cluster: document that PullImage assumes that the buffer is safe