This isn't optimal since theoretically there could be an image pushed
just between building and downloading again, but variables cannot be
used within gitlab-ci.yml so that is what we have to work with. If
variables get introduced, we should lock this to the current commit sha.