switch to explicitly versioned docker images and pull_if_missing