ensure we have the weavetools image

prior to entering any time-sensitive code, in particular
post-container-startup network configuration.

weave

@@ -132,8 +132,6 @@ create_bridge() {
         ip link add name v${CONTAINER_IFNAME}du mtu $MTU type dummy
         ip link set dev v${CONTAINER_IFNAME}du master $BRIDGE
         ip link del dev v${CONTAINER_IFNAME}du
-        # disable offloading
-        run_tool host ethtool -K $BRIDGE tx off >/dev/null
         # Work around the situation where there are no rules allowing traffic
         # across our bridge. E.g. ufw
         add_iptables_rule filter FORWARD -i $BRIDGE -o $BRIDGE -j ACCEPT
@@ -141,6 +139,12 @@ create_bridge() {
         run_iptables -t nat -N WEAVE >/dev/null 2>&1 || true
         add_iptables_rule nat POSTROUTING -j WEAVE
     }
+    # disable offloading - we do this even when $BRIDGE already exists
+    # simply because it has the desirable side-effect of ensuring we
+    # have the $TOOLS_IMAGE and thus do not incur downloading-induced
+    # delays in more time-sensitive sections elsewhere.
+    run_tool host ethtool -K $BRIDGE tx off >/dev/null
+
     ip link set dev $BRIDGE up
 }