provision/docker: use safe buffer to prevent data races in pull image