diff --git a/src/cmd/linuxkit/pkglib/build.go b/src/cmd/linuxkit/pkglib/build.go
index 6442fe7c7..ad1c05b2b 100644
--- a/src/cmd/linuxkit/pkglib/build.go
+++ b/src/cmd/linuxkit/pkglib/build.go
@@ -282,6 +282,7 @@ func (p Pkg) Build(bos ...BuildOpt) error {
 			imageBuildOpts.Labels["org.opencontainers.image.revision"] = commit
 		}
 
+		imageBuildOpts.NetworkMode = "default"
 		if !p.network {
 			imageBuildOpts.NetworkMode = "none"
 		}
diff --git a/src/cmd/linuxkit/pkglib/docker.go b/src/cmd/linuxkit/pkglib/docker.go
index 3c96d409b..d8cd04a72 100644
--- a/src/cmd/linuxkit/pkglib/docker.go
+++ b/src/cmd/linuxkit/pkglib/docker.go
@@ -432,7 +432,15 @@ func (dr *dockerRunnerImpl) build(ctx context.Context, tag, pkg, dockerContext,
 	}
 
 	// network
-	frontendAttrs["network"] = imageBuildOpts.NetworkMode
+	// translate to net modes understood by buildkit dockerfile frontend
+	switch imageBuildOpts.NetworkMode {
+	case "host", "none":
+		frontendAttrs["force-network-mode"] = imageBuildOpts.NetworkMode
+	case "default":
+		frontendAttrs["force-network-mode"] = "sandbox"
+	default:
+		return fmt.Errorf("unsupported network mode %q", imageBuildOpts.NetworkMode)
+	}
 
 	for k, v := range imageBuildOpts.Labels {
 		frontendAttrs[fmt.Sprintf("label:%s", k)] = v