivers, such as ``virtio-net-pci`` or ``vmxnet3``, are incompatible with
+   this configuration. Specifically, ICMP messages will not be processed
+   correctly.
 
-   To check your NIC driver, use the following command: :opcmd:`show interfaces ethernet
-   eth0 physical | grep -i driver`
+   To check your NIC driver, use the following command:
+   :opcmd:`show interfaces ethernet eth0 physical | grep -i driver`
 
 Cisco Catalyst configuration
 ============================
@@ -486,8 +526,8 @@ such as allowed VLAN interfaces and STP, is applied here.
 Juniper EX Switch configuration
 ===============================
 
-Configure a Juniper EX Series switch to integrate with a two-member VyOS bonding 
-interface.
+Configure a Juniper EX Series switch to integrate with a two-member VyOS
+bonding interface.
 
 .. code-block:: none
 
@@ -536,7 +576,7 @@ between the two devices.
 
 Let's assume the following topology:
 
-.. figure:: /_static/images/vyos_arista_bond_lacp.png
+.. figure:: /_static/images/vyos_arista_bond_lacp.*
    :alt: VyOS Arista EOS setup
 
 **R1**
diff --git a/docs/configuration/interfaces/openvpn-examples.rst b/docs/configuration/interfaces/openvpn-examples.rst
index 4685e4df..6e746e46 100644
--- a/docs/configuration/interfaces/openvpn-examples.rst
+++ b/docs/configuration/interfaces/openvpn-examples.rst
@@ -38,7 +38,7 @@ In both cases, we will use the following settings:
   the remote router has a dynamic IP address.
 
 
-.. figure:: /_static/images/openvpn_site2site_diagram.jpg
+.. figure:: /_static/images/openvpn_site2site_diagram.*
 
 Set up site-to-site certificates
 --------------------------------
diff --git a/docs/configuration/interfaces/wireguard.rst b/docs/configuration/interfaces/wireguard.rst
index 1f7c875f..bc53b388 100644
--- a/docs/configuration/interfaces/wireguard.rst
+++ b/docs/configuration/interfaces/wireguard.rst
@@ -16,7 +16,7 @@ Site-to-site VPN
 
 The following diagram illustrates a site-to-site VPN setup.
 
-.. figure:: /_static/images/wireguard_site2site_diagram.jpg
+.. figure:: /_static/images/wireguard_site2site_diagram.*
 
 ********
 Keypairs
@@ -33,8 +33,9 @@ Generate keypair
 
    Generate a keypair: a public and a private key.
    
-   .. note:: This command only outputs the keys to your console. It neither stores 
-      them in the system nor applies them to the system configuration.
+   .. note:: This command only outputs the keys to your console. It
+      neither stores them in the system nor applies them to the system
+      configuration.
 
 
    .. code-block:: none
@@ -58,9 +59,9 @@ Generate keypair
 
      Corresponding public-key to use on peer system is: 'UxDsYT6EnpTIOKUzvMlw2p0sNOKQvFxEdSVrnNrX1Ro='
 
-   .. note:: If you invoke this command from configuration mode with the ``run`` 
-      prefix, the generated private key is automatically assigned to the specified 
-      interface. 
+   .. note:: If you invoke this command from configuration mode with
+      the ``run`` prefix, the generated private key is automatically
+      assigned to the specified interface.
 
    .. code-block:: none
 
@@ -103,10 +104,12 @@ Optional
      Pre-shared key: OHH2EwZfMNK+1L6BXbYw3bKCtMrfjpR4mCAEeBlFnRs=
 
 
+.. stop_vyoslinter
+
 .. opcmd:: generate pki wireguard preshared-key install interface <interface> peer <peer>
 
-   Generate a pre-shared key and output the key assignment command for the 
-   specified peer.
+   Generate a pre-shared key and output the key assignment command for
+   the specified peer.
 
    .. code-block:: none
 
@@ -119,8 +122,11 @@ Optional
      Pre-shared key: +LuaZ8W6DjsDFJFX3jJzoNqrsXHhvq08JztM9z8LHCs=
 
 
-   .. note:: If you invoke this command from configuration mode with the run 
-      prefix, the generated key is automatically assigned to the specified peer. 
+   .. note:: If you invoke this command from configuration mode with
+      the run prefix, the generated key is automatically assigned to
+      the specified peer.
+
+.. start_vyoslinter
 
 
 ***********************
@@ -133,7 +139,8 @@ networks you want to tunnel (``allowed-ips``).
 If your system only initiates connections, specifying the listen port is 
 optional. If your system accepts incoming connections, you must define a port 
 for peers to connect to. Otherwise, WireGuard selects a random port at each 
-reboot, and that may break your peers' ability to connect if that port is not enabled in your firewall rules.
+reboot, and that may break your peers' ability to connect if that port
+is not enabled in your firewall rules.
 
 To configure a WireGuard tunnel, you also need your peer's public key.
 
@@ -417,19 +424,16 @@ simplify deployment, generate a per-mobile configuration from the VyOS CLI.
   The public key from the specified interface is automatically included in the 
   configuration file.
 
-  The command also generates a configuration snippet that can be copied into the 
-  VyOS CLI. The ``<name>`` you provide will be used as the peer name in the 
-  snippet.
+  The command also generates a configuration snippet that can be copied
+  into the VyOS CLI. The ``<name>`` you provide will be used as the peer
+  name in the snippet.
 
-  You must also specify the IP address or FQDN of the server the client connects 
-  to. The address parameter can be used twice to assign both an IPv4 (/32) and 
-  an IPv6 (/128) address to the client.
+  You must also specify the IP address or FQDN of the server the client
+  connects to. The address parameter can be used twice to assign both an
+  IPv4 (/32) and an IPv6 (/128) address to the client.
 
-  .. figure:: /_static/images/wireguard_qrcode.jpg
+  .. figure:: /_static/images/wireguard_qrcode.*
      :alt: WireGuard Client QR code
 
-.. stop_vyoslinter
-
-.. _`WireGuard mailing list`: https://lists.zx2c4.com/pipermail/wireguard/2018-December/003704.html
-
-.. start_vyoslinter
+.. _`WireGuard mailing list`:
+   https://lists.zx2c4.com/pipermail/wireguard/2018-December/003704.html
diff --git a/docs/configuration/loadbalancing/wan.rst b/docs/configuration/loadbalancing/wan.rst
index b9a513bc..56fdb02c 100644
--- a/docs/configuration/loadbalancing/wan.rst
+++ b/docs/configuration/loadbalancing/wan.rst
@@ -203,7 +203,7 @@ Sticky connections
 Inbound connections to a WAN interface can be improperly handled when
 replies are sent back to the client.
 
-.. image:: /_static/images/sticky-connections.jpg
+.. image:: /_static/images/sticky-connections.*
    :width: 80%
    :align: center
 
diff --git a/docs/configuration/nat/nat44.rst b/docs/configuration/nat/nat44.rst
index fb0d5af9..63b787ba 100644
--- a/docs/configuration/nat/nat44.rst
+++ b/docs/configuration/nat/nat44.rst
@@ -692,7 +692,7 @@ The ASP requests that all connections from this company should come from
 172.29.41.89 - an address that is assigned by the ASP and not in use at
 the customer site.
 
-.. figure:: /_static/images/nat_before_vpn_topology.png
+.. figure:: /_static/images/nat_before_vpn_topology.*
    :scale: 100 %
    :alt: NAT before VPN Topology
 
diff --git a/docs/configuration/nat/nat66.rst b/docs/configuration/nat/nat66.rst
index be5cf2b3..aecce524 100644
--- a/docs/configuration/nat/nat66.rst
+++ b/docs/configuration/nat/nat66.rst
@@ -127,7 +127,7 @@ Use the following topology to build a nat66 based isolated
 network between internal and external networks (dynamic prefix is 
 not supported):
 
-.. figure:: /_static/images/vyos_1_4_nat66_simple.png
+.. figure:: /_static/images/vyos_1_4_nat66_simple.*
    :alt: VyOS NAT66 Simple Configure
 
 R1:
@@ -158,7 +158,7 @@ Use the following topology to translate internal user local addresses
 (``fc::/7``) to DHCPv6-PD provided prefixes from an ISP connected to
 a VyOS HA pair.
 
-.. figure:: /_static/images/vyos_1_5_nat66_dhcpv6_wdummy.png
+.. figure:: /_static/images/vyos_1_5_nat66_dhcpv6_wdummy.*
    :alt: VyOS NAT66 DHCPv6 using a dummy interface
 
 Configure both routers (a and b) for DHCPv6-PD via dummy interface:
diff --git a/docs/configuration/policy/examples.rst b/docs/configuration/policy/examples.rst
index d822d839..6c5c592a 100644
--- a/docs/configuration/policy/examples.rst
+++ b/docs/configuration/policy/examples.rst
@@ -99,7 +99,7 @@ Routing tables that will be used in this example are:
 * ``main`` Routing table used by VyOS and other interfaces not
   participating in PBR
 
-.. figure:: /_static/images/pbr_example_1.png
+.. figure:: /_static/images/pbr_example_1.*
    :scale: 80 %
    :alt: PBR multiple uplinks
 
diff --git a/docs/configuration/protocols/pim.rst b/docs/configuration/protocols/pim.rst
index 2e881943..f3f388ba 100644
--- a/docs/configuration/protocols/pim.rst
+++ b/docs/configuration/protocols/pim.rst
@@ -70,12 +70,17 @@ PIM-SM - PIM Sparse Mode
    This command is only useful at scale when you can possibly have a large
    number of PIM control packets flowing.
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set protocols pim register-accept-list <prefix-list>
 
-   When PIM receives a register packet the source of the packet will be compared
-   to the prefix-list specified, and if a permit is received normal processing
-   continues. If a deny is returned for the source address of the register packet
-   a register stop message is sent to the source.
+   When PIM receives a register packet the source of the packet will be
+   compared to the prefix-list specified, and if a permit is received
+   normal processing continues. If a deny is returned for the source
+   address of the register packet a register stop message is sent to
+   the source.
+
+.. start_vyoslinter
 
 .. cfgcmd:: set protocols pim register-suppress-time <n>
 
@@ -84,9 +89,10 @@ PIM-SM - PIM Sparse Mode
 
 .. cfgcmd:: set protocols pim rp <address> group <group>
 
-   In order to use PIM, it is necessary to configure a :abbr:`RP (Rendezvous Point)`
-   for join messages to be sent to. Currently the only methodology to do this is
-   via static rendezvous point commands.
+   In order to use PIM, it is necessary to configure a
+   :abbr:`RP (Rendezvous Point)` for join messages to be sent to.
+   Currently the only methodology to do this is via static rendezvous
+   point commands.
 
    All routers in the PIM network must agree on these values.
 
@@ -115,14 +121,19 @@ PIM-SM - PIM Sparse Mode
    nexthops in it's decision for :abbr:`RPF (Reverse Path Forwarding)` lookup
    if this option is not set (default).
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set protocols pim spt-switchover infinity-and-beyond [prefix-list <list>]
 
-   On the last hop router if it is desired to not switch over to the SPT tree
-   configure this command.
+   On the last hop router if it is desired to not switch over to the
+   SPT tree configure this command.
 
-   Optional parameter prefix-list can be use to control which groups to switch or
-   not switch. If a group is PERMIT as per the prefix-list, then the SPT switchover
-   does not happen for it and if it is DENY, then the SPT switchover happens.
+   Optional parameter prefix-list can be use to control which groups
+   to switch or not switch. If a group is PERMIT as per the
+   prefix-list, then the SPT switchover does not happen for it and if
+   it is DENY, then the SPT switchover happens.
+
+.. start_vyoslinter
 
 .. cfgcmd:: set protocols pim ssm prefix-list <list>
 
@@ -206,6 +217,8 @@ Interface specific commands
    not returned in the specified time, it will be assumed the (S,G) or
    (\*,G) state :rfc:`7761#section-4.1` has timed out.
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set protocols pim interface <interface> igmp version <version-number>
 
    Use this command to define in the selected interface whether you
@@ -213,12 +226,14 @@ Interface specific commands
 
    The default value is 3.
 
+.. start_vyoslinter
+
 Example
 -------
 
 In the following example we can see a basic multicast setup:
 
-.. image:: /_static/images/multicast-basic.png
+.. image:: /_static/images/multicast-basic.*
    :width: 90%
    :align: center
    :alt: Network Topology Diagram
diff --git a/docs/configuration/service/conntrack-sync.rst b/docs/configuration/service/conntrack-sync.rst
index 27bc977d..2527407e 100644
--- a/docs/configuration/service/conntrack-sync.rst
+++ b/docs/configuration/service/conntrack-sync.rst
@@ -56,6 +56,8 @@ Configuration
 
     Protocol for which expect entries need to be synchronized.
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set service conntrack-sync failover-mechanism vrrp sync-group <group>
 
     Failover mechanism to use for conntrack-sync.
@@ -64,7 +66,10 @@ Configuration
 
 .. cfgcmd:: set service conntrack-sync ignore-address <x.x.x.x>
 
-    IP addresses or networks for which local conntrack entries will not be synced
+    IP addresses or networks for which local conntrack entries will not
+    be synced
+
+.. start_vyoslinter
 
 .. cfgcmd:: set service conntrack-sync interface <name>
 
@@ -147,8 +152,9 @@ Operation
   .. note::
   
     If the table is empty and you have a warning message, it means
-    conntrack is not enabled. To enable conntrack, just create a NAT or a firewall
-    rule. :cfgcmd:`set firewall state-policy established action accept`
+    conntrack is not enabled. To enable conntrack, just create a NAT
+    or a firewall rule.
+    :cfgcmd:`set firewall state-policy established action accept`
 
 .. opcmd:: show conntrack-sync cache external
 
@@ -210,7 +216,7 @@ Example
 
 The next example is a simple configuration of conntrack-sync.
 
-.. figure:: /_static/images/service_conntrack_sync-schema.png
+.. figure:: /_static/images/service_conntrack_sync-schema.*
    :scale: 60 %
    :alt: Conntrack Sync Example
 
diff --git a/docs/configuration/service/dhcp-relay.rst b/docs/configuration/service/dhcp-relay.rst
index 632b2800..6a1b02f2 100644
--- a/docs/configuration/service/dhcp-relay.rst
+++ b/docs/configuration/service/dhcp-relay.rst
@@ -89,7 +89,7 @@ Example
 * Router receives DHCP client requests on ``eth1`` and relays them to the
   server at 10.0.1.4 on ``eth2``.
 
-.. figure:: /_static/images/service_dhcp-relay01.png
+.. figure:: /_static/images/service_dhcp-relay01.*
    :scale: 80 %
    :alt: DHCP relay example
 
@@ -177,7 +177,7 @@ Example
 * Requests are forwarded through ``eth2`` as the `upstream interface`
 * External DHCPv6 server is at 2001:db8::4
 
-.. figure:: /_static/images/service_dhcpv6-relay01.png
+.. figure:: /_static/images/service_dhcpv6-relay01.*
    :scale: 80 %
    :alt: DHCPv6 relay example
 
diff --git a/docs/configuration/service/snmp.rst b/docs/configuration/service/snmp.rst
index b444ab85..6dc13240 100644
--- a/docs/configuration/service/snmp.rst
+++ b/docs/configuration/service/snmp.rst
@@ -56,7 +56,7 @@ managed devices. NMSs provide the bulk of the processing and memory resources
 required for network management. One or more NMSs may exist on any managed
 network.
 
-.. figure:: /_static/images/service_snmp_communication_principles_diagram.png
+.. figure:: /_static/images/service_snmp_communication_principles_diagram.*
    :scale: 20 %
    :alt: Principle of SNMP Communication
 
diff --git a/docs/configuration/vpn/dmvpn.rst b/docs/configuration/vpn/dmvpn.rst
index 59f5af1e..30398a25 100644
--- a/docs/configuration/vpn/dmvpn.rst
+++ b/docs/configuration/vpn/dmvpn.rst
@@ -27,7 +27,7 @@ peers.
    complete solution also incorporates the use of a routing protocol. BGP is
    particularly well suited for use with DMVPN.
 
-.. figure:: /_static/images/vpn_dmvpn_topology01.png
+.. figure:: /_static/images/vpn_dmvpn_topology01.*
    :scale: 40 %
    :alt: Baseline DMVPN topology
 
@@ -64,9 +64,10 @@ To create NBMA GRE tunnel you might use the following:
 * Please refer to the :ref:`tunnel-interface` documentation for the individual
   tunnel related options.
 
-  .. note:: The IP-address is assigned as host prefix to tunnel interface.
-    NHRP will automatically create additional host routes pointing to tunnel interface
-    when a connection with these hosts is established.
+  .. note:: The IP-address is assigned as host prefix to tunnel
+    interface. NHRP will automatically create additional host routes
+    pointing to tunnel interface when a connection with these hosts is
+    established.
 
 The tunnel interface subnet prefix should be announced by routing protocol
 from the hub nodes (e.g. BGP ‘network’ announce). This allows the routing
@@ -112,46 +113,57 @@ NHRP protocol configuration
 
   * **network-id** - NHRP network id <1-4294967295>
 
-  Enable NHRP on this interface and set the interface’s network ID. The network ID
-  is used to allow creating multiple nhrp domains on a router when multiple interfaces
-  are configured on the router. Interfaces configured with the same ID are part of the
-  same logical NBMA network. The ID is a local only parameter and is not sent to other
-  NHRP nodes and so IDs on different nodes do not need to match. When NHRP packets are
-  received on an interface they are assigned to the local NHRP domain for that interface.
+  Enable NHRP on this interface and set the interface’s network ID.
+  The network ID is used to allow creating multiple nhrp domains on a
+  router when multiple interfaces are configured on the router.
+  Interfaces configured with the same ID are part of the same logical
+  NBMA network. The ID is a local only parameter and is not sent to
+  other NHRP nodes and so IDs on different nodes do not need to match.
+  When NHRP packets are received on an interface they are assigned to
+  the local NHRP domain for that interface.
+
+.. stop_vyoslinter
 
 .. cfgcmd:: set protocols nhrp tunnel <tunnel> nhs tunnel-ip <tunnel-ip> nbma <nbma-ip>
 
   * **tunnel-ip** - Tunnel ip address in format **x.x.x.x** or **dynamic**
   * **nbma-ip** - NBMA ip address in format **x.x.x.x**
 
-  Configure the Next Hop Server address and its NBMA address. If dynamic is specified
-  then Next Hop Server can have dynamic address which maps to its NBMA address.
+  Configure the Next Hop Server address and its NBMA address. If
+  dynamic is specified then Next Hop Server can have dynamic address
+  which maps to its NBMA address.
+
+.. start_vyoslinter
 
 .. cfgcmd:: set protocols nhrp tunnel <tunnel> redirect
 
-  This enable redirect replies on the NHS similar to ICMP redirects except this is
-  managed by the nhrp protocol. This setting allows spokes to communicate with each
-  others directly.
+  This enable redirect replies on the NHS similar to ICMP redirects
+  except this is managed by the nhrp protocol. This setting allows
+  spokes to communicate with each others directly.
 
 .. cfgcmd:: set protocols nhrp tunnel <tunnel> registration-no-unique
 
-  Allow the client to not set the unique flag in the NHRP packets. This is useful when
-  a station has a dynamic IP address that could change over time.
+  Allow the client to not set the unique flag in the NHRP packets.
+  This is useful when a station has a dynamic IP address that could
+  change over time.
 
 .. cfgcmd:: set protocols nhrp tunnel <tunnel> shortcut
 
-  Enable shortcut (spoke-to-spoke) tunnels to allow NHC to talk to each others directly
-  after establishing a connection without going through the hub.
+  Enable shortcut (spoke-to-spoke) tunnels to allow NHC to talk to
+  each others directly after establishing a connection without going
+  through the hub.
 
 IPSEC configuration
 ==============================
 
-* Please refer to the :ref:`ipsec_general` documentation for the individual IPSec
-  related options.
+* Please refer to the :ref:`ipsec_general` documentation for the
+  individual IPSec related options.
 
-.. note:: NHRP daemon based on FRR nhrpd. It controls IPSEC. That's why 'close-action'
-  parameter in IKE configuration always is set to 'close' and 'dead-peer-detection action'
-  always is set to 'clear'.
+.. note:: NHRP daemon based on FRR nhrpd. It controls IPSEC. That's
+  why 'close-action' parameter in IKE configuration always is set to
+  'close' and 'dead-peer-detection action' always is set to 'clear'.
+
+.. stop_vyoslinter
 
 .. cfgcmd:: set vpn ipsec profile <profile-name> authentication mode pre-shared-secret
 
@@ -161,6 +173,8 @@ IPSEC configuration
 
   Set preshared secret
 
+.. start_vyoslinter
+
 .. cfgcmd:: set vpn ipsec profile <profile-name> bind tunnel <tunnel name>
 
   Bind IPSEC profile to the specific tunnel interface.
@@ -195,7 +209,7 @@ Example
 This blueprint uses VyOS as the DMVPN Hub and Cisco IOSv 15.5(3)M and VyOS as
 multiple spoke sites.
 
-.. figure:: /_static/images/blueprint-dmvpn.png
+.. figure:: /_static/images/blueprint-dmvpn.*
    :width: 70%
    :align: center
    :alt: DMVPN Network Topology Diagram
diff --git a/docs/configuration/vpn/ipsec/ipsec_general.rst b/docs/configuration/vpn/ipsec/ipsec_general.rst
index 873f4f51..3d21b81d 100644
--- a/docs/configuration/vpn/ipsec/ipsec_general.rst
+++ b/docs/configuration/vpn/ipsec/ipsec_general.rst
@@ -32,7 +32,7 @@ There are two IPsec modes:
         another IP datagram, and an IPsec header (AH or ESP) is
         inserted between the outer and inner headers.
 
-.. figure:: /_static/images/ESP_AH.png
+.. figure:: /_static/images/ESP_AH.*
    :scale: 80 %
    :alt: AH and ESP in Transport Mode and Tunnel Mode
 
@@ -143,8 +143,9 @@ You can view the PPK column for information on if PPK is configured, and
 if it is in use. The output is in the format of ``<configured> / <in use>``. 
 The options for configured are none if not conifugred, opt if configured 
 but optional, and req is configured and required. The in use will show yes 
-Possible values of the ``configured`` field are ``none`` if not conifgured, ``opt`` if configured 
-but optional, and ``req`` is configured and required. The in use will show yes 
+Possible values of the ``configured`` field are ``none`` if not
+conifgured, ``opt`` if configured but optional, and ``req`` is
+configured and required. The in use will show yes
 
 
 
@@ -200,6 +201,8 @@ VyOS IKE group has the next options:
  * **aggressive** - Use Aggressive mode for Key Exchanges in the IKEv1
    protocol aggressive mode is much more insecure compared to Main mode.
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set vpn ipsec ike-group <name> proposal <number> dh-group <dh-group number>
 
   Dh-group. Default value is **2**.
@@ -208,6 +211,8 @@ VyOS IKE group has the next options:
 
   Encryption algorithm. Default value is **aes128**.
 
+.. start_vyoslinter
+
 .. cfgcmd:: set vpn ipsec ike-group <name> proposal <number> hash <hash>
 
   Hash algorithm. Default value is **sha1**.
@@ -232,10 +237,14 @@ DPD (Dead Peer Detection) Configuration
   * **restart** - Immediately tries to re-negotiate the CHILD_SA
     under a fresh IKE_SA.
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set vpn ipsec ike-group <name> dead-peer-detection interval <interval>
 
   Keep-alive interval in seconds <2-86400> (default 30).
 
+.. start_vyoslinter
+
 .. cfgcmd:: set vpn ipsec ike-group <name> dead-peer-detection timeout <timeout>
 
   Keep-alive timeout in seconds <2-86400> (default 120) **IKEv1 only**
@@ -292,10 +301,14 @@ VyOS ESP group has the next options:
  * **disable** - Disable PFS.
  * **<dh-group>** - Defines a Diffie-Hellman group for PFS.
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set vpn ipsec esp-group <name> proposal <number> encryption <encryption>
 
   Encryption algorithm. Default value is **aes128**.
 
+.. start_vyoslinter
+
 .. cfgcmd:: set vpn ipsec esp-group <name> proposal <number> hash <hash>
 
   Hash algorithm. Default value is **sha1**.
@@ -351,7 +364,8 @@ Options
 IKEv2 Retransmission
 ====================
 
-If the peer does not respond on DPD packet, the router starts retransmission procedure.
+If the peer does not respond on DPD packet, the router starts the
+retransmission procedure.
 
 The following formula is used to calculate the timeout:
 
diff --git a/docs/configuration/vpn/ipsec/site2site_ipsec.rst b/docs/configuration/vpn/ipsec/site2site_ipsec.rst
index 227621ac..9f8231e7 100644
--- a/docs/configuration/vpn/ipsec/site2site_ipsec.rst
+++ b/docs/configuration/vpn/ipsec/site2site_ipsec.rst
@@ -78,7 +78,8 @@ Tunnel information:
     * If Route based VPN is used
         * IP of the VTI interface is 10.0.0.1/30
 
-.. note:: We do not recommend using policy-based vpn and route-based vpn configurations to the same peer.
+.. note:: We do not recommend using policy-based vpn and route-based
+   vpn configurations to the same peer.
 
 **1. Configure ike-group (IKE Phase 1)**
 
@@ -108,7 +109,8 @@ Tunnel information:
 
     set vpn ipsec interface eth0
 
-**4. Configure PSK keys and authentication ids for this key if authentication type is PSK**
+**4. Configure PSK keys and authentication ids for this key if
+authentication type is PSK**
 
 .. code-block:: none
 
@@ -146,14 +148,16 @@ To set base64 secret encode plaintext password to base64 and set secret-type
 
 **6. Depends to vpn type (route-based vpn or policy-based vpn).**
 
-   **6.1 For Policy-based VPN configure SAs using tunnel command specifying remote and local networks.**
+   **6.1 For Policy-based VPN configure SAs using tunnel command
+   specifying remote and local networks.**
 
     .. code-block:: none
 
         set vpn ipsec site-to-site peer PEER1 tunnel 1 local prefix '192.168.10.0/24'
         set vpn ipsec site-to-site peer PEER1 tunnel 1 remote prefix '192.168.50.0/24'
 
-   **6.2 For Route-based VPN create VTI interface, set IP address to this interface and bind this interface to the vpn peer.**
+   **6.2 For Route-based VPN create VTI interface, set IP address to
+   this interface and bind this interface to the vpn peer.**
 
     .. code-block:: none
 
@@ -184,7 +188,7 @@ The result of wrong value selection can be unstable work of the VPN.
 Below flow-chart could be a quick reference for the close-action
 combination depending on how the peer is configured.
 
-.. figure:: /_static/images/IPSec_close_action_settings.png
+.. figure:: /_static/images/IPSec_close_action_settings.*
 
 Similar combinations are applicable for the dead-peer-detection.
 
@@ -243,6 +247,8 @@ Peer Authentication Commands
   address. Useful in case if the remote peer is behind NAT
   or if ``mode x509`` is used.
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set vpn ipsec site-to-site peer <name> authentication rsa local-key <key>
 
   Name of PKI key-pair with local private key.
@@ -270,6 +276,8 @@ Peer Authentication Commands
   Name of certificate in PKI configuration, which will be used
   for authenticating local router on remote peer.
 
+.. start_vyoslinter
+
 .. cfgcmd:: set vpn ipsec authentication x509 passphrase <passphrase>
 
   Private key passphrase, if needed.
@@ -370,6 +378,8 @@ Policy-Based CHILD SAs Configuration Commands
 
 Every configured tunnel under peer configuration is a new CHILD SA.
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set vpn ipsec site-to-site peer <name> tunnel <number> disable
 
   Disable this tunnel.
@@ -406,6 +416,8 @@ Every configured tunnel under peer configuration is a new CHILD SA.
   Remote port number. Have effect only when used together with
   ``prefix``.
 
+.. start_vyoslinter
+
 Route-Based CHILD SAs Configuration Commands
 """""""""""""""""""""""""""""""""""""""""""""
 
@@ -435,6 +447,8 @@ for each remote network.
 Traffic-selectors parameters for traffic that should pass via vti
 interface.
 
+.. stop_vyoslinter
+
 .. cfgcmd:: set vpn ipsec site-to-site peer <name> vti traffic-selector local prefix <network>
 
   Local prefix for interesting traffic.
@@ -443,6 +457,8 @@ interface.
 
   Remote prefix for interesting traffic.
 
+.. start_vyoslinter
+
 IPsec Op-mode Commands
 ======================
 
diff --git a/docs/configuration/vrf/index.rst b/docs/configuration/vrf/index.rst
index f41e98a2..5965f857 100644
--- a/docs/configuration/vrf/index.rst
+++ b/docs/configuration/vrf/index.rst
@@ -20,8 +20,8 @@ then enslaved to a VRF device.
 
 .. cfgcmd:: set vrf name <name> table <id>
 
-   Create a new VRF instance with `<name>` and `<id>`. The name is used when placing
-   individual interfaces into the VRF.
+   Create a new VRF instance with `<name>` and `<id>`. The name is
+   used when placing individual interfaces into the VRF.
 
    .. note:: A routing table ID can not be modified once it is assigned. It can
       only be changed by deleting and re-adding the VRF instance.
@@ -66,9 +66,10 @@ can be used to filter which routes zebra will install in the kernel.
 Nexthop Tracking
 ----------------
 
-Nexthop tracking resolve nexthops via the default route by default. This is enabled
-by default for a traditional profile of FRR which we use. It and can be disabled if
-you do not want to e.g. allow BGP to peer across the default route.
+Nexthop tracking resolve nexthops via the default route by default.
+This is enabled by default for a traditional profile of FRR which we
+use. It and can be disabled if you do not want to e.g. allow BGP to
+peer across the default route.
 
 .. cfgcmd:: set vrf name <name> ip nht no-resolve-via-default
 
@@ -230,8 +231,8 @@ For VRF maintenance the following operational commands are in place.
    the round-trip time of these packets is used in calculating the minimum/
    average/maximum round-trip time numbers.
 
-   .. note:: Ping command can be interrupted at any given time using ``<Ctrl>+c``.
-     A brief statistic is shown afterwards.
+   .. note:: Ping command can be interrupted at any given time using
+     ``<Ctrl>+c``. A brief statistic is shown afterwards.
 
    .. code-block:: none
 
@@ -272,7 +273,7 @@ VRF route leaking
 
 The following example topology was built using EVE-NG.
 
-.. figure:: /_static/images/vrf-example-topology-01.png
+.. figure:: /_static/images/vrf-example-topology-01.*
    :alt: VRF topology example
 
    VRF route leaking
@@ -535,9 +536,9 @@ address-family.
 .. cfgcmd:: set vrf name <name> protocols bgp interface <interface> mpls
             forwarding
 
-   It is possible to permit BGP install VPN prefixes without transport labels.
-   This configuration will install VPN prefixes originated from an e-bgp session,
-   and with the next-hop directly connected.
+   It is possible to permit BGP install VPN prefixes without transport
+   labels. This configuration will install VPN prefixes originated
+   from an e-bgp session, and with the next-hop directly connected.
 
 .. _l3vpn-vrf example operation: