Elasticsearch is already installed in docker images that I'm using. Possibly it was made with deb package but would need to check it to be 100% sure, still does it matter for plugin installation how was elasticsearch installed( now I'm curcious) ? Also it is on machine that has no internet access so the easiest way to install x-pack for me is by installing it from zip file.
Also I did doublecheck if I have it installed and does not look like it, this is all I get when checking plugins in elastic:
server1 ingest-geoip 6.3.0
server1 ingest-user-agent 6.3.0