pin used revisions in Dockerfile