Handle docker refs correctly in policy/docker