provision/docker: remove image only once