provision/docker: add retry on pull