container: always pull image in a separate task before container creation

roles/container/tasks/image.yml

@@ -17,4 +17,25 @@
         build:
           pull: true
           path: "/opt/{{ docker_service }}"
-      register: docker_built_image
+      register: built_image
+
+- name: Pull container image for {{ docker_service }}
+  docker_image:
+    name: "{{ docker_image }}"
+    source: pull
+    force_source: true
+  register: pulled_image
+  when: dockerfile is not defined or dockerfile | length == 0
+
+- name: Set container_image variable
+  set_fact:
+    container_image: "{{ item }}"
+  when: item.skipped is not defined or not item.skipped
+  loop:
+    - "{{ built_image }}"
+    - "{{ pulled_image }}"
+
+- name: Set image user variable
+  set_fact:
+    image_user: "{{ container_image.image.Config.User }}"
+  when: container_image.image.Config.User | length > 0