ensure new container images are downloaded

Now, after a container image is downloaded, it will never be refreshed again. we don't want to hit the network on every run, but we do need to update the image from time to time.