docker: pull latest before building image