provisioners/docker: always pull images [GH-2901]