Docker's --tmpfs defaults to noexec, which prevents all chroot'd pacman post-transaction hooks from executing (mkinitcpio, sysusers, etc.). The missing vmlinuz was a symptom — noexec meant the linux package install hooks couldn't generate the initramfs.