diff --git a/src/cmd/linuxkit/moby/config.go b/src/cmd/linuxkit/moby/config.go
index 0160f329f..d6249eca5 100644
--- a/src/cmd/linuxkit/moby/config.go
+++ b/src/cmd/linuxkit/moby/config.go
@@ -360,8 +360,9 @@ func NewConfig(config []byte, packageFinder spec.PackageResolver) (Moby, error)
 
 	// Parse raw yaml
 	var rawYaml interface{}
-	err := yaml.Unmarshal(config, &rawYaml)
-	if err != nil {
+	dec := yaml.NewDecoder(bytes.NewReader(config))
+	dec.KnownFields(true)
+	if err := dec.Decode(&rawYaml); err != nil {
 		return m, err
 	}
 
diff --git a/test/cases/000_build/091_validate_linuxkit_yaml/linuxkit.yml b/test/cases/000_build/091_validate_linuxkit_yaml/linuxkit.yml
new file mode 100644
index 000000000..3f3434046
--- /dev/null
+++ b/test/cases/000_build/091_validate_linuxkit_yaml/linuxkit.yml
@@ -0,0 +1,39 @@
+unknownField: "abc"
+kernel:
+  image: linuxkit/kernel:6.6.71
+  cmdline: "console=tty0 console=ttyS0 console=ttyAMA0"
+init:
+  - linuxkit/init:680da6e6f79bb8236a095147d532cd2160e23c9f
+  - linuxkit/runc:2dfee46421e963d6c0d946137e46fe36fa606d29
+  - linuxkit/containerd:838b745e38e43309393675ce3cf04bee9047eb91
+  - linuxkit/ca-certificates:a4f15fe71bb0ad7560ff78f48504dd2af500a442
+onboot:
+  - name: sysctl
+    image: linuxkit/sysctl:2fad4cdf96faa97bf7888696b8c3ca00f98137af
+  - name: dhcpcd
+    image: linuxkit/dhcpcd:4681273eeea47c26d980958656e60fe70d49e318
+    command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
+onshutdown:
+  - name: shutdown
+    image: busybox:latest
+    command: ["/bin/echo", "so long and thanks for all the fish"]
+services:
+  - name: getty
+    image: linuxkit/getty:37a16fb37f56ad0aee6532c1a39d780416f7fb80
+    env:
+     - INSECURE=true
+  - name: rngd
+    image: linuxkit/rngd:80f22b0f60d23c29ce28d06674bc77fe3775a38b
+  - name: nginx
+    image: nginx:1.19.5-alpine
+    capabilities:
+     - CAP_NET_BIND_SERVICE
+     - CAP_CHOWN
+     - CAP_SETUID
+     - CAP_SETGID
+     - CAP_DAC_OVERRIDE
+    binds:
+     - /etc/resolv.conf:/etc/resolv.conf
+files:
+  - path: etc/linuxkit-config
+    metadata: yaml
diff --git a/test/cases/000_build/091_validate_linuxkit_yaml/test.sh b/test/cases/000_build/091_validate_linuxkit_yaml/test.sh
new file mode 100755
index 000000000..6da4b2004
--- /dev/null
+++ b/test/cases/000_build/091_validate_linuxkit_yaml/test.sh
@@ -0,0 +1,19 @@
+#!/bin/sh
+# SUMMARY: Check that the build-args are correctly passed to Dockerfiles
+# LABELS:
+# REPEAT:
+
+set -ex
+
+# Source libraries. Uncomment if needed/defined
+#. "${RT_LIB}"
+. "${RT_PROJECT_ROOT}/_lib/lib.sh"
+
+# Test code goes here
+RESULT=$(linuxkit build linuxkit.yaml 2>&1 || echo FAILED)
+if [ "${RESULT}" != "FAILED" ]; then
+    echo "Build should have failed with invalid yaml, instead was ${RESULT}"
+fi
+echo "Summary: correctly detected invalid yaml"
+
+exit 0