We should handle this just like backstop. Pull in a docker container for this sort of thing. It would be best if it's the same container we use for backstop, so we'll probably have to roll our own, or it would take forever to download 2 images for a CI build.