Simply, always pull the image: this checks the hash anyway, and takes <2s when the image does not have to be updated