What do I need to do as to prevent docker from downloading when I `run`? If I don’t want anything to download when I run
 docker run -ti --rm \
            -v /home/sable/heudiconvTest/BIDS:ro \
            -v /home/sable/heudiconvTest/qsipOutput:/out \
            pennbbl/qsiprep:latest \
            /data /out participant

What do I need to do? Do I just do pull pennbbl/qsiprep:latest and that’s it?
Provided that the commands run on the same machine, yes, that should work.
To be even safer and to make it clearer, I would use an explicit version tag, such as 0.9.0beta1, or 0.8.0, instead of latest.