docker pulls: rate limited by upstream service