diff --git a/src/cmd/linuxkit/vendor.conf b/src/cmd/linuxkit/vendor.conf
index 736195899..4f5502055 100644
--- a/src/cmd/linuxkit/vendor.conf
+++ b/src/cmd/linuxkit/vendor.conf
@@ -26,7 +26,7 @@ github.com/moby/datakit 97b3d230535397a813323902c23751e176481a86
 github.com/moby/hyperkit a285521725f44f3d10ca1042c2c07d3a6e24bed8
 # When updating also:
 # curl -fsSL -o src/cmd/linuxkit/build.go https://raw.githubusercontent.com/moby/tool/«hash»/cmd/moby/build.go
-github.com/moby/tool 486e313fe3069da88948500ceb60d0abfffad464
+github.com/moby/tool 3dbad3b7daffd631d036493a1e883608206d2e03
 github.com/moby/vpnkit 0e4293bb1058598c4b0a406ed171f52573ef414c
 github.com/opencontainers/go-digest 21dfd564fd89c944783d00d069f33e3e7123c448
 github.com/opencontainers/image-spec v1.0.0
diff --git a/src/cmd/linuxkit/vendor/github.com/moby/tool/src/initrd/initrd.go b/src/cmd/linuxkit/vendor/github.com/moby/tool/src/initrd/initrd.go
index 2a4a27a06..6575cdf85 100644
--- a/src/cmd/linuxkit/vendor/github.com/moby/tool/src/initrd/initrd.go
+++ b/src/cmd/linuxkit/vendor/github.com/moby/tool/src/initrd/initrd.go
@@ -8,6 +8,7 @@ import (
 	"io"
 	"io/ioutil"
 	"path/filepath"
+	"strings"
 
 	"github.com/moby/tool/src/pad4"
 	"github.com/surma/gocpio"
@@ -121,26 +122,26 @@ func CopySplitTar(w *Writer, r *tar.Reader) (kernel []byte, cmdline string, ucod
 		if err != nil {
 			return
 		}
-		switch thdr.Name {
-		case "boot/kernel":
+		switch {
+		case thdr.Name == "boot/kernel":
 			kernel, err = ioutil.ReadAll(r)
 			if err != nil {
 				return
 			}
-		case "boot/cmdline":
+		case thdr.Name == "boot/cmdline":
 			var buf []byte
 			buf, err = ioutil.ReadAll(r)
 			if err != nil {
 				return
 			}
 			cmdline = string(buf)
-		case "boot/ucode.cpio":
+		case thdr.Name == "boot/ucode.cpio":
 			ucode, err = ioutil.ReadAll(r)
 			if err != nil {
 				return
 			}
-		case "boot":
-			// skip this entry
+		case strings.HasPrefix(thdr.Name, "boot/"):
+			// skip the rest of ./boot
 		default:
 			_, err = copyTarEntry(w, thdr, r)
 			if err != nil {
diff --git a/src/cmd/linuxkit/vendor/github.com/moby/tool/src/moby/docker.go b/src/cmd/linuxkit/vendor/github.com/moby/tool/src/moby/docker.go
index 296a61108..18520387a 100644
--- a/src/cmd/linuxkit/vendor/github.com/moby/tool/src/moby/docker.go
+++ b/src/cmd/linuxkit/vendor/github.com/moby/tool/src/moby/docker.go
@@ -22,7 +22,7 @@ import (
 )
 
 func dockerRun(input io.Reader, output io.Writer, trust bool, img string, args ...string) error {
-	log.Debugf("docker run (input): %s", strings.Join(args, " "))
+	log.Debugf("docker run %s (trust=%t) (input): %s", img, trust, strings.Join(args, " "))
 	docker, err := exec.LookPath("docker")
 	if err != nil {
 		return errors.New("Docker does not seem to be installed")
@@ -38,7 +38,7 @@ func dockerRun(input io.Reader, output io.Writer, trust bool, img string, args .
 	pull.Env = env
 	if err := pull.Run(); err != nil {
 		if exitError, ok := err.(*exec.ExitError); ok {
-			return fmt.Errorf("docker pull failed: %v output:\n%s", err, exitError.Stderr)
+			return fmt.Errorf("docker pull %s failed: %v output:\n%s", img, err, exitError.Stderr)
 		}
 		return err
 	}
@@ -51,12 +51,12 @@ func dockerRun(input io.Reader, output io.Writer, trust bool, img string, args .
 
 	if err := cmd.Run(); err != nil {
 		if exitError, ok := err.(*exec.ExitError); ok {
-			return fmt.Errorf("docker run failed: %v output:\n%s", err, exitError.Stderr)
+			return fmt.Errorf("docker run %s failed: %v output:\n%s", img, err, exitError.Stderr)
 		}
 		return err
 	}
 
-	log.Debugf("docker run (input): %s...Done", strings.Join(args, " "))
+	log.Debugf("docker run %s (input): %s...Done", img, strings.Join(args, " "))
 	return nil
 }
 
diff --git a/src/cmd/linuxkit/vendor/github.com/moby/tool/src/moby/linuxkit.go b/src/cmd/linuxkit/vendor/github.com/moby/tool/src/moby/linuxkit.go
index 94d88ec41..0d853982c 100644
--- a/src/cmd/linuxkit/vendor/github.com/moby/tool/src/moby/linuxkit.go
+++ b/src/cmd/linuxkit/vendor/github.com/moby/tool/src/moby/linuxkit.go
@@ -17,11 +17,11 @@ kernel:
   image: linuxkit/kernel:4.9.39
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
+  - linuxkit/init:00ab58c9681a0bf42b2e35134c1ccf1591ebb64d
+  - linuxkit/runc:f5960b83a8766ae083efc744fa63dbf877450e4f
 onboot:
   - name: mkimage
-    image: linuxkit/mkimage:v0.3
+    image: linuxkit/mkimage:50bde8b00eb82e08f12dd9cc29f36c77f5638426
   - name: poweroff
     image: linuxkit/poweroff:3845c4d64d47a1ea367806be5547e44594b0fa91
 trust:
diff --git a/src/cmd/linuxkit/vendor/github.com/moby/tool/src/moby/output.go b/src/cmd/linuxkit/vendor/github.com/moby/tool/src/moby/output.go
index c8c859242..a5427c2a7 100644
--- a/src/cmd/linuxkit/vendor/github.com/moby/tool/src/moby/output.go
+++ b/src/cmd/linuxkit/vendor/github.com/moby/tool/src/moby/output.go
@@ -8,24 +8,40 @@ import (
 	"io/ioutil"
 	"os"
 	"runtime"
+	"strings"
 
 	"github.com/moby/tool/src/initrd"
 	log "github.com/sirupsen/logrus"
 )
 
-const (
-	isoBios    = "linuxkit/mkimage-iso-bios:9a51dc64a461f1cc50ba05f30a38f73f5227ac03"
-	isoEfi     = "linuxkit/mkimage-iso-efi:343cf1a8ac0aba7d8a1f13b7f45fa0b57ab897dc"
-	rawBios    = "linuxkit/mkimage-raw-bios:d90713b2dd610cf9a0f5f9d9095f8bf86f40d5c6"
-	rawEfi     = "linuxkit/mkimage-raw-efi:8938ffb6014543e557b624a40cce1714f30ce4b6"
-	gcp        = "linuxkit/mkimage-gcp:e6cdcf859ab06134c0c37a64ed5f886ec8dae1a1"
-	vhd        = "linuxkit/mkimage-vhd:3820219e5c350fe8ab2ec6a217272ae82f4b9242"
-	vmdk       = "linuxkit/mkimage-vmdk:cee81a3ed9c44ae446ef7ebff8c42c1e77b3e1b5"
-	dynamicvhd = "linuxkit/mkimage-dynamic-vhd:743ac9959fe6d3912ebd78b4fd490b117c53f1a6"
-	rpi3       = "linuxkit/mkimage-rpi3:0f23c4f37cdca99281ca33ac6188e1942fa7a2b8"
-	qcow2Efi   = "linuxkit/mkimage-qcow2-efi:787b54906e14a56b9f1da35dcc8e46bd58435285"
+var (
+	outputImages = map[string]string{
+		"iso-bios":    "linuxkit/mkimage-iso-bios:9a51dc64a461f1cc50ba05f30a38f73f5227ac03",
+		"iso-efi":     "linuxkit/mkimage-iso-efi:343cf1a8ac0aba7d8a1f13b7f45fa0b57ab897dc",
+		"raw-bios":    "linuxkit/mkimage-raw-bios:d90713b2dd610cf9a0f5f9d9095f8bf86f40d5c6",
+		"raw-efi":     "linuxkit/mkimage-raw-efi:8938ffb6014543e557b624a40cce1714f30ce4b6",
+		"squashfs":    "linuxkit/mkimage-squashfs:b44d00b0a336fd32c122ff32bd2b39c36a965135",
+		"gcp":         "linuxkit/mkimage-gcp:e6cdcf859ab06134c0c37a64ed5f886ec8dae1a1",
+		"qcow2-efi":   "linuxkit/mkimage-qcow2-efi:787b54906e14a56b9f1da35dcc8e46bd58435285",
+		"vhd":         "linuxkit/mkimage-vhd:3820219e5c350fe8ab2ec6a217272ae82f4b9242",
+		"dynamic-vhd": "linuxkit/mkimage-dynamic-vhd:743ac9959fe6d3912ebd78b4fd490b117c53f1a6",
+		"vmdk":        "linuxkit/mkimage-vmdk:cee81a3ed9c44ae446ef7ebff8c42c1e77b3e1b5",
+		"rpi3":        "linuxkit/mkimage-rpi3:0f23c4f37cdca99281ca33ac6188e1942fa7a2b8",
+	}
 )
 
+// UpdateOutputImages overwrite the docker images used to build the outputs
+// 'update' is a map where the key is the output format and the value is a LinuxKit 'mkimage' image.
+func UpdateOutputImages(update map[string]string) error {
+	for k, img := range update {
+		if _, ok := outputImages[k]; !ok {
+			return fmt.Errorf("Image format %s is not known", k)
+		}
+		outputImages[k] = img
+	}
+	return nil
+}
+
 var outFuns = map[string]func(string, io.Reader, int) error{
 	"kernel+initrd": func(base string, image io.Reader, size int) error {
 		kernel, initrd, cmdline, ucode, err := tarToInitrd(image)
@@ -49,14 +65,14 @@ var outFuns = map[string]func(string, io.Reader, int) error{
 		return nil
 	},
 	"iso-bios": func(base string, image io.Reader, size int) error {
-		err := outputIso(isoBios, base+".iso", image)
+		err := outputIso(outputImages["iso-bios"], base+".iso", image)
 		if err != nil {
 			return fmt.Errorf("Error writing iso-bios output: %v", err)
 		}
 		return nil
 	},
 	"iso-efi": func(base string, image io.Reader, size int) error {
-		err := outputIso(isoEfi, base+"-efi.iso", image)
+		err := outputIso(outputImages["iso-efi"], base+"-efi.iso", image)
 		if err != nil {
 			return fmt.Errorf("Error writing iso-efi output: %v", err)
 		}
@@ -68,7 +84,7 @@ var outFuns = map[string]func(string, io.Reader, int) error{
 			return fmt.Errorf("Error converting to initrd: %v", err)
 		}
 		// TODO: Handle ucode
-		err = outputImg(rawBios, base+"-bios.img", kernel, initrd, cmdline)
+		err = outputImg(outputImages["raw-bios"], base+"-bios.img", kernel, initrd, cmdline)
 		if err != nil {
 			return fmt.Errorf("Error writing raw-bios output: %v", err)
 		}
@@ -79,12 +95,19 @@ var outFuns = map[string]func(string, io.Reader, int) error{
 		if err != nil {
 			return fmt.Errorf("Error converting to initrd: %v", err)
 		}
-		err = outputImg(rawEfi, base+"-efi.img", kernel, initrd, cmdline)
+		err = outputImg(outputImages["raw-efi"], base+"-efi.img", kernel, initrd, cmdline)
 		if err != nil {
 			return fmt.Errorf("Error writing raw-efi output: %v", err)
 		}
 		return nil
 	},
+	"kernel+squashfs": func(base string, image io.Reader, size int) error {
+		err := outputKernelSquashFS(outputImages["squashfs"], base, image)
+		if err != nil {
+			return fmt.Errorf("Error writing kernel+squashfs output: %v", err)
+		}
+		return nil
+	},
 	"aws": func(base string, image io.Reader, size int) error {
 		filename := base + ".raw"
 		log.Infof("  %s", filename)
@@ -103,7 +126,7 @@ var outFuns = map[string]func(string, io.Reader, int) error{
 		if err != nil {
 			return fmt.Errorf("Error converting to initrd: %v", err)
 		}
-		err = outputImg(gcp, base+".img.tar.gz", kernel, initrd, cmdline)
+		err = outputImg(outputImages["gcp"], base+".img.tar.gz", kernel, initrd, cmdline)
 		if err != nil {
 			return fmt.Errorf("Error writing gcp output: %v", err)
 		}
@@ -114,7 +137,7 @@ var outFuns = map[string]func(string, io.Reader, int) error{
 		if err != nil {
 			return fmt.Errorf("Error converting to initrd: %v", err)
 		}
-		err = outputImg(qcow2Efi, base+"-efi.qcow2", kernel, initrd, cmdline)
+		err = outputImg(outputImages["qcow2-efi"], base+"-efi.qcow2", kernel, initrd, cmdline)
 		if err != nil {
 			return fmt.Errorf("Error writing qcow2 EFI output: %v", err)
 		}
@@ -139,7 +162,7 @@ var outFuns = map[string]func(string, io.Reader, int) error{
 		if err != nil {
 			return fmt.Errorf("Error converting to initrd: %v", err)
 		}
-		err = outputImg(vhd, base+".vhd", kernel, initrd, cmdline)
+		err = outputImg(outputImages["vhd"], base+".vhd", kernel, initrd, cmdline)
 		if err != nil {
 			return fmt.Errorf("Error writing vhd output: %v", err)
 		}
@@ -150,7 +173,7 @@ var outFuns = map[string]func(string, io.Reader, int) error{
 		if err != nil {
 			return fmt.Errorf("Error converting to initrd: %v", err)
 		}
-		err = outputImg(dynamicvhd, base+".vhd", kernel, initrd, cmdline)
+		err = outputImg(outputImages["dynamic-vhd"], base+".vhd", kernel, initrd, cmdline)
 		if err != nil {
 			return fmt.Errorf("Error writing vhd output: %v", err)
 		}
@@ -161,7 +184,7 @@ var outFuns = map[string]func(string, io.Reader, int) error{
 		if err != nil {
 			return fmt.Errorf("Error converting to initrd: %v", err)
 		}
-		err = outputImg(vmdk, base+".vmdk", kernel, initrd, cmdline)
+		err = outputImg(outputImages["vmdk"], base+".vmdk", kernel, initrd, cmdline)
 		if err != nil {
 			return fmt.Errorf("Error writing vmdk output: %v", err)
 		}
@@ -171,7 +194,7 @@ var outFuns = map[string]func(string, io.Reader, int) error{
 		if runtime.GOARCH != "arm64" {
 			return fmt.Errorf("Raspberry Pi output currently only supported on arm64")
 		}
-		err := outputRPi3(rpi3, base+".tar", image)
+		err := outputRPi3(outputImages["rpi3"], base+".tar", image)
 		if err != nil {
 			return fmt.Errorf("Error writing rpi3 output: %v", err)
 		}
@@ -413,3 +436,57 @@ func outputKernelInitrdTarball(base string, kernel []byte, initrd []byte, cmdlin
 	}
 	return tw.Close()
 }
+
+func outputKernelSquashFS(image, base string, filesystem io.Reader) error {
+	log.Debugf("output kernel/squashfs: %s %s", image, base)
+	log.Infof("  %s-squashfs.img", base)
+
+	tr := tar.NewReader(filesystem)
+	buf := new(bytes.Buffer)
+	rootfs := tar.NewWriter(buf)
+
+	for {
+		var thdr *tar.Header
+		thdr, err := tr.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return err
+		}
+		switch {
+		case thdr.Name == "boot/kernel":
+			kernel, err := ioutil.ReadAll(tr)
+			if err != nil {
+				return err
+			}
+			if err := ioutil.WriteFile(base+"-kernel", kernel, os.FileMode(0644)); err != nil {
+				return err
+			}
+		case thdr.Name == "boot/cmdline":
+			cmdline, err := ioutil.ReadAll(tr)
+			if err != nil {
+				return err
+			}
+			if err := ioutil.WriteFile(base+"-cmdline", cmdline, os.FileMode(0644)); err != nil {
+				return err
+			}
+		case strings.HasPrefix(thdr.Name, "boot/"):
+			// skip the rest of boot/
+		default:
+			rootfs.WriteHeader(thdr)
+			if _, err := io.Copy(rootfs, tr); err != nil {
+				return err
+			}
+		}
+	}
+	rootfs.Close()
+
+	output, err := os.Create(base + "-squashfs.img")
+	if err != nil {
+		return err
+	}
+	defer output.Close()
+
+	return dockerRun(buf, output, true, image)
+}
diff --git a/src/cmd/linuxkit/vendor/github.com/moby/tool/vendor.conf b/src/cmd/linuxkit/vendor/github.com/moby/tool/vendor.conf
index be28bf5b7..9c422a88c 100644
--- a/src/cmd/linuxkit/vendor/github.com/moby/tool/vendor.conf
+++ b/src/cmd/linuxkit/vendor/github.com/moby/tool/vendor.conf
@@ -1,4 +1,4 @@
-github.com/agl/ed25519 5312a61534124124185d41f09206b9fef1d88403
+github.com/agl/ed25519 278e1ec8e8a6e017cd07577924d6766039146ced
 github.com/containerd/containerd v1.0.0
 github.com/docker/distribution 3800056b8832cf6075e78b282ac010131d8687bc
 github.com/docker/docker ba99c19b593bdb9e7b90793681fe89b0a91781ed
@@ -6,19 +6,19 @@ github.com/docker/go d30aec9fd63c35133f8f79c3412ad91a3b08be06
 github.com/docker/go-connections v0.3.0
 github.com/docker/go-units v0.3.1
 github.com/gogo/protobuf v0.5
-github.com/gorilla/mux 4c1c3952b7d9d0a061a3fa7b36fd373ba0398ebc
+github.com/gorilla/mux v1.6.1
 github.com/opencontainers/go-digest 21dfd564fd89c944783d00d069f33e3e7123c448
 github.com/opencontainers/image-spec v1.0.0
 github.com/opencontainers/runtime-spec v1.0.0
 github.com/pkg/errors v0.8.0
 github.com/sirupsen/logrus v1.0.3
 github.com/surma/gocpio fcb68777e7dc4ea43ffce871b552c0d073c17495
-github.com/theupdateframework/notary v0.6.0
+github.com/theupdateframework/notary v0.6.1
 github.com/xeipuuv/gojsonpointer 6fe8760cad3569743d51ddbb243b26f8456742dc
 github.com/xeipuuv/gojsonreference e02fc20de94c78484cd5ffb007f8af96be030a45
 github.com/xeipuuv/gojsonschema 702b404897d4364af44dc8dcabc9815947942325
 golang.org/x/crypto 573951cbe80bb6352881271bb276f48749eab6f4
 golang.org/x/net 7dcfb8076726a3fdd9353b6b8a1f1b6be6811bd6
 golang.org/x/sys 739734461d1c916b6c72a63d7efda2b27edb369f
-gopkg.in/yaml.v2 a3f3340b5840cee44f372bddb5880fcbc419b46a
+gopkg.in/yaml.v2 v2.2.1
 github.com/Microsoft/go-winio v0.4.1