provision/docker: pull image on creation closes #602