run: pull only latest when no tag specified

This PR makes Docker pull only the image tagged as latest when no tag has been specified. This makes Docker pull only the image it'll run.

Fixes #5047