diff --git a/contrib/mesos/pkg/scheduler/service/service.go b/contrib/mesos/pkg/scheduler/service/service.go
index 64a87a6ebe5..fc71ad4ff87 100644
--- a/contrib/mesos/pkg/scheduler/service/service.go
+++ b/contrib/mesos/pkg/scheduler/service/service.go
@@ -117,10 +117,11 @@ type SchedulerServer struct {
 	checkpoint          bool
 	failoverTimeout     float64
 
-	executorLogV           int
-	executorBindall        bool
-	executorSuicideTimeout time.Duration
-	launchGracePeriod      time.Duration
+	executorLogV                   int
+	executorBindall                bool
+	executorSuicideTimeout         time.Duration
+	launchGracePeriod              time.Duration
+	kubeletEnableDebuggingHandlers bool
 
 	runProxy     bool
 	proxyBindall bool
@@ -196,24 +197,25 @@ func NewSchedulerServer() *SchedulerServer {
 		minionLogMaxBackups:   minioncfg.DefaultLogMaxBackups,
 		minionLogMaxAgeInDays: minioncfg.DefaultLogMaxAgeInDays,
 
-		mesosAuthProvider:    sasl.ProviderName,
-		mesosCgroupPrefix:    minioncfg.DefaultCgroupPrefix,
-		mesosMaster:          defaultMesosMaster,
-		mesosUser:            defaultMesosUser,
-		mesosExecutorCPUs:    defaultExecutorCPUs,
-		mesosExecutorMem:     defaultExecutorMem,
-		frameworkRoles:       strings.Split(defaultFrameworkRoles, ","),
-		defaultPodRoles:      strings.Split(defaultPodRoles, ","),
-		reconcileInterval:    defaultReconcileInterval,
-		reconcileCooldown:    defaultReconcileCooldown,
-		checkpoint:           true,
-		frameworkName:        defaultFrameworkName,
-		ha:                   false,
-		mux:                  http.NewServeMux(),
-		kubeletCadvisorPort:  4194, // copied from github.com/GoogleCloudPlatform/kubernetes/blob/release-0.14/cmd/kubelet/app/server.go
-		kubeletSyncFrequency: 10 * time.Second,
-		containPodResources:  true,
-		nodeRelistPeriod:     defaultNodeRelistPeriod,
+		mesosAuthProvider:              sasl.ProviderName,
+		mesosCgroupPrefix:              minioncfg.DefaultCgroupPrefix,
+		mesosMaster:                    defaultMesosMaster,
+		mesosUser:                      defaultMesosUser,
+		mesosExecutorCPUs:              defaultExecutorCPUs,
+		mesosExecutorMem:               defaultExecutorMem,
+		frameworkRoles:                 strings.Split(defaultFrameworkRoles, ","),
+		defaultPodRoles:                strings.Split(defaultPodRoles, ","),
+		reconcileInterval:              defaultReconcileInterval,
+		reconcileCooldown:              defaultReconcileCooldown,
+		checkpoint:                     true,
+		frameworkName:                  defaultFrameworkName,
+		ha:                             false,
+		mux:                            http.NewServeMux(),
+		kubeletCadvisorPort:            4194, // copied from github.com/GoogleCloudPlatform/kubernetes/blob/release-0.14/cmd/kubelet/app/server.go
+		kubeletSyncFrequency:           10 * time.Second,
+		kubeletEnableDebuggingHandlers: true,
+		containPodResources:            true,
+		nodeRelistPeriod:               defaultNodeRelistPeriod,
 	}
 	// cache this for later use. also useful in case the original binary gets deleted, e.g.
 	// during upgrades, development deployments, etc.
@@ -291,6 +293,7 @@ func (s *SchedulerServer) addCoreFlags(fs *pflag.FlagSet) {
 	fs.StringVar(&s.kubeletHostNetworkSources, "kubelet-host-network-sources", s.kubeletHostNetworkSources, "Comma-separated list of sources from which the Kubelet allows pods to use of host network. For all sources use \"*\" [default=\"file\"]")
 	fs.DurationVar(&s.kubeletSyncFrequency, "kubelet-sync-frequency", s.kubeletSyncFrequency, "Max period between synchronizing running containers and config")
 	fs.StringVar(&s.kubeletNetworkPluginName, "kubelet-network-plugin", s.kubeletNetworkPluginName, "<Warning: Alpha feature> The name of the network plugin to be invoked for various events in kubelet/pod lifecycle")
+	fs.BoolVar(&s.kubeletEnableDebuggingHandlers, "kubelet-enable-debugging-handlers", s.kubeletEnableDebuggingHandlers, "Enables kubelet endpoints for log collection and local running of containers and commands")
 
 	//TODO(jdef) support this flag once we have a better handle on mesos-dns and k8s DNS integration
 	//fs.StringVar(&s.HADomain, "ha-domain", s.HADomain, "Domain of the HA scheduler service, only used in HA mode. If specified may be used to construct artifact download URIs.")
@@ -409,6 +412,7 @@ func (s *SchedulerServer) prepareExecutorInfo(hks hyperkube.Interface) (*mesos.E
 	ci.Arguments = append(ci.Arguments, fmt.Sprintf("--cadvisor-port=%v", s.kubeletCadvisorPort))
 	ci.Arguments = append(ci.Arguments, fmt.Sprintf("--sync-frequency=%v", s.kubeletSyncFrequency))
 	ci.Arguments = append(ci.Arguments, fmt.Sprintf("--contain-pod-resources=%t", s.containPodResources))
+	ci.Arguments = append(ci.Arguments, fmt.Sprintf("--enable-debugging-handlers=%t", s.kubeletEnableDebuggingHandlers))
 
 	if s.authPath != "" {
 		//TODO(jdef) should probably support non-local files, e.g. hdfs:///some/config/file
diff --git a/hack/verify-flags/known-flags.txt b/hack/verify-flags/known-flags.txt
index 2774c24d665..a0928e3c1d4 100644
--- a/hack/verify-flags/known-flags.txt
+++ b/hack/verify-flags/known-flags.txt
@@ -158,6 +158,7 @@ kubelet-certificate-authority
 kubelet-client-certificate
 kubelet-client-key
 kubelet-docker-endpoint
+kubelet-enable-debugging-handlers
 kubelet-host-network-sources
 kubelet-https
 kubelet-network-plugin