diff --git a/blueprints/docker-for-mac/base.yml b/blueprints/docker-for-mac/base.yml
index 66e9a74d6..9ced4fd56 100644
--- a/blueprints/docker-for-mac/base.yml
+++ b/blueprints/docker-for-mac/base.yml
@@ -3,6 +3,7 @@ kernel:
   image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 page_poison=1"
 init:
+  - linuxkit/vpnkit-expose-port:b9bbd9b79c4682daec991c71934341b50772de00 # install vpnkit-expose-port and vpnkit-iptables-wrapper on host
   - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
   - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
   - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
@@ -52,7 +53,7 @@ services:
   # vpnkit-forwarder forwards network traffic to/from the host via VSOCK port 62373. 
   # It needs access to the vpnkit 9P coordination share 
   - name: vpnkit-forwarder
-    image: "linuxkit/vpnkit-forwarder:e2776b82ddfe82ed7f90e55d7a2b424e62e9a279"
+    image: "linuxkit/vpnkit-forwarder:79aaeefac19b396396a3d3073c0a082735e86673"
     binds:
         - /var/vpnkit:/port
     net: host
diff --git a/blueprints/docker-for-mac/docker-17.06-ce.yml b/blueprints/docker-for-mac/docker-17.06-ce.yml
index c62cd61d6..bf026221b 100644
--- a/blueprints/docker-for-mac/docker-17.06-ce.yml
+++ b/blueprints/docker-for-mac/docker-17.06-ce.yml
@@ -11,11 +11,14 @@ services:
      - type: cgroup
        options: ["rw","nosuid","noexec","nodev","relatime"]
     binds:
-        - /var/lib/docker:/var/lib/docker
-        - /lib/modules:/lib/modules
-        - /var/vpnkit:/port
-        - /var/run:/var/run
-        - /var/config/docker:/var/config/docker
+     - /var/lib/docker:/var/lib/docker
+     - /lib/modules:/lib/modules
+     - /var/vpnkit:/port
+     - /var/vpnkit:/port # vpnkit control 9p mount
+     - /var/run:/var/run
+     - /var/config/docker:/var/config/docker
+     - /usr/bin/vpnkit-expose-port:/usr/bin/vpnkit-expose-port # userland proxy
+     - /usr/bin/vpnkit-iptables-wrapper:/usr/bin/iptables # iptables wrapper 
     command: [ "/usr/bin/docker-init", "/usr/bin/dockerd", "--",
             "--config-file", "/var/config/docker/daemon.json",
             "--swarm-default-advertise-addr=eth0",