split things out so more can be shared between CIs
this works better with registries like hub.docker.com that don't allow nested images