This seems to work -- I can't shell in to a running build container itself because CircleCI doesn't support docker exec, but launching a new instance does allow to connect to the X server on the host.
For now this hard-codes the default IP address used for the docker0 bridge and client. We can do a little more work with some awk'ing to get the values dynamically.
Also adds a check for whether docker pull actually updated anything, to avoid re-saving the image unnecessarily (saves 3-5 minutes).