diff --git a/src/cmd/linuxkit/run_hyperkit.go b/src/cmd/linuxkit/run_hyperkit.go
index 7dcd177b0..4abf3c02e 100644
--- a/src/cmd/linuxkit/run_hyperkit.go
+++ b/src/cmd/linuxkit/run_hyperkit.go
@@ -32,6 +32,7 @@ func runHyperKit(args []string) {
 	data := flags.String("data", "", "Metadata to pass to VM (either a path to a file or a string)")
 	ipStr := flags.String("ip", "", "IP address for the VM")
 	state := flags.String("state", "", "Path to directory to keep VM state in")
+	vsockports := flags.String("vsock-ports", "", "List of vsock ports to forward from the guest on startup (comma separated). A unix domain socket for each port will be created in the state directory")
 
 	if err := flags.Parse(args); err != nil {
 		log.Fatal("Unable to parse args")
@@ -100,6 +101,10 @@ func runHyperKit(args []string) {
 		log.Fatalln("Error creating hyperkit: ", err)
 	}
 
+	if h.VSockPorts, err = stringToIntArray(*vsockports, ","); err != nil {
+		log.Fatalln("Unable to parse vsock-ports: ", err)
+	}
+
 	h.Kernel = prefix + "-kernel"
 	h.Initrd = prefix + "-initrd.img"
 	h.VPNKitKey = vpnKitKey
diff --git a/src/cmd/linuxkit/util.go b/src/cmd/linuxkit/util.go
index a5717c07a..548047096 100644
--- a/src/cmd/linuxkit/util.go
+++ b/src/cmd/linuxkit/util.go
@@ -3,6 +3,7 @@ package main
 import (
 	"os"
 	"strconv"
+	"strings"
 )
 
 func getStringValue(envKey string, flagVal string, defaultVal string) string {
@@ -81,3 +82,18 @@ func getBoolValue(envKey string, flagVal bool) bool {
 
 	return res
 }
+
+func stringToIntArray(l string, sep string) ([]int, error) {
+	var err error
+	if l == "" {
+		return []int{}, err
+	}
+	s := strings.Split(l, sep)
+	i := make([]int, len(s))
+	for idx := range s {
+		if i[idx], err = strconv.Atoi(s[idx]); err != nil {
+			return nil, err
+		}
+	}
+	return i, nil
+}
diff --git a/vendor.conf b/vendor.conf
index 3957b025f..716258727 100644
--- a/vendor.conf
+++ b/vendor.conf
@@ -9,7 +9,7 @@ github.com/docker/infrakit cb420e3e50ea60afe58538b1d3cab1cb14059433
 github.com/golang/protobuf c9c7427a2a70d2eb3bafa0ab2dc163e45f143317
 github.com/googleapis/gax-go 8c5154c0fe5bf18cf649634d4c6df50897a32751
 github.com/mitchellh/go-ps 4fdf99ab29366514c69ccccddab5dc58b8d84062
-github.com/moby/hyperkit 9b5f5fd848f0f5aedccb67a5a8cfa6787b8654f9
+github.com/moby/hyperkit fa78d9472a7d98e393233fd61ad5e95adc8c6912
 github.com/opencontainers/runtime-spec d094a5c9c1997ab086197b57e9378fabed394d92
 github.com/pkg/errors ff09b135c25aae272398c51a07235b90a75aa4f0
 github.com/packethost/packngo 91d54000aa56874149d348a884ba083c41d38091
diff --git a/vendor/github.com/moby/hyperkit/README.md b/vendor/github.com/moby/hyperkit/README.md
index 17c44ae11..ff639b489 100644
--- a/vendor/github.com/moby/hyperkit/README.md
+++ b/vendor/github.com/moby/hyperkit/README.md
@@ -38,7 +38,7 @@ via `brew` and using `opam` to install the appropriate libraries:
     $ brew install opam libev
     $ opam init
     $ eval `opam config env`
-    $ opam install uri qcow.0.8.1 mirage-block-unix.2.6.0 conf-libev logs fmt mirage-unix
+    $ opam install uri qcow.0.9.5 mirage-block-unix.2.7.0 conf-libev logs fmt mirage-unix
 
 Notes:
 
diff --git a/vendor/github.com/moby/hyperkit/go/hyperkit.go b/vendor/github.com/moby/hyperkit/go/hyperkit.go
index 95d7e5488..1604c7b4b 100644
--- a/vendor/github.com/moby/hyperkit/go/hyperkit.go
+++ b/vendor/github.com/moby/hyperkit/go/hyperkit.go
@@ -51,6 +51,8 @@ const (
 	defaultCPUs   = 1
 	defaultMemory = 1024 // 1G
 
+	defaultVSockGuestCID = 3
+
 	jsonFile = "hyperkit.json"
 	pidFile  = "hyperkit.pid"
 )
@@ -79,6 +81,10 @@ type HyperKit struct {
 	ISOImage string `json:"iso"`
 	// VSock enables the virtio-socket device and exposes it on the host
 	VSock bool `json:"vsock"`
+	// VSockPorts is a list of guest VSock ports that should be exposed as sockets on the host
+	VSockPorts []int `json:"vsock_ports"`
+	// VSock guest CID
+	VSockGuestCID int `json:"vsock_guest_cid"`
 
 	// Kernel is the path to the kernel image to boot
 	Kernel string `json:"kernel"`
@@ -133,6 +139,8 @@ func New(hyperkit, vpnkitsock, statedir string) (*HyperKit, error) {
 	h.CPUs = defaultCPUs
 	h.Memory = defaultMemory
 
+	h.VSockGuestCID = defaultVSockGuestCID
+
 	h.Console = ConsoleStdio
 
 	return &h, nil
@@ -203,6 +211,9 @@ func (h *HyperKit) execute(cmdline string) error {
 	if h.VSock && h.StateDir == "" {
 		return fmt.Errorf("If virtio-sockets are enabled, StateDir must be specified")
 	}
+	if !h.VSock && len(h.VSockPorts) > 0 {
+		return fmt.Errorf("To forward vsock ports vsock must be enabled")
+	}
 	if _, err = os.Stat(h.Kernel); os.IsNotExist(err) {
 		return fmt.Errorf("Kernel %s does not exist", h.Kernel)
 	}
@@ -335,6 +346,17 @@ func CreateDiskImage(location string, sizeMB int) error {
 	return nil
 }
 
+func intArrayToString(i []int, sep string) string {
+	if len(i) == 0 {
+		return ""
+	}
+	s := make([]string, len(i))
+	for idx := range i {
+		s[idx] = strconv.Itoa(i[idx])
+	}
+	return strings.Join(s, sep)
+}
+
 func (h *HyperKit) buildArgs(cmdline string) {
 	a := []string{"-A", "-u"}
 	if h.StateDir != "" {
@@ -359,7 +381,11 @@ func (h *HyperKit) buildArgs(cmdline string) {
 		a = append(a, "-s", fmt.Sprintf("2:0,virtio-blk,%s", h.DiskImage))
 	}
 	if h.VSock {
-		a = append(a, "-s", fmt.Sprintf("3,virtio-sock,guest_cid=3,path=%s", h.StateDir))
+		l := fmt.Sprintf("3,virtio-sock,guest_cid=%d,path=%s", h.VSockGuestCID, h.StateDir)
+		if len(h.VSockPorts) > 0 {
+			l = fmt.Sprintf("%s,guest_forwards=%s", l, intArrayToString(h.VSockPorts, ";"))
+		}
+		a = append(a, "-s", l)
 	}
 	if h.ISOImage != "" {
 		a = append(a, "-s", fmt.Sprintf("4,ahci-cd,%s", h.ISOImage))
diff --git a/vendor/github.com/moby/hyperkit/src/include/xhyve/firmware/bootrom.h b/vendor/github.com/moby/hyperkit/src/include/xhyve/firmware/bootrom.h
index 7787f9eea..7c4c82261 100644
--- a/vendor/github.com/moby/hyperkit/src/include/xhyve/firmware/bootrom.h
+++ b/vendor/github.com/moby/hyperkit/src/include/xhyve/firmware/bootrom.h
@@ -3,6 +3,6 @@
 #include <stdint.h>
 #include <stdbool.h>
 
-void bootrom_init(const char *bootrom_path);
+int bootrom_init(const char *bootrom_path);
 uint64_t bootrom_load(void);
 bool bootrom_contains_gpa(uint64_t gpa);
diff --git a/vendor/github.com/moby/hyperkit/src/include/xhyve/firmware/fbsd.h b/vendor/github.com/moby/hyperkit/src/include/xhyve/firmware/fbsd.h
index 30d4388cc..968ba42a4 100644
--- a/vendor/github.com/moby/hyperkit/src/include/xhyve/firmware/fbsd.h
+++ b/vendor/github.com/moby/hyperkit/src/include/xhyve/firmware/fbsd.h
@@ -97,6 +97,6 @@ struct loader_callbacks {
 	const char * (*getenv)(void *arg, int num);
 };
 
-void fbsd_init(char *userboot_path, char *bootvolume_path, char *kernelenv,
+int fbsd_init(char *userboot_path, char *bootvolume_path, char *kernelenv,
 	char *cons);
 uint64_t fbsd_load(void);
diff --git a/vendor/github.com/moby/hyperkit/src/include/xhyve/firmware/kexec.h b/vendor/github.com/moby/hyperkit/src/include/xhyve/firmware/kexec.h
index 5a8e7672f..b90950f48 100644
--- a/vendor/github.com/moby/hyperkit/src/include/xhyve/firmware/kexec.h
+++ b/vendor/github.com/moby/hyperkit/src/include/xhyve/firmware/kexec.h
@@ -82,5 +82,5 @@ struct zero_page {
 	uint8_t _7[276];
 } __attribute__((packed));
 
-void kexec_init(char *kernel_path, char *initrd_path, char *cmdline);
+int kexec_init(char *kernel_path, char *initrd_path, char *cmdline);
 uint64_t kexec(void);
diff --git a/vendor/github.com/moby/hyperkit/src/include/xhyve/firmware/multiboot.h b/vendor/github.com/moby/hyperkit/src/include/xhyve/firmware/multiboot.h
new file mode 100644
index 000000000..7742f0dfc
--- /dev/null
+++ b/vendor/github.com/moby/hyperkit/src/include/xhyve/firmware/multiboot.h
@@ -0,0 +1,4 @@
+#include <stdint.h>
+
+int multiboot_init(char *kernel_path, char *module_spec, char *cmdline);
+uint64_t multiboot(void);
diff --git a/vendor/github.com/moby/hyperkit/src/lib/pci_virtio_net_vpnkit.c b/vendor/github.com/moby/hyperkit/src/lib/pci_virtio_net_vpnkit.c
index 1b97fe405..ad64a0df1 100644
--- a/vendor/github.com/moby/hyperkit/src/lib/pci_virtio_net_vpnkit.c
+++ b/vendor/github.com/moby/hyperkit/src/lib/pci_virtio_net_vpnkit.c
@@ -317,11 +317,6 @@ static int vpnkit_connect(int fd, const char uuid[36], struct vif_info *vif)
 			init_reply.magic[4]);
 		return -1;
 	}
-	if (init_reply.version != 1) {
-		fprintf(stderr, "virtio-net-vpnkit: bad init version %d\n",
-			init_reply.version);
-		return -1;
-	}
 
 	fprintf(stderr, "virtio-net-vpnkit: magic=%c%c%c%c%c version=%d commit=%*s\n",
 		init_reply.magic[0], init_reply.magic[1],