diff --git a/drivers/docker/network.go b/drivers/docker/network.go
index bd0b6b61b292..263f86d1fc78 100644
--- a/drivers/docker/network.go
+++ b/drivers/docker/network.go
@@ -28,24 +28,8 @@ func (d *Driver) CreateNetwork(allocID string, createSpec *drivers.NetworkCreate
 		return nil, false, fmt.Errorf("failed to connect to docker daemon: %s", err)
 	}
 
-	repo, tag := parseDockerImage(d.config.InfraImage)
-
-	// Pull the InfraImage only if it doesn't exist locally, or uses the "latest" tag
-	if dockerImage, _ := client.InspectImage(d.config.InfraImage); dockerImage == nil || tag == "latest" {
-		authOptions, err := firstValidAuth(repo, []authBackend{
-			authFromDockerConfig(d.config.Auth.Config),
-			authFromHelper(d.config.Auth.Helper),
-		})
-		if err != nil {
-			d.logger.Debug("auth failed for infra container image pull", "image", d.config.InfraImage, "error", err)
-		}
-		_, err = d.coordinator.PullImage(d.config.InfraImage, authOptions, allocID, noopLogEventFn, d.config.infraImagePullTimeoutDuration, d.config.pullActivityTimeoutDuration)
-		if err != nil {
-			return nil, false, err
-		}
-	} else {
-		// Image exists, so just increment its reference count
-		d.coordinator.IncrementImageReference(dockerImage.ID, d.config.InfraImage, allocID)
+	if err := d.pullInfraImage(allocID); err != nil {
+		return nil, false, err
 	}
 
 	config, err := d.createSandboxContainerConfig(allocID, createSpec)
@@ -131,3 +115,39 @@ func (d *Driver) createSandboxContainerConfig(allocID string, createSpec *driver
 		},
 	}, nil
 }
+
+// pullInfraImage conditionally pulls the `infra_image` from the Docker registry
+// only if its name uses the "latest" tag or the image doesn't already exist locally.
+func (d *Driver) pullInfraImage(allocID string) error {
+	name := d.config.InfraImage
+	repo, tag := parseDockerImage(name)
+
+	doPull := func() error {
+		authOptions, err := firstValidAuth(repo, []authBackend{
+			authFromDockerConfig(d.config.Auth.Config),
+			authFromHelper(d.config.Auth.Helper),
+		})
+		if err != nil {
+			d.logger.Debug("auth failed for infra_image container pull", "image", name, "error", err)
+		}
+		_, err = d.coordinator.PullImage(name, authOptions, allocID, noopLogEventFn, d.config.infraImagePullTimeoutDuration, d.config.pullActivityTimeoutDuration)
+
+		return err
+	}
+
+	if tag == "latest" {
+		return doPull()
+	}
+
+	dockerImage, err := client.InspectImage(name)
+	if err != nil {
+		d.logger.Debug("InspectImage failed for infra_image container pull", "image", name, "error", err)
+		return err
+	} else if dockerImage != nil {
+		// Image exists, so no pull is attempted; just increment its reference count
+		d.coordinator.IncrementImageReference(dockerImage.ID, name, allocID)
+		return nil
+	}
+
+	return doPull()
+}