container: always pull image in a separate task before container creation

roles/container/tasks/image.yml

@@ -17,4 +17,25 @@
         build:
           pull: true
           path: "/opt/{{ docker_service }}"
-      register: docker_built_image
+      register: built_image
+
+- name: Pull container image for {{ docker_service }}
+  docker_image:
+    name: "{{ docker_image }}"
+    source: pull
+    force_source: true
+  register: pulled_image
+  when: dockerfile is not defined or dockerfile | length == 0
+
+- name: Set container_image variable
+  set_fact:
+    container_image: "{{ item }}"
+  when: item.skipped is not defined or not item.skipped
+  loop:
+    - "{{ built_image }}"
+    - "{{ pulled_image }}"
+
+- name: Set image user variable
+  set_fact:
+    image_user: "{{ container_image.image.Config.User }}"
+  when: container_image.image.Config.User | length > 0

roles/container/tasks/main.yml

@@ -54,7 +54,7 @@
 - name: "Container for {{ docker_service_name }}"
   docker_container:
     name: "{{ docker_service_name }}"
-    image: "{{ docker_built_image.image.Id if dockerfile is defined and not ansible_check_mode else docker_image }}"
+    image: "{{ container_image.image.Id }}"
     user: "{{ docker_user | default(omit) }}"
     pull: "{{ dockerfile is not defined }}"
     volumes: "{{ docker_volume_definition }}"