> on nightly

Just to make it clear: it wasn't pinned to `latest`, we created a small script that would probe the docker registry and enumerate all the tagged images (e.g. 15.3.2, 16.4.1, ...), sort, pick the latest of those tagged, and apply it. It was probably 1-3 updates per week. Still, it was a really good run despite the couple hiccups mentioned above.