actually make use of docker::run pull_on_start

 * This is documented in the README, but wasn't really used anywhere.

 * The systemd template by default pulls, which clearly isn't going to
   work if the image is not in a registry, but is built via
   docker::image with Dockerfile or so.