Say your Dockerfile starts with
FROM quay.io/foo/bar:latest. If your local system already has an image with that tag, it uses it, and the registry is never contacted. If it doesn’t, then it will pull that image from the registry and use it for the present build, and it will be available for future builds.
The “better” solution, which takes a fair bit of manual management, is to encode a specific build tag in your Dockerfile,
FROM quay.io/foo/bar:20171127.01. This can get hard to manage if your base images update frequently and/or you have many downstream images, though; you might be able to use a script wrapper to help you along. (Is there a prebuilt solution for this?)
The easier solution is to explicitly
docker pull the base image before you build. It’s less reproducible, but will generally work, especially if your base images are things like “current Ubuntu plus software updates plus two commonly used packages” where building older software on a newer base isn’t a problem.