diff --git a/test/e2e/util.go b/test/e2e/util.go
index 4b0478987ca..46f1e2e5a26 100644
--- a/test/e2e/util.go
+++ b/test/e2e/util.go
@@ -33,7 +33,9 @@ import (
 
 	"k8s.io/kubernetes/pkg/api"
 	apierrs "k8s.io/kubernetes/pkg/api/errors"
+	"k8s.io/kubernetes/pkg/api/latest"
 	"k8s.io/kubernetes/pkg/api/resource"
+	"k8s.io/kubernetes/pkg/api/unversioned"
 	"k8s.io/kubernetes/pkg/apis/extensions"
 	"k8s.io/kubernetes/pkg/client/cache"
 	client "k8s.io/kubernetes/pkg/client/unversioned"
@@ -1921,6 +1923,50 @@ func sshCore(cmd, host, provider string, verbose bool) (string, string, int, err
 	return stdout, stderr, code, err
 }
 
+// NewHostExecPodSpec returns the pod spec of hostexec pod
+func NewHostExecPodSpec(ns, name string) *api.Pod {
+	pod := &api.Pod{
+		TypeMeta: unversioned.TypeMeta{
+			Kind:       "Pod",
+			APIVersion: latest.GroupOrDie("").Version,
+		},
+		ObjectMeta: api.ObjectMeta{
+			Name:      name,
+			Namespace: ns,
+		},
+		Spec: api.PodSpec{
+			Containers: []api.Container{
+				{
+					Name:            "hostexec",
+					Image:           "gcr.io/google_containers/hostexec:1.2",
+					ImagePullPolicy: api.PullIfNotPresent,
+				},
+			},
+			SecurityContext: &api.PodSecurityContext{
+				HostNetwork: true,
+			},
+		},
+	}
+	return pod
+}
+
+// RunHostCmd runs the given cmd in the context of the given pod using `kubectl exec`
+// inside of a shell.
+func RunHostCmd(ns, name, cmd string) string {
+	return runKubectl("exec", fmt.Sprintf("--namespace=%v", ns), name, "--", "/bin/sh", "-c", cmd)
+}
+
+// LaunchHostExecPod launches a hostexec pod in the given namespace and waits
+// until it's Running
+func LaunchHostExecPod(client *client.Client, ns, name string) *api.Pod {
+	hostExecPod := NewHostExecPodSpec(ns, name)
+	pod, err := client.Pods(ns).Create(hostExecPod)
+	expectNoError(err)
+	err = waitForPodRunningInNamespace(client, pod.Name, pod.Namespace)
+	expectNoError(err)
+	return pod
+}
+
 // getSigner returns an ssh.Signer for the provider ("gce", etc.) that can be
 // used to SSH to their nodes.
 func getSigner(provider string) (ssh.Signer, error) {
diff --git a/test/images/hostexec/Dockerfile b/test/images/hostexec/Dockerfile
new file mode 100644
index 00000000000..aa6c1dbbdaf
--- /dev/null
+++ b/test/images/hostexec/Dockerfile
@@ -0,0 +1,20 @@
+# Copyright 2015 Google Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+FROM alpine:3.2
+
+run apk --update add curl netcat-openbsd iproute2 && rm -rf /var/cache/apk/*
+
+# wait forever
+CMD rm -f /fifo && mkfifo /fifo && exec cat </fifo
diff --git a/test/images/hostexec/Makefile b/test/images/hostexec/Makefile
new file mode 100644
index 00000000000..0d196043115
--- /dev/null
+++ b/test/images/hostexec/Makefile
@@ -0,0 +1,16 @@
+.PHONY: all image push clean
+
+TAG = 1.2
+PREFIX = gcr.io/google_containers
+
+
+all: push
+
+image:
+	docker build -t $(PREFIX)/hostexec:$(TAG) .
+
+push: image
+	gcloud docker push $(PREFIX)/hostexec:$(TAG)
+
+clean:
+	rm -f hostexec
diff --git a/test/images/hostexec/pod.yaml b/test/images/hostexec/pod.yaml
new file mode 100644
index 00000000000..375e777ed4d
--- /dev/null
+++ b/test/images/hostexec/pod.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: hostexec
+  labels:
+    app: hostexec
+spec:
+  containers:
+  - name: hostexec
+    image: gcr.io/google_containers/hostexec:1.2
+  securityContext:
+    hostNetwork: true