diff --git a/blueprints/docker-for-mac.yml b/blueprints/docker-for-mac.yml
index c15f5af5f..c29a19e5a 100644
--- a/blueprints/docker-for-mac.yml
+++ b/blueprints/docker-for-mac.yml
@@ -1,23 +1,23 @@
 # This is a blueprint for building the open source components of Docker for Mac
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/init:2599bcd5013ce5962aa155ee8929c26160de13bd
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
   - linuxkit/containerd:b50181bc6e0084e5fcd6b6ad3cf433c4f66cae5a
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
   - name: sysfs
-    image: "linuxkit/sysfs:1244c5a86dfa2318c4e304af68d37e12367e1b7f"
+    image: "linuxkit/sysfs:b4091d81261f4582ff899a8510110fc4f2be2b49"
   - name: binfmt
-    image: "linuxkit/binfmt:8ac5535f57f0c6f5fe88317b9d22a7677093c765"
+    image: "linuxkit/binfmt:24e2b996f7d6ad20bfa9c9f1564a3c6172db47ce"
   # Format and mount the disk image in /var/lib/docker
   - name: format
-    image: "linuxkit/format:180cb2dc1de5e60373385080f8148abf10a3afac"
+    image: "linuxkit/format:ba085fdcac31c383acee3b4b91d78eb7095e5ac3"
   - name: mount
-    image: "linuxkit/mount:ff5338822f20375b8913f5a80f9ed4f6ea9a592b"
+    image: "linuxkit/mount:fe22dc5cbf109b4637b1caaafc76ccbf5140c3da"
     command: ["/mount.sh", "/var/lib/docker"]
   # mount-vpnkit mounts the 9p share used by vpnkit to coordinate port forwarding
   - name: mount-vpnkit
@@ -29,30 +29,30 @@ onboot:
     rootfsPropagation: shared
     command: ["sh", "-c", "mkdir -p /host_var/vpnkit/port && mount -v -t 9p -o trans=virtio,dfltuid=1001,dfltgid=50,version=9p2000 port /host_var/vpnkit"]
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
   # Enable getty for easier debugging
   - name: getty
-    image: "linuxkit/getty:ef9d667af71089326419fb08e9cc9d567cf15748"
+    image: "linuxkit/getty:6cbeee0392b0670053ce2bf05a5a0d67ec2bce05"
     env:
         - INSECURE=true
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
   # Run ntpd to keep time synchronised in the VM
   - name: ntpd
-    image: "linuxkit/openntpd:45deeb05f736162d941c9bf494983f655ab80aa5"
+    image: "linuxkit/openntpd:a4c642d52e985922fcd97db52e471db123cc6841"
   # VSOCK to unix domain socket forwarding. Forwards guest /var/run/docker.sock
   # to a socket on the host.
   - name: vsudd
-    image: "linuxkit/vsudd:a66df914201aac784195d5b78262f622fe7f910c"
+    image: "linuxkit/vsudd:9e5882b4450a97836e113bcad231f497aa7bdba4"
     binds:
         - /var/run:/var/run
     command: ["/vsudd", "-inport", "2375:unix:/var/run/docker.sock"]
   # vpnkit-forwarder forwards network traffic to/from the host via VSOCK port 62373. 
   # It needs access to the vpnkit 9P coordination share 
   - name: vpnkit-forwarder
-    image: "linuxkit/vpnkit-forwarder:883de832c2c3cb72cd9b01e3f7bd788649e0f2c2"
+    image: "linuxkit/vpnkit-forwarder:e2776b82ddfe82ed7f90e55d7a2b424e62e9a279"
     binds:
         - /var/vpnkit:/port
     net: host
@@ -61,7 +61,7 @@ services:
   # Bind mounts /var/run to allow vsudd to connect to docker.sock, /var/vpnkit
   # for vpnkit coordination and /var/config/docker for the configuration file.
   - name: docker-dfm
-    image: "linuxkit/docker-ce:dda71ff9fe5ebbfa794b98c57c32df286b212848"
+    image: "linuxkit/docker-ce:530912564c0b648aeeab2459c7b82ce40d48fd6a"
     capabilities:
      - all
     net: host
diff --git a/docs/external-disk.md b/docs/external-disk.md
index 740b35dbc..e91990895 100644
--- a/docs/external-disk.md
+++ b/docs/external-disk.md
@@ -40,9 +40,9 @@ To simplify the process, two `onboot` images are available for you to use:
 ```yml
 onboot:
   - name: format
-    image: "linuxkit/format:180cb2dc1de5e60373385080f8148abf10a3afac"
+    image: "linuxkit/format:ba085fdcac31c383acee3b4b91d78eb7095e5ac3"
   - name: mount
-    image: "linuxkit/mount:ff5338822f20375b8913f5a80f9ed4f6ea9a592b"
+    image: "linuxkit/mount:fe22dc5cbf109b4637b1caaafc76ccbf5140c3da"
     command: ["/mount.sh", "/var/external"]
 ```
 
diff --git a/docs/kernels.md b/docs/kernels.md
index ddcc59775..0403eff15 100644
--- a/docs/kernels.md
+++ b/docs/kernels.md
@@ -11,17 +11,16 @@ updated frequently to include bug and security fixes.  For some
 kernels we do carry additional patches, which are mostly back-ported
 fixes from newer kernels. The full kernel source with patches can be
 found on [github](https://github.com/linuxkit/linux). Each kernel
-image is tagged with the full kernel version plus the hash of the
-files it was created from (git tree hash of the `./kernel`
-directory). For convenience, the latest kernel of each stable series
-is also available under a shorthand tag, e.g. `linuxkit/kernel:4.9.x`
-for the latest `4.9` kernel. For selected kernels (mostly the LTS
-kernels and latest stable kernels) we also compile/push kernels with
-additional debugging enabled. The hub images for these kernels have
-the `_dbg` suffix in the tag. For some kernels, we also provide
-matching packages containing the `perf` utility for debugging and
-performance tracing.  The perf package is called `kernel-perf` and is
-tagged the same way as the kernel packages.
+image is tagged with the full kernel version (e.g.,
+`linuxkit/kernel:4.9.33`) and with the full kernel version plus the
+hash of the files it was created from (git tree hash of the `./kernel`
+directory). For selected kernels (mostly the LTS kernels and latest
+stable kernels) we also compile/push kernels with additional debugging
+enabled. The hub images for these kernels have the `_dbg` suffix in
+the tag. For some kernels, we also provide matching packages
+containing the `perf` utility for debugging and performance tracing.
+The perf package is called `kernel-perf` and is tagged the same way as
+the kernel packages.
 
 In addition to the official kernel images, LinuxKit offers the ability
 to build bootable Linux images with kernels from various
@@ -51,7 +50,7 @@ RAM disk.
 There is a [example](../tests/kmod), but basically one can use a
 multi-stage build to compile the kernel modules:
 ```
-FROM linuxkit/kernel:4.9.x AS ksrc
+FROM linuxkit/kernel:4.9.33 AS ksrc
 # Extract headers and compile module
 FROM linuxkit/kernel-compile:1b396c221af673757703258159ddc8539843b02b@sha256:6b32d205bfc6407568324337b707d195d027328dbfec554428ea93e7b0a8299b AS build
 COPY --from=ksrc /kernel-dev.tar /
@@ -73,20 +72,24 @@ configuration.
 To build and test locally modified kernels, e.g., to try a different
 kernel config or new patches, the existing kernel build system in the
 [`../kernel`](../kernel/) can be re-used. For example, assuming the
-current 4.9 kernel is 4.9.28, you can build a local kernel with:
+current 4.9 kernel is 4.9.33, you can build a local kernel with:
 ```
-make build_4.9.28 HASH=foo
+make build_4.9.x
 ```
 This will create a local kernel image called
-`linuxkit/kernel:4.9.28-foo` which you can use in your YAML file as:
+`linuxkit/kernel:4.9.33-<hash>-dirty` assuming you haven't committed you local changes. You can then use this in your YAML file as:
 ```
 kernel:
-  image: "linuxkit/kernel:4.9.28-foo"
+  image: "linuxkit/kernel:4.9.33-<hash>-dirty"
 ```
 
-If you have more substantial changes, or require a different kernel
-version, it's best to replicate the kernel build system and change the
-Docker Hub organisation to your own.
+If you have committed your local changes, the `-dirty` will not be appended. Then you can also override the Hub organisation to use the image elsewhere with:
+```
+make ORG=<your hub org>
+```
+The image will be uploaded to Hub and can be use in a YAML file as
+`<your hub org>/kernel:4.9.33` or as `<your hub
+org>/kernel:4.9.33-<hash>`.
 
 
 ## Working with Linux kernel patches for LinuxKit
diff --git a/examples/aws.yml b/examples/aws.yml
index a4e276a9e..83b9c49b7 100644
--- a/examples/aws.yml
+++ b/examples/aws.yml
@@ -1,24 +1,24 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: metadata
-    image: "linuxkit/metadata:31a0b0f5557c6123beaa9c33e3400ae3c03447e0"
+    image: "linuxkit/metadata:09781c8a8097e5aa3ae522c74856d80e1da3b915"
 services:
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
   - name: sshd
-    image: "linuxkit/sshd:14f9d669ba6b0ba1658dfb2eb7ac08e1b7d9f5a4"
+    image: "linuxkit/sshd:f095b62ddca658e99d5751872c933ef3d5d18cec"
     binds:
      - /var/config/ssh/authorized_keys:/root/.ssh/authorized_keys
   - name: nginx
diff --git a/examples/azure.yml b/examples/azure.yml
index 22de15926..977d41f66 100644
--- a/examples/azure.yml
+++ b/examples/azure.yml
@@ -1,21 +1,21 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
   - linuxkit/containerd:b1766e4c4c09f63ac4925a6e4612852a93f7e73b
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
 services:
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
   - name: sshd
-    image: "linuxkit/sshd:14f9d669ba6b0ba1658dfb2eb7ac08e1b7d9f5a4"
+    image: "linuxkit/sshd:f095b62ddca658e99d5751872c933ef3d5d18cec"
 files:
   - path: root/.ssh/authorized_keys
     source: ~/.ssh/id_rsa.pub
diff --git a/examples/docker.yml b/examples/docker.yml
index 0d9dd3efb..dbfe71ec8 100644
--- a/examples/docker.yml
+++ b/examples/docker.yml
@@ -1,36 +1,36 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
   - name: sysfs
-    image: linuxkit/sysfs:1244c5a86dfa2318c4e304af68d37e12367e1b7f
+    image: linuxkit/sysfs:b4091d81261f4582ff899a8510110fc4f2be2b49
   - name: binfmt
-    image: "linuxkit/binfmt:8ac5535f57f0c6f5fe88317b9d22a7677093c765"
+    image: "linuxkit/binfmt:24e2b996f7d6ad20bfa9c9f1564a3c6172db47ce"
   - name: format
-    image: "linuxkit/format:180cb2dc1de5e60373385080f8148abf10a3afac"
+    image: "linuxkit/format:ba085fdcac31c383acee3b4b91d78eb7095e5ac3"
   - name: mount
-    image: "linuxkit/mount:ff5338822f20375b8913f5a80f9ed4f6ea9a592b"
+    image: "linuxkit/mount:fe22dc5cbf109b4637b1caaafc76ccbf5140c3da"
     command: ["/mount.sh", "/var/lib/docker"]
 services:
   - name: getty
-    image: "linuxkit/getty:9f27c1272b6d128c9a09745e916f151d09cb0d27"
+    image: "linuxkit/getty:6cbeee0392b0670053ce2bf05a5a0d67ec2bce05"
     env:
      - INSECURE=true
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
   - name: ntpd
-    image: "linuxkit/openntpd:45deeb05f736162d941c9bf494983f655ab80aa5"
+    image: "linuxkit/openntpd:a4c642d52e985922fcd97db52e471db123cc6841"
   - name: docker
-    image: "linuxkit/docker-ce:dda71ff9fe5ebbfa794b98c57c32df286b212848"
+    image: "linuxkit/docker-ce:530912564c0b648aeeab2459c7b82ce40d48fd6a"
     capabilities:
      - all
     net: host
diff --git a/examples/gcp.yml b/examples/gcp.yml
index 3466398a0..a6ee1f9d2 100644
--- a/examples/gcp.yml
+++ b/examples/gcp.yml
@@ -1,28 +1,28 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: metadata
-    image: "linuxkit/metadata:31a0b0f5557c6123beaa9c33e3400ae3c03447e0"
+    image: "linuxkit/metadata:09781c8a8097e5aa3ae522c74856d80e1da3b915"
 services:
   - name: getty
-    image: "linuxkit/getty:9f27c1272b6d128c9a09745e916f151d09cb0d27"
+    image: "linuxkit/getty:6cbeee0392b0670053ce2bf05a5a0d67ec2bce05"
     env:
      - INSECURE=true
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
   - name: sshd
-    image: "linuxkit/sshd:14f9d669ba6b0ba1658dfb2eb7ac08e1b7d9f5a4"
+    image: "linuxkit/sshd:f095b62ddca658e99d5751872c933ef3d5d18cec"
     binds:
      - /var/config/ssh/authorized_keys:/root/.ssh/authorized_keys
   - name: nginx
diff --git a/examples/getty.yml b/examples/getty.yml
index 44313b7a6..96cff755d 100644
--- a/examples/getty.yml
+++ b/examples/getty.yml
@@ -1,25 +1,25 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
   - name: getty
-    image: "linuxkit/getty:9f27c1272b6d128c9a09745e916f151d09cb0d27"
+    image: "linuxkit/getty:6cbeee0392b0670053ce2bf05a5a0d67ec2bce05"
     # to make insecure with passwordless root login, uncomment following lines
     #env:
     # - INSECURE=true
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
 files:
   - path: etc/getty.shadow
     # sample sets password for root to "abcdefgh" (without quotes)
diff --git a/examples/minimal.yml b/examples/minimal.yml
index 63ba69b45..8bc3f7eea 100644
--- a/examples/minimal.yml
+++ b/examples/minimal.yml
@@ -1,17 +1,17 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
   - name: getty
-    image: "linuxkit/getty:9f27c1272b6d128c9a09745e916f151d09cb0d27"
+    image: "linuxkit/getty:6cbeee0392b0670053ce2bf05a5a0d67ec2bce05"
     env:
      - INSECURE=true
 trust:
diff --git a/examples/node_exporter.yml b/examples/node_exporter.yml
index 0761a7ca6..0a97404b7 100644
--- a/examples/node_exporter.yml
+++ b/examples/node_exporter.yml
@@ -1,21 +1,21 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 services:
   - name: getty
-    image: "linuxkit/getty:9f27c1272b6d128c9a09745e916f151d09cb0d27"
+    image: "linuxkit/getty:6cbeee0392b0670053ce2bf05a5a0d67ec2bce05"
     env:
      - INSECURE=true
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
   - name: node_exporter
-    image: "linuxkit/node_exporter:265b35e1c9bd659fff22b0345fc7c8735c787b3c"
+    image: "linuxkit/node_exporter:0e8d0f1d979507837ad88943864c02b310f7a78f"
 trust:
   org:
     - linuxkit
diff --git a/examples/packet.yml b/examples/packet.yml
index d6bb4e4cf..70fd71745 100644
--- a/examples/packet.yml
+++ b/examples/packet.yml
@@ -1,21 +1,21 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS1 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
 services:
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
   - name: sshd
-    image: "linuxkit/sshd:14f9d669ba6b0ba1658dfb2eb7ac08e1b7d9f5a4"
+    image: "linuxkit/sshd:f095b62ddca658e99d5751872c933ef3d5d18cec"
 files:
   - path: root/.ssh/authorized_keys
     source: ~/.ssh/id_rsa.pub
diff --git a/examples/redis-os.yml b/examples/redis-os.yml
index 0113e7047..6365b7f71 100644
--- a/examples/redis-os.yml
+++ b/examples/redis-os.yml
@@ -1,19 +1,19 @@
 # Minimal YAML to run a redis server (used at DockerCon'17)
 # connect: nc localhost 6379
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
   - name: getty
-    image: "linuxkit/getty:9f27c1272b6d128c9a09745e916f151d09cb0d27"
+    image: "linuxkit/getty:6cbeee0392b0670053ce2bf05a5a0d67ec2bce05"
     env:
      - INSECURE=true
   - name: redis
diff --git a/examples/sshd.yml b/examples/sshd.yml
index 9c8f0ffb3..821c7cffc 100644
--- a/examples/sshd.yml
+++ b/examples/sshd.yml
@@ -1,25 +1,25 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
 services:
   - name: getty
-    image: "linuxkit/getty:9f27c1272b6d128c9a09745e916f151d09cb0d27"
+    image: "linuxkit/getty:6cbeee0392b0670053ce2bf05a5a0d67ec2bce05"
     env:
      - INSECURE=true
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
   - name: sshd
-    image: "linuxkit/sshd:14f9d669ba6b0ba1658dfb2eb7ac08e1b7d9f5a4"
+    image: "linuxkit/sshd:f095b62ddca658e99d5751872c933ef3d5d18cec"
 files:
   - path: root/.ssh/authorized_keys
     source: ~/.ssh/id_rsa.pub
diff --git a/examples/swap.yml b/examples/swap.yml
index 0bf3b7760..7a1640ab1 100644
--- a/examples/swap.yml
+++ b/examples/swap.yml
@@ -1,34 +1,34 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
   - linuxkit/ca-certificates:eabc5a6e59f05aa91529d80e9a595b85b046f935
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: format
-    image: "linuxkit/format:180cb2dc1de5e60373385080f8148abf10a3afac"
+    image: "linuxkit/format:ba085fdcac31c383acee3b4b91d78eb7095e5ac3"
   - name: mount
-    image: "linuxkit/mount:ff5338822f20375b8913f5a80f9ed4f6ea9a592b"
+    image: "linuxkit/mount:fe22dc5cbf109b4637b1caaafc76ccbf5140c3da"
     command: ["/mount.sh", "/var/external"]
   - name: swap
-    image: "linuxkit/swap:e36b5e794256c2a56c000035f73a4d46f7ffb3e6"
+    image: "linuxkit/swap:cfdce4b41db13ce996cfa986b12b69b94f56f718"
     # to use unencrypted swap, use:
     # command: ["/swap.sh", "--path", "/var/external/swap", "--size", "1G"]
     command: ["/swap.sh", "--path", "/var/external/swap", "--size", "1G", "--encrypt"]
 services:
   - name: getty
-    image: "linuxkit/getty:9f27c1272b6d128c9a09745e916f151d09cb0d27"
+    image: "linuxkit/getty:6cbeee0392b0670053ce2bf05a5a0d67ec2bce05"
     env:
      - INSECURE=true
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
   - name: nginx
     image: "nginx:alpine"
     capabilities:
diff --git a/examples/vmware.yml b/examples/vmware.yml
index 884dfd8bf..f7e2bbbbe 100644
--- a/examples/vmware.yml
+++ b/examples/vmware.yml
@@ -1,23 +1,23 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=tty0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
 services:
   - name: getty
-    image: "linuxkit/getty:9f27c1272b6d128c9a09745e916f151d09cb0d27"
+    image: "linuxkit/getty:6cbeee0392b0670053ce2bf05a5a0d67ec2bce05"
     env:
      - INSECURE=true
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
   - name: nginx
     image: "nginx:alpine"
     capabilities:
diff --git a/examples/vpnkit-forwarder.yml b/examples/vpnkit-forwarder.yml
index 807097612..6b6c413a8 100644
--- a/examples/vpnkit-forwarder.yml
+++ b/examples/vpnkit-forwarder.yml
@@ -1,13 +1,13 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: mount-vpnkit
     image: "alpine:3.6"
@@ -19,15 +19,15 @@ onboot:
     command: ["sh", "-c", "mkdir /host_var/vpnkit && mount -v -t 9p -o trans=virtio,dfltuid=1001,dfltgid=50,version=9p2000 port /host_var/vpnkit"]
 services:
   - name: sshd
-    image: "linuxkit/sshd:14f9d669ba6b0ba1658dfb2eb7ac08e1b7d9f5a4"
+    image: "linuxkit/sshd:f095b62ddca658e99d5751872c933ef3d5d18cec"
   - name: vpnkit-forwarder
-    image: "linuxkit/vpnkit-forwarder:883de832c2c3cb72cd9b01e3f7bd788649e0f2c2"
+    image: "linuxkit/vpnkit-forwarder:e2776b82ddfe82ed7f90e55d7a2b424e62e9a279"
     binds:
         - /var/vpnkit:/port
     net: host
     command: ["/vpnkit-forwarder"]
   - name: vpnkit-expose-port
-    image: "linuxkit/vpnkit-forwarder:883de832c2c3cb72cd9b01e3f7bd788649e0f2c2"
+    image: "linuxkit/vpnkit-forwarder:e2776b82ddfe82ed7f90e55d7a2b424e62e9a279"
     net: none
     binds:
         - /var/vpnkit:/port
diff --git a/examples/vsudd.yml b/examples/vsudd.yml
index e6b5df54e..5b6e3427e 100644
--- a/examples/vsudd.yml
+++ b/examples/vsudd.yml
@@ -1,17 +1,17 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
   - name: vsudd
-    image: "linuxkit/vsudd:a66df914201aac784195d5b78262f622fe7f910c"
+    image: "linuxkit/vsudd:9e5882b4450a97836e113bcad231f497aa7bdba4"
     binds:
         - /run/containerd/containerd.sock:/run/containerd/containerd.sock
     command: ["/vsudd",
diff --git a/kernel/Makefile b/kernel/Makefile
index c88f079f6..40a00012a 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -2,11 +2,11 @@
 # in a scratch container, which contains the bzImage, a tar
 # ball with modules, the kernel sources, and in some case, the perf binary.
 #
-# Each kernel is pushed to hub twice, once as
-# linuxkit/kernel:<kernel>.<major>.<minor>-<hash> and once as
-# linuxkit/kernel:<kernel>.<major>.x. The <hash> is the git tree hash
-# of the current directory. The build will only rebuild the kernel
-# image if the git tree hash changed.
+# Each kernel is pushed to hub twice:
+# - linuxkit/kernel:<kernel>.<major>.<minor>-<hash>
+# - linuxkit/kernel:<kernel>.<major>.<minor>
+# The <hash> is the git tree hash of the current directory. The build
+# will only rebuild the kernel image if the git tree hash changed.
 #
 # For some kernels we also build a separate package containing the perf utility
 # which is specific to a given kernel. perf packages are tagged the same way
@@ -19,14 +19,25 @@ ORG?=linuxkit
 IMAGE:=kernel
 IMAGE_PERF:=kernel-perf
 
-.PHONY: check tag push sign
+# Add '-dirty' to hash if the repository is not clean. make does not
+# concatenate strings without spaces, so we use the documented trick
+# of replacing the space with nothing.
+DIRTY=$(shell git diff-index --quiet HEAD --; echo $$?)
+ifneq ($(DIRTY),0)
+HASH+=-dirty
+nullstring :=
+space := $(nullstring) $(nullstring)
+TAG=$(subst $(space),,$(HASH))
+else
+TAG=$(HASH)
+endif
+
+.PHONY: check tag push
 # Targets:
 # build: builds all kernels
-# push:  pushes all tagged kernel images to hub
-# sign:  sign and push all kernel images to hub
+# push:  pushes and sign all tagged kernel images to hub
 build:
 push:
-sign:
 
 # A template for defining kernel build
 # Arguments:
@@ -34,57 +45,45 @@ sign:
 # $2: Kernel "series", e.g., 4.9.x
 # $3: Build a debug kernel (used as suffix for image)
 # This defines targets like:
-# build_4.9.x, push_4.9.x and sign_4.9.x and adds them as dependencies
+# build_4.9.x and  push_4.9.x and adds them as dependencies
 # to the global targets
 # Set $3 to "_dbg", to build debug kernels. This defines targets like
 # build_4.9.x_dbg and adds "_dbg" to the hub image name.
 define kernel
 build_$(2)$(3): Dockerfile Makefile $(wildcard patches-$(2)/*) kernel_config-$(2) kernel_config.debug
-	docker pull $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) || \
+	docker pull $(ORG)/$(IMAGE):$(1)$(3)-$(TAG) || \
 		docker build \
 			--build-arg KERNEL_VERSION=$(1) \
 			--build-arg KERNEL_SERIES=$(2) \
 			--build-arg DEBUG=$(3) \
-			--no-cache -t $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) .
+			--no-cache -t $(ORG)/$(IMAGE):$(1)$(3)-$(TAG) .
 
 push_$(2)$(3): build_$(2)$(3)
-	docker pull $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) || \
-		(docker push $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) && \
-		 docker tag $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) $(ORG)/$(IMAGE):$(2)$(3) && \
-		 docker push $(ORG)/$(IMAGE):$(2)$(3))
-
-sign_$(2)$(3): build_$(2)$(3)
-	DOCKER_CONTENT_TRUST=1 docker pull $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) || \
-		(DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) && \
-		 docker tag $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) $(ORG)/$(IMAGE):$(2)$(3) && \
-		 DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(2)$(3))
+	@if [ $(DIRTY) -ne 0 ]; then echo "Your repository is not clean. Will not push image"; exit 1; fi
+	DOCKER_CONTENT_TRUST=1 docker pull $(ORG)/$(IMAGE):$(1)$(3)-$(TAG) || \
+		(DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(1)$(3)-$(TAG) && \
+		 docker tag $(ORG)/$(IMAGE):$(1)$(3)-$(TAG) $(ORG)/$(IMAGE):$(1)$(3) && \
+		 DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(1)$(3))
 
 build: build_$(2)$(3)
 push: push_$(2)$(3)
-sign: sign_$(2)$(3)
 
 ifneq ($(2), 4.4.x)
 build_perf_$(2)$(3): build_$(2)$(3)
-	docker pull $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(HASH) || \
+	docker pull $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(TAG) || \
 		docker build -f Dockerfile.perf \
-			--build-arg IMAGE=$(ORG)/$(IMAGE):$(1)$(3)-$(HASH) \
-	 		--no-cache --network=none -t $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(HASH) .
+			--build-arg IMAGE=$(ORG)/$(IMAGE):$(1)$(3)-$(TAG) \
+	 		--no-cache --network=none -t $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(TAG) .
 
 push_perf_$(2)$(3): build_perf_$(2)$(3)
-	docker pull $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(HASH) || \
-		(docker push $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(HASH) && \
-		 docker tag $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(HASH) $(ORG)/$(IMAGE_PERF):$(2)$(3) && \
-		 docker push $(ORG)/$(IMAGE_PERF):$(2)$(3))
-
-sign_perf_$(2)$(3): build_perf_$(2)$(3)
-	DOCKER_CONTENT_TRUST=1 docker pull $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(HASH) || \
-		(DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(HASH) && \
-		 docker tag $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(HASH) $(ORG)/$(IMAGE_PERF):$(2)$(3) && \
-		 DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE_PERF):$(2)$(3))
+	@if [ $(DIRTY) -ne 0 ]; then echo "Your repository is not clean. Will not push image"; exit 1; fi
+	DOCKER_CONTENT_TRUST=1 docker pull $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(TAG) || \
+		(DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(TAG) && \
+		 docker tag $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(TAG) $(ORG)/$(IMAGE_PERF):$(1)$(3) && \
+		 DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE_PERF):$(1)$(3))
 
 build: build_perf_$(2)$(3)
 push: push_perf_$(2)$(3)
-sign: sign_perf_$(2)$(3)
 endif
 
 endef
diff --git a/linuxkit.yml b/linuxkit.yml
index 2d7e85463..6c111c02e 100644
--- a/linuxkit.yml
+++ b/linuxkit.yml
@@ -1,26 +1,26 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
   - name: binfmt
-    image: "linuxkit/binfmt:8ac5535f57f0c6f5fe88317b9d22a7677093c765"
+    image: "linuxkit/binfmt:24e2b996f7d6ad20bfa9c9f1564a3c6172db47ce"
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
   - name: getty
-    image: "linuxkit/getty:9f27c1272b6d128c9a09745e916f151d09cb0d27"
+    image: "linuxkit/getty:6cbeee0392b0670053ce2bf05a5a0d67ec2bce05"
     env:
      - INSECURE=true
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
   - name: nginx
     image: "nginx:alpine"
     capabilities:
diff --git a/pkg/binfmt/Dockerfile b/pkg/binfmt/Dockerfile
index 9eae1e14e..dd6dadf76 100644
--- a/pkg/binfmt/Dockerfile
+++ b/pkg/binfmt/Dockerfile
@@ -1,10 +1,10 @@
-FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 AS qemu
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 AS qemu
 RUN apk add \
     qemu-aarch64 \
     qemu-arm \
     qemu-ppc64le
 
-FROM linuxkit/alpine:451603daf499e3a40308dbf5571dcffed2343ffa AS mirror
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 AS mirror
 
 RUN apk add --no-cache go musl-dev
 ENV GOPATH=/go PATH=$PATH:/go/bin
diff --git a/pkg/ca-certificates/Dockerfile b/pkg/ca-certificates/Dockerfile
index 3bd8c7dc5..35bab864e 100644
--- a/pkg/ca-certificates/Dockerfile
+++ b/pkg/ca-certificates/Dockerfile
@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 as alpine
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 as alpine
 
 RUN apk add ca-certificates
 
diff --git a/pkg/containerd/Dockerfile b/pkg/containerd/Dockerfile
index 9587cbcac..0aef231f4 100644
--- a/pkg/containerd/Dockerfile
+++ b/pkg/containerd/Dockerfile
@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:c96f56ef989ccb31fd115d25c1b90f05b992271d as alpine
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 as alpine
 RUN \
   apk add \
   btrfs-progs-dev \
diff --git a/pkg/dhcpcd/Dockerfile b/pkg/dhcpcd/Dockerfile
index fd40b6fbb..7dfc17ba8 100644
--- a/pkg/dhcpcd/Dockerfile
+++ b/pkg/dhcpcd/Dockerfile
@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 AS mirror
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 AS mirror
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \
     alpine-baselayout \
diff --git a/pkg/docker-ce/Dockerfile b/pkg/docker-ce/Dockerfile
index cf5f235c7..28c251bd9 100644
--- a/pkg/docker-ce/Dockerfile
+++ b/pkg/docker-ce/Dockerfile
@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 AS mirror
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 AS mirror
 
 # https://github.com/docker/docker/blob/master/project/PACKAGERS.md#runtime-dependencies
 # removed openssl as I do not think server needs it
@@ -17,7 +17,7 @@ RUN apk add --no-cache --initdb -p /out \
 	xz
 RUN rm -rf /out/etc/apk /out/lib/apk /out/var/cache
 
-FROM linuxkit/vpnkit-forwarder:883de832c2c3cb72cd9b01e3f7bd788649e0f2c2 AS vpnkit
+FROM linuxkit/vpnkit-forwarder:e2776b82ddfe82ed7f90e55d7a2b424e62e9a279 AS vpnkit
 FROM scratch
 COPY --from=mirror /out/ /
 COPY --from=vpnkit /vpnkit-expose-port /usr/bin/vpnkit-expose-port
diff --git a/pkg/format/Dockerfile b/pkg/format/Dockerfile
index 73f1c604f..0342b710c 100644
--- a/pkg/format/Dockerfile
+++ b/pkg/format/Dockerfile
@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 AS mirror
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 AS mirror
 
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \
diff --git a/pkg/getty/Dockerfile b/pkg/getty/Dockerfile
index bc679a09c..73ed45b9d 100644
--- a/pkg/getty/Dockerfile
+++ b/pkg/getty/Dockerfile
@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 AS mirror
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 AS mirror
 
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \
diff --git a/pkg/getty/README.md b/pkg/getty/README.md
index d0f2f2211..2bedc7743 100644
--- a/pkg/getty/README.md
+++ b/pkg/getty/README.md
@@ -10,7 +10,7 @@ If you want a console getty, add the following to your `moby.yml`:
 ```
 services:
   - name: getty
-    image: "linuxkit/getty:886d35fe30c47750e8cfbf2f73016e9d2cc6361a"
+    image: "linuxkit/getty:<hash>"
 ```
 
 The above will launch a getty for each console defined in the cmdline, i.e. `/proc/cmdline`.
@@ -70,17 +70,3 @@ In addition to the usual getty shell, it is possible that you have a LinuxKit bu
 In that case, you can make `linuxkit/getty` an `init:` level container. This will lead to a `sh` running on the console.
 
 **This is highly insecure and should not be used except to debug system startup where containerd will not start itself or services. In all other cases, use getty only via services.**
-
-To use it this way:
-
-```yml
-kernel:
-  image: "linuxkit/kernel:4.9.x"
-  cmdline: "console=ttyS0 console=tty0 page_poison=1"
-init:
-  - linuxkit/init:1b8a7e394d2ec2f1fdb4d67645829d1b5bdca037
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:b1766e4c4c09f63ac4925a6e4612852a93f7e73b
-  - linuxkit/ca-certificates:eabc5a6e59f05aa91529d80e9a595b85b046f935
-  - linuxkit/getty:8305d9a564bfbe38b7ea6d6f5bccd95ae59b03d2
-```
diff --git a/pkg/init/Dockerfile b/pkg/init/Dockerfile
index 85af575cb..73f6804d2 100644
--- a/pkg/init/Dockerfile
+++ b/pkg/init/Dockerfile
@@ -1,10 +1,10 @@
-FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 AS build
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 AS build
 RUN apk add --no-cache --initdb alpine-baselayout make gcc musl-dev
 
 ADD usermode-helper.c .
 RUN make usermode-helper
 
-FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 AS mirror
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 AS mirror
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out alpine-baselayout busybox musl
 
diff --git a/pkg/metadata/Dockerfile b/pkg/metadata/Dockerfile
index d3fa8fd1d..518fab4ef 100644
--- a/pkg/metadata/Dockerfile
+++ b/pkg/metadata/Dockerfile
@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:451603daf499e3a40308dbf5571dcffed2343ffa AS mirror
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 AS mirror
 
 RUN apk add --no-cache go musl-dev
 ENV GOPATH=/go PATH=$PATH:/go/bin
diff --git a/pkg/mkimage/Dockerfile b/pkg/mkimage/Dockerfile
index a5fa368d0..656393915 100644
--- a/pkg/mkimage/Dockerfile
+++ b/pkg/mkimage/Dockerfile
@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 AS mirror
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 AS mirror
 
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \
diff --git a/pkg/mount/Dockerfile b/pkg/mount/Dockerfile
index b4609b24b..9b3da8ad8 100644
--- a/pkg/mount/Dockerfile
+++ b/pkg/mount/Dockerfile
@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 AS mirror
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 AS mirror
 
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \
diff --git a/pkg/open-vm-tools/Dockerfile b/pkg/open-vm-tools/Dockerfile
index 18db88aac..471b8a2d5 100644
--- a/pkg/open-vm-tools/Dockerfile
+++ b/pkg/open-vm-tools/Dockerfile
@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 AS mirror
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 AS mirror
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \
     alpine-baselayout \
diff --git a/pkg/openntpd/Dockerfile b/pkg/openntpd/Dockerfile
index a021587c4..09440cd54 100644
--- a/pkg/openntpd/Dockerfile
+++ b/pkg/openntpd/Dockerfile
@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 AS mirror
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 AS mirror
 
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \
diff --git a/pkg/package.mk b/pkg/package.mk
index 4ef4f57c0..08a2d262b 100644
--- a/pkg/package.mk
+++ b/pkg/package.mk
@@ -5,13 +5,39 @@ ORG?=linuxkit
 HASH?=$(shell git ls-tree HEAD -- ../$(notdir $(CURDIR)) | awk '{print $$3}')
 BASE_DEPS=Dockerfile Makefile
 
-tag: $(BASE_DEPS) $(DEPS)
-ifndef $(NETWORK)
-	docker build -t $(ORG)/$(IMAGE):$(HASH) .
+# Add '-dirty' to hash if the repository is not clean. make does not
+# concatenate strings without spaces, so we use the documented trick
+# of replacing the space with nothing.
+DIRTY=$(shell git diff-index --quiet HEAD --; echo $$?)
+ifneq ($(DIRTY),0)
+HASH+=-dirty
+nullstring :=
+space := $(nullstring) $(nullstring)
+TAG=$(subst $(space),,$(HASH))
 else
-	docker build --network=none -t $(ORG)/$(IMAGE):$(HASH) .
+TAG=$(HASH)
 endif
 
+# Get a release tag, if present
+RELEASE=$(shell git tag -l --points-at HEAD)
+
+ifndef $(NETWORK)
+NET_OPT=
+else
+NET_OPT=--network=none
+endif
+
+tag: $(BASE_DEPS) $(DEPS)
+	DOCKER_CONTENT_TRUST=1 docker pull $(ORG)/$(IMAGE):$(TAG) || \
+	docker build $(NET_OPT) -t $(ORG)/$(IMAGE):$(TAG) .
+
 push: tag
-	DOCKER_CONTENT_TRUST=1 docker pull $(ORG)/$(IMAGE):$(HASH) || \
-	DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(HASH)
+ifneq ($(DIRTY),0)
+	$(error Your repository is not clean. Will not push package image.)
+endif
+	DOCKER_CONTENT_TRUST=1 docker pull $(ORG)/$(IMAGE):$(TAG) || \
+	DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(TAG)
+ifneq ($(RELEASE),)
+	docker tag $(ORG)/$(IMAGE):$(TAG) $(ORG)/$(IMAGE):$(RELEASE)	
+	DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(RELEASE)
+endif
diff --git a/pkg/qemu-ga/Dockerfile b/pkg/qemu-ga/Dockerfile
index 9691b25f4..32629d1c8 100644
--- a/pkg/qemu-ga/Dockerfile
+++ b/pkg/qemu-ga/Dockerfile
@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 AS build
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 AS build
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN mkdir -p /out/var/run
 RUN apk add --no-cache --initdb -p /out \
diff --git a/pkg/rngd/Dockerfile b/pkg/rngd/Dockerfile
index 07fd49dbd..e126fee1a 100644
--- a/pkg/rngd/Dockerfile
+++ b/pkg/rngd/Dockerfile
@@ -1,14 +1,15 @@
-FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 AS mirror
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 AS mirror
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \
     tini
 RUN rm -rf /out/etc/apk /out/lib/apk /out/var/cache
 RUN mkdir -p /out/dev /out/proc /out/sys
 
-FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 AS build
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 AS build
 RUN apk add \
     argp-standalone \
     automake \
+    curl \
     gcc \
     linux-headers \
     make \
@@ -19,7 +20,7 @@ COPY . /
 
 ENV pkgname=rng-tools pkgver=5
 
-ADD http://downloads.sourceforge.net/project/gkernel/$pkgname/$pkgver/$pkgname-$pkgver.tar.gz $pkgname-$pkgver.tar.gz
+RUN curl -fSL "http://downloads.sourceforge.net/project/gkernel/$pkgname/$pkgver/$pkgname-$pkgver.tar.gz" -o "$pkgname-$pkgver.tar.gz"
 RUN sha256sum -c sha256sums
 RUN zcat $pkgname-$pkgver.tar.gz | tar xf -
 
diff --git a/pkg/runc/Dockerfile b/pkg/runc/Dockerfile
index b49ecfde2..02a83f3d5 100644
--- a/pkg/runc/Dockerfile
+++ b/pkg/runc/Dockerfile
@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 as alpine
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 as alpine
 RUN \
   apk add \
   bash \
diff --git a/pkg/sshd/Dockerfile b/pkg/sshd/Dockerfile
index ad6889148..bf6f1c618 100644
--- a/pkg/sshd/Dockerfile
+++ b/pkg/sshd/Dockerfile
@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 AS mirror
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 AS mirror
 
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \
diff --git a/pkg/swap/Dockerfile b/pkg/swap/Dockerfile
index 7ad7f0ab0..c95d5da2d 100644
--- a/pkg/swap/Dockerfile
+++ b/pkg/swap/Dockerfile
@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 AS mirror
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 AS mirror
 
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \
diff --git a/pkg/swap/README.md b/pkg/swap/README.md
index 4c668fbdd..71d32677d 100644
--- a/pkg/swap/README.md
+++ b/pkg/swap/README.md
@@ -8,7 +8,7 @@ Normally, unless you are running explicitly in a desktop version, LinuxKit image
 ```
 onboot:
   - name: swap
-    image: "linuxkit/swap:e36b5e794256c2a56c000035f73a4d46f7ffb3e6"
+    image: "linuxkit/swap:<hash>"
     command: ["swap.sh","--path","/var/external/swap","--size","2G"]
 ```
 
diff --git a/pkg/sysctl/Dockerfile b/pkg/sysctl/Dockerfile
index 828e80ac1..994794b24 100644
--- a/pkg/sysctl/Dockerfile
+++ b/pkg/sysctl/Dockerfile
@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 AS mirror
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 AS mirror
 
 RUN apk add --no-cache go musl-dev
 ENV GOPATH=/go PATH=$PATH:/go/bin
diff --git a/pkg/sysfs/Dockerfile b/pkg/sysfs/Dockerfile
index 3383ef010..4ee6397f0 100644
--- a/pkg/sysfs/Dockerfile
+++ b/pkg/sysfs/Dockerfile
@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 AS mirror
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 AS mirror
 
 RUN apk add --no-cache go musl-dev
 ENV GOPATH=/go PATH=$PATH:/go/bin
diff --git a/pkg/vpnkit-forwarder/Dockerfile b/pkg/vpnkit-forwarder/Dockerfile
index e6141e2ac..65ab82b22 100644
--- a/pkg/vpnkit-forwarder/Dockerfile
+++ b/pkg/vpnkit-forwarder/Dockerfile
@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 AS mirror
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 AS mirror
 
 RUN apk add --no-cache go musl-dev git build-base
 ENV GOPATH=/go PATH=$PATH:/go/bin 
diff --git a/pkg/vsudd/Dockerfile b/pkg/vsudd/Dockerfile
index d9f6392e5..aba279eca 100644
--- a/pkg/vsudd/Dockerfile
+++ b/pkg/vsudd/Dockerfile
@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 AS mirror
+FROM linuxkit/alpine:c608d404c1cb36cce0c7d9303e30b52c9d81ccf0 AS mirror
 
 RUN apk add --no-cache go musl-dev git build-base
 ENV GOPATH=/go PATH=$PATH:/go/bin 
diff --git a/projects/compose/compose-dynamic.yml b/projects/compose/compose-dynamic.yml
index aff359fed..3c7d84f3b 100644
--- a/projects/compose/compose-dynamic.yml
+++ b/projects/compose/compose-dynamic.yml
@@ -1,33 +1,33 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 page_poison=1"
 init:
   - linuxkit/init:1b8a7e394d2ec2f1fdb4d67645829d1b5bdca037
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
   - linuxkit/containerd:b1766e4c4c09f63ac4925a6e4612852a93f7e73b
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
   - name: sysfs
-    image: linuxkit/sysfs:1244c5a86dfa2318c4e304af68d37e12367e1b7f
+    image: linuxkit/sysfs:b4091d81261f4582ff899a8510110fc4f2be2b49
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: binfmt
-    image: "linuxkit/binfmt:8ac5535f57f0c6f5fe88317b9d22a7677093c765"
+    image: "linuxkit/binfmt:24e2b996f7d6ad20bfa9c9f1564a3c6172db47ce"
   - name: format
-    image: "linuxkit/format:180cb2dc1de5e60373385080f8148abf10a3afac"
+    image: "linuxkit/format:ba085fdcac31c383acee3b4b91d78eb7095e5ac3"
   - name: mount
-    image: "linuxkit/mount:ff5338822f20375b8913f5a80f9ed4f6ea9a592b"
+    image: "linuxkit/mount:fe22dc5cbf109b4637b1caaafc76ccbf5140c3da"
     command: ["/mount.sh", "/var/lib/docker"]
 services:
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
   - name: ntpd
-    image: "linuxkit/openntpd:45deeb05f736162d941c9bf494983f655ab80aa5"
+    image: "linuxkit/openntpd:a4c642d52e985922fcd97db52e471db123cc6841"
   - name: docker
-    image: "linuxkit/docker-ce:dda71ff9fe5ebbfa794b98c57c32df286b212848"
+    image: "linuxkit/docker-ce:530912564c0b648aeeab2459c7b82ce40d48fd6a"
     capabilities:
      - all
     net: host
diff --git a/projects/compose/compose-static.yml b/projects/compose/compose-static.yml
index 59dd920f2..feabd1f02 100644
--- a/projects/compose/compose-static.yml
+++ b/projects/compose/compose-static.yml
@@ -1,33 +1,33 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 page_poison=1"
 init:
   - linuxkit/init:1b8a7e394d2ec2f1fdb4d67645829d1b5bdca037
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
   - linuxkit/containerd:b1766e4c4c09f63ac4925a6e4612852a93f7e73b
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
   - name: sysfs
-    image: linuxkit/sysfs:1244c5a86dfa2318c4e304af68d37e12367e1b7f
+    image: linuxkit/sysfs:b4091d81261f4582ff899a8510110fc4f2be2b49
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: binfmt
-    image: "linuxkit/binfmt:8ac5535f57f0c6f5fe88317b9d22a7677093c765"
+    image: "linuxkit/binfmt:24e2b996f7d6ad20bfa9c9f1564a3c6172db47ce"
   - name: format
-    image: "linuxkit/format:180cb2dc1de5e60373385080f8148abf10a3afac"
+    image: "linuxkit/format:ba085fdcac31c383acee3b4b91d78eb7095e5ac3"
   - name: mount
-    image: "linuxkit/mount:ff5338822f20375b8913f5a80f9ed4f6ea9a592b"
+    image: "linuxkit/mount:fe22dc5cbf109b4637b1caaafc76ccbf5140c3da"
     command: ["/mount.sh", "/var/lib/docker"]
 services:
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
   - name: ntpd
-    image: "linuxkit/openntpd:45deeb05f736162d941c9bf494983f655ab80aa5"
+    image: "linuxkit/openntpd:a4c642d52e985922fcd97db52e471db123cc6841"
   - name: docker
-    image: "linuxkit/docker-ce:dda71ff9fe5ebbfa794b98c57c32df286b212848"
+    image: "linuxkit/docker-ce:530912564c0b648aeeab2459c7b82ce40d48fd6a"
     capabilities:
      - all
     net: host
diff --git a/projects/etcd/etcd.yml b/projects/etcd/etcd.yml
index dd7a0ba8d..d72389ffe 100644
--- a/projects/etcd/etcd.yml
+++ b/projects/etcd/etcd.yml
@@ -1,31 +1,31 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
   - linuxkit/init:1b8a7e394d2ec2f1fdb4d67645829d1b5bdca037
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
   - name: format
-    image: "linuxkit/format:180cb2dc1de5e60373385080f8148abf10a3afac"
+    image: "linuxkit/format:ba085fdcac31c383acee3b4b91d78eb7095e5ac3"
   - name: mount
-    image: "linuxkit/mount:ff5338822f20375b8913f5a80f9ed4f6ea9a592b"
+    image: "linuxkit/mount:fe22dc5cbf109b4637b1caaafc76ccbf5140c3da"
     command: ["/mount.sh", "/var/lib/etcd"]
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: metadata
     image: "linuxkit/metadata:4e73345cdcb4f7e9df07b0ee7aede652960297f2"
 services:
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
   - name: ntpd
-    image: "linuxkit/openntpd:45deeb05f736162d941c9bf494983f655ab80aa5"
+    image: "linuxkit/openntpd:a4c642d52e985922fcd97db52e471db123cc6841"
   - name: node_exporter
-    image: "linuxkit/node_exporter:265b35e1c9bd659fff22b0345fc7c8735c787b3c"
+    image: "linuxkit/node_exporter:0e8d0f1d979507837ad88943864c02b310f7a78f"
   - name: etcd
     image: "moby/etcd"
     capabilities:
diff --git a/projects/etcd/prom-us-central1-f.yml b/projects/etcd/prom-us-central1-f.yml
index f00bf6974..e6b48a08c 100644
--- a/projects/etcd/prom-us-central1-f.yml
+++ b/projects/etcd/prom-us-central1-f.yml
@@ -10,7 +10,7 @@ onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: metadata
     image: "linuxkit/metadata:4e73345cdcb4f7e9df07b0ee7aede652960297f2"
diff --git a/projects/ima-namespace/ima-namespace.yml b/projects/ima-namespace/ima-namespace.yml
index a71090e90..76e87d0b3 100644
--- a/projects/ima-namespace/ima-namespace.yml
+++ b/projects/ima-namespace/ima-namespace.yml
@@ -3,21 +3,21 @@ kernel:
   cmdline: "console=ttyS0 console=tty0 page_poison=1 ima_appraise=enforce_ns"
 init:
   - linuxkit/init:b3740303f3d1e5689a84c87b7dfb48fd2a40a192
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
   - linuxkit/ima-utils:dfeb3896fd29308b80ff9ba7fe5b8b767e40ca29
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
   - name: binfmt
-    image: "linuxkit/binfmt:8ac5535f57f0c6f5fe88317b9d22a7677093c765"
+    image: "linuxkit/binfmt:24e2b996f7d6ad20bfa9c9f1564a3c6172db47ce"
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
   - name: nginx
     image: "nginx:alpine"
     capabilities:
diff --git a/projects/kubernetes/image-cache/Dockerfile b/projects/kubernetes/image-cache/Dockerfile
index 0e3d7455f..4bfd174c6 100644
--- a/projects/kubernetes/image-cache/Dockerfile
+++ b/projects/kubernetes/image-cache/Dockerfile
@@ -1,4 +1,4 @@
-FROM linuxkit/docker-ce:dda71ff9fe5ebbfa794b98c57c32df286b212848
+FROM linuxkit/docker-ce:530912564c0b648aeeab2459c7b82ce40d48fd6a
 ADD . /images
 ENTRYPOINT [ "/bin/sh", "-c" ]
 CMD [ "for image in /images/*.tar ; do docker image load -i $image && rm -f $image ; done" ]
diff --git a/projects/kubernetes/kube-master.yml b/projects/kubernetes/kube-master.yml
index 38ecf77d1..f0d8018f3 100644
--- a/projects/kubernetes/kube-master.yml
+++ b/projects/kubernetes/kube-master.yml
@@ -1,20 +1,20 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
   - name: sysfs
-    image: linuxkit/sysfs:1244c5a86dfa2318c4e304af68d37e12367e1b7f
+    image: linuxkit/sysfs:b4091d81261f4582ff899a8510110fc4f2be2b49
   - name: binfmt
-    image: "linuxkit/binfmt:8ac5535f57f0c6f5fe88317b9d22a7677093c765"
+    image: "linuxkit/binfmt:24e2b996f7d6ad20bfa9c9f1564a3c6172db47ce"
   - name: format
-    image: "linuxkit/format:180cb2dc1de5e60373385080f8148abf10a3afac"
+    image: "linuxkit/format:ba085fdcac31c383acee3b4b91d78eb7095e5ac3"
   - name: mounts
     image: "linuxkit/kubernetes:latest-mounts"
     capabilities:
@@ -26,19 +26,19 @@ onboot:
      - /var:/var:rshared,rbind
 services:
   - name: getty
-    image: "linuxkit/getty:9f27c1272b6d128c9a09745e916f151d09cb0d27"
+    image: "linuxkit/getty:6cbeee0392b0670053ce2bf05a5a0d67ec2bce05"
     env:
      - INSECURE=true
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
   - name: ntpd
-    image: "linuxkit/openntpd:45deeb05f736162d941c9bf494983f655ab80aa5"
+    image: "linuxkit/openntpd:a4c642d52e985922fcd97db52e471db123cc6841"
   - name: sshd
-    image: "linuxkit/sshd:14f9d669ba6b0ba1658dfb2eb7ac08e1b7d9f5a4"
+    image: "linuxkit/sshd:f095b62ddca658e99d5751872c933ef3d5d18cec"
   - name: docker
-    image: "linuxkit/docker-ce:dda71ff9fe5ebbfa794b98c57c32df286b212848"
+    image: "linuxkit/docker-ce:530912564c0b648aeeab2459c7b82ce40d48fd6a"
     capabilities:
      - all
     net: host
diff --git a/projects/kubernetes/kube-node.yml b/projects/kubernetes/kube-node.yml
index 1833ac916..c0ca7983e 100644
--- a/projects/kubernetes/kube-node.yml
+++ b/projects/kubernetes/kube-node.yml
@@ -1,20 +1,20 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
   - name: sysfs
-    image: linuxkit/sysfs:1244c5a86dfa2318c4e304af68d37e12367e1b7f
+    image: linuxkit/sysfs:b4091d81261f4582ff899a8510110fc4f2be2b49
   - name: binfmt
-    image: "linuxkit/binfmt:8ac5535f57f0c6f5fe88317b9d22a7677093c765"
+    image: "linuxkit/binfmt:24e2b996f7d6ad20bfa9c9f1564a3c6172db47ce"
   - name: format
-    image: "linuxkit/format:180cb2dc1de5e60373385080f8148abf10a3afac"
+    image: "linuxkit/format:ba085fdcac31c383acee3b4b91d78eb7095e5ac3"
   - name: mounts
     image: "linuxkit/kubernetes:latest-mounts"
     capabilities:
@@ -26,19 +26,19 @@ onboot:
      - /var:/var:rshared,rbind
 services:
   - name: getty
-    image: "linuxkit/getty:9f27c1272b6d128c9a09745e916f151d09cb0d27"
+    image: "linuxkit/getty:6cbeee0392b0670053ce2bf05a5a0d67ec2bce05"
     env:
      - INSECURE=true
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
   - name: ntpd
-    image: "linuxkit/openntpd:45deeb05f736162d941c9bf494983f655ab80aa5"
+    image: "linuxkit/openntpd:a4c642d52e985922fcd97db52e471db123cc6841"
   - name: sshd
-    image: "linuxkit/sshd:14f9d669ba6b0ba1658dfb2eb7ac08e1b7d9f5a4"
+    image: "linuxkit/sshd:f095b62ddca658e99d5751872c933ef3d5d18cec"
   - name: docker
-    image: "linuxkit/docker-ce:dda71ff9fe5ebbfa794b98c57c32df286b212848"
+    image: "linuxkit/docker-ce:530912564c0b648aeeab2459c7b82ce40d48fd6a"
     capabilities:
      - all
     net: host
diff --git a/projects/kubernetes/mounts.rb b/projects/kubernetes/mounts.rb
index bff3e2513..2f6c352df 100644
--- a/projects/kubernetes/mounts.rb
+++ b/projects/kubernetes/mounts.rb
@@ -1,6 +1,6 @@
 import 'common.rb'
 
-from "linuxkit/mount:ff5338822f20375b8913f5a80f9ed4f6ea9a592b"
+from "linuxkit/mount:fe22dc5cbf109b4637b1caaafc76ccbf5140c3da"
 
 script = [
   mount_bind_hostns_self("/etc/cni"), mount_make_hostns_rshared("/etc/cni"),
diff --git a/projects/logging/examples/logging.yml b/projects/logging/examples/logging.yml
index ed1b27a79..d6a0342af 100644
--- a/projects/logging/examples/logging.yml
+++ b/projects/logging/examples/logging.yml
@@ -1,23 +1,23 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
   - linuxkit/init:1b8a7e394d2ec2f1fdb4d67645829d1b5bdca037 # with runc, logwrite, startmemlogd
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
   - linuxkit/memlogd:9b5834189f598f43c507f6938077113906f51012
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
   - name: binfmt
-    image: "linuxkit/binfmt:8ac5535f57f0c6f5fe88317b9d22a7677093c765"
+    image: "linuxkit/binfmt:24e2b996f7d6ad20bfa9c9f1564a3c6172db47ce"
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
   - name: nginx
     image: "nginx:alpine"
     capabilities:
diff --git a/projects/miragesdk/examples/mirage-dhcp.yml b/projects/miragesdk/examples/mirage-dhcp.yml
index 9662cb7a7..bc13bc6b3 100644
--- a/projects/miragesdk/examples/mirage-dhcp.yml
+++ b/projects/miragesdk/examples/mirage-dhcp.yml
@@ -1,10 +1,10 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/init:2599bcd5013ce5962aa155ee8929c26160de13bd
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: sysctl
     image: linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018
@@ -28,9 +28,9 @@ onboot:
      - /lib:/lib     # for ifconfig
 services:
   - name: sshd
-    image: "linuxkit/sshd:14f9d669ba6b0ba1658dfb2eb7ac08e1b7d9f5a4"
+    image: "linuxkit/sshd:f095b62ddca658e99d5751872c933ef3d5d18cec"
   - name: getty
-    image: "linuxkit/getty:9f27c1272b6d128c9a09745e916f151d09cb0d27"
+    image: "linuxkit/getty:6cbeee0392b0670053ce2bf05a5a0d67ec2bce05"
     env:
      - INSECURE=true
 files:
diff --git a/projects/okernel/examples/okernel_simple.yaml b/projects/okernel/examples/okernel_simple.yaml
index 4b3ea721c..10f403973 100644
--- a/projects/okernel/examples/okernel_simple.yaml
+++ b/projects/okernel/examples/okernel_simple.yaml
@@ -3,19 +3,19 @@ kernel:
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
   - linuxkit/init:1b8a7e394d2ec2f1fdb4d67645829d1b5bdca037
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
   - linuxkit/containerd:5749f2e9e65395cc6635229e8da0e0d484320ddf
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
 services:
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
   - name: sshd
-    image: "linuxkit/sshd:14f9d669ba6b0ba1658dfb2eb7ac08e1b7d9f5a4"
+    image: "linuxkit/sshd:f095b62ddca658e99d5751872c933ef3d5d18cec"
 files:
   - path: root/.ssh/authorized_keys
     source: ~/.ssh/id_rsa.pub
diff --git a/projects/shiftfs/shiftfs.yml b/projects/shiftfs/shiftfs.yml
index f99c7e09e..187d69a96 100644
--- a/projects/shiftfs/shiftfs.yml
+++ b/projects/shiftfs/shiftfs.yml
@@ -2,25 +2,25 @@ kernel:
   image: "linuxkitprojects/kernel-shiftfs:4.11.4-881a041fc14bd95814cf140b5e98d97dd65160b5"
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
-  - linuxkit/init:2599bcd5013ce5962aa155ee8929c26160de13bd
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
   - name: binfmt
-    image: "linuxkit/binfmt:8ac5535f57f0c6f5fe88317b9d22a7677093c765"
+    image: "linuxkit/binfmt:24e2b996f7d6ad20bfa9c9f1564a3c6172db47ce"
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
   - name: getty
-    image: "linuxkit/getty:9f27c1272b6d128c9a09745e916f151d09cb0d27"
+    image: "linuxkit/getty:6cbeee0392b0670053ce2bf05a5a0d67ec2bce05"
     env:
      - INSECURE=true
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
   - name: nginx
     image: "nginx:alpine"
     capabilities:
diff --git a/projects/swarmd/swarmd.yml b/projects/swarmd/swarmd.yml
index 7d32ad31e..dea3efe8f 100644
--- a/projects/swarmd/swarmd.yml
+++ b/projects/swarmd/swarmd.yml
@@ -1,35 +1,35 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
   - linuxkit/init:1b8a7e394d2ec2f1fdb4d67645829d1b5bdca037
   - linuxkit/runc:2649198589ef0020d99f613adaeda45ce0093a38
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
     binds:
      - /etc/sysctl.d/01-swarmd.conf:/etc/sysctl.d/01-swarmd.conf
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: format
-    image: "linuxkit/format:180cb2dc1de5e60373385080f8148abf10a3afac"
+    image: "linuxkit/format:ba085fdcac31c383acee3b4b91d78eb7095e5ac3"
   - name: mount
-    image: "linuxkit/mount:ff5338822f20375b8913f5a80f9ed4f6ea9a592b"
+    image: "linuxkit/mount:fe22dc5cbf109b4637b1caaafc76ccbf5140c3da"
     command: ["/mount.sh", "/var/lib/swarmd"]
   - name: metadata
     image: "linuxkit/metadata:4e73345cdcb4f7e9df07b0ee7aede652960297f2"
 services:
   - name: qemu-ga
-    image: "linuxkit/qemu-ga:e5fbcf55926f6e1a96b3e49a392e547e8be1022c"
+    image: "linuxkit/qemu-ga:2dbdc6523df576773b7c7d56d3a394429a4488ce"
     binds:
       - /dev/vport0p1:/dev/vport0p1
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
   - name: ntpd
-    image: "linuxkit/openntpd:45deeb05f736162d941c9bf494983f655ab80aa5"
+    image: "linuxkit/openntpd:a4c642d52e985922fcd97db52e471db123cc6841"
   - name: swarmd
     image: "linuxkit/swarmd:1002422b78339a767559058d704b086889e90447"
     command: ["/usr/bin/swarmd", "--containerd-addr=/run/containerd/containerd.sock", "--log-level=debug", "--state-dir=/var/lib/swarmd"]
diff --git a/projects/wireguard/wireguard.yml b/projects/wireguard/wireguard.yml
index 17e7a3bb6..47f3b0b47 100644
--- a/projects/wireguard/wireguard.yml
+++ b/projects/wireguard/wireguard.yml
@@ -13,7 +13,7 @@ onboot:
   - name: binfmt
     image: "linuxkit/binfmt:603e5f064b3e8a64088c0fcf7a80d2783541ee1d"
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:ae03169274d19fe8841314fa5a6fea3c61adbf4e"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
   - name: rngd
diff --git a/test/cases/000_build/000_outputs/test.yml b/test/cases/000_build/000_outputs/test.yml
index e91c2ad50..51cea8781 100644
--- a/test/cases/000_build/000_outputs/test.yml
+++ b/test/cases/000_build/000_outputs/test.yml
@@ -1,13 +1,13 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 trust:
   org:
diff --git a/test/cases/010_platforms/000_qemu/000_run_kernel/test.yml b/test/cases/010_platforms/000_qemu/000_run_kernel/test.yml
index aaa53e8eb..bdc21d9ae 100644
--- a/test/cases/010_platforms/000_qemu/000_run_kernel/test.yml
+++ b/test/cases/010_platforms/000_qemu/000_run_kernel/test.yml
@@ -1,10 +1,10 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: poweroff
     image: "linuxkit/poweroff:7404cf2295df89ccfa2dda41997a28307a90cf28"
diff --git a/test/cases/010_platforms/000_qemu/010_run_iso/test.yml b/test/cases/010_platforms/000_qemu/010_run_iso/test.yml
index cde8652a3..849f73b24 100644
--- a/test/cases/010_platforms/000_qemu/010_run_iso/test.yml
+++ b/test/cases/010_platforms/000_qemu/010_run_iso/test.yml
@@ -1,10 +1,10 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: poweroff
     image: "linuxkit/poweroff:7404cf2295df89ccfa2dda41997a28307a90cf28"
diff --git a/test/cases/010_platforms/000_qemu/020_run_efi/test.yml b/test/cases/010_platforms/000_qemu/020_run_efi/test.yml
index aaa53e8eb..bdc21d9ae 100644
--- a/test/cases/010_platforms/000_qemu/020_run_efi/test.yml
+++ b/test/cases/010_platforms/000_qemu/020_run_efi/test.yml
@@ -1,10 +1,10 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: poweroff
     image: "linuxkit/poweroff:7404cf2295df89ccfa2dda41997a28307a90cf28"
diff --git a/test/cases/010_platforms/000_qemu/030_run_qcow/test.yml b/test/cases/010_platforms/000_qemu/030_run_qcow/test.yml
index aaa53e8eb..bdc21d9ae 100644
--- a/test/cases/010_platforms/000_qemu/030_run_qcow/test.yml
+++ b/test/cases/010_platforms/000_qemu/030_run_qcow/test.yml
@@ -1,10 +1,10 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: poweroff
     image: "linuxkit/poweroff:7404cf2295df89ccfa2dda41997a28307a90cf28"
diff --git a/test/cases/010_platforms/000_qemu/040_run_raw/test.yml b/test/cases/010_platforms/000_qemu/040_run_raw/test.yml
index aaa53e8eb..bdc21d9ae 100644
--- a/test/cases/010_platforms/000_qemu/040_run_raw/test.yml
+++ b/test/cases/010_platforms/000_qemu/040_run_raw/test.yml
@@ -1,10 +1,10 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: poweroff
     image: "linuxkit/poweroff:7404cf2295df89ccfa2dda41997a28307a90cf28"
diff --git a/test/cases/010_platforms/000_qemu/100_container/test.yml b/test/cases/010_platforms/000_qemu/100_container/test.yml
index 1d8f4d33c..ff6a07a0a 100644
--- a/test/cases/010_platforms/000_qemu/100_container/test.yml
+++ b/test/cases/010_platforms/000_qemu/100_container/test.yml
@@ -1,10 +1,10 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: poweroff
     image: "linuxkit/poweroff:7404cf2295df89ccfa2dda41997a28307a90cf28"
diff --git a/test/cases/010_platforms/010_hyperkit/000_run_kernel/test.yml b/test/cases/010_platforms/010_hyperkit/000_run_kernel/test.yml
index aaa53e8eb..bdc21d9ae 100644
--- a/test/cases/010_platforms/010_hyperkit/000_run_kernel/test.yml
+++ b/test/cases/010_platforms/010_hyperkit/000_run_kernel/test.yml
@@ -1,10 +1,10 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: poweroff
     image: "linuxkit/poweroff:7404cf2295df89ccfa2dda41997a28307a90cf28"
diff --git a/test/cases/020_kernel/000_config_4.4.x/test-kernel-config.yml b/test/cases/020_kernel/000_config_4.4.x/test-kernel-config.yml
index cf064b19d..d766649f3 100644
--- a/test/cases/020_kernel/000_config_4.4.x/test-kernel-config.yml
+++ b/test/cases/020_kernel/000_config_4.4.x/test-kernel-config.yml
@@ -1,10 +1,10 @@
 kernel:
-  image: "linuxkit/kernel:4.4.x"
+  image: "linuxkit/kernel:4.4.74"
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: check-kernel-config
     image: "linuxkit/test-kernel-config:9f08e3b99f8ac2f422251b3e8c94ce874ee34119"
diff --git a/test/cases/020_kernel/001_config_4.9.x/test-kernel-config.yml b/test/cases/020_kernel/001_config_4.9.x/test-kernel-config.yml
index 5300e2856..2eeb0aa92 100644
--- a/test/cases/020_kernel/001_config_4.9.x/test-kernel-config.yml
+++ b/test/cases/020_kernel/001_config_4.9.x/test-kernel-config.yml
@@ -1,10 +1,10 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: check-kernel-config
     image: "linuxkit/test-kernel-config:9f08e3b99f8ac2f422251b3e8c94ce874ee34119"
diff --git a/test/cases/020_kernel/003_config_4.11.x/test-kernel-config.yml b/test/cases/020_kernel/003_config_4.11.x/test-kernel-config.yml
index f4a925876..bc8d2a2ea 100644
--- a/test/cases/020_kernel/003_config_4.11.x/test-kernel-config.yml
+++ b/test/cases/020_kernel/003_config_4.11.x/test-kernel-config.yml
@@ -1,10 +1,10 @@
 kernel:
-  image: "linuxkit/kernel:4.11.x"
+  image: "linuxkit/kernel:4.11.7"
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: check-kernel-config
     image: "linuxkit/test-kernel-config:9f08e3b99f8ac2f422251b3e8c94ce874ee34119"
diff --git a/test/cases/020_kernel/010_kmod_4.9.x/Dockerfile b/test/cases/020_kernel/010_kmod_4.9.x/Dockerfile
index 7b45e112a..d0c64b4c6 100644
--- a/test/cases/020_kernel/010_kmod_4.9.x/Dockerfile
+++ b/test/cases/020_kernel/010_kmod_4.9.x/Dockerfile
@@ -3,7 +3,7 @@
 # In the last stage, it creates a package, which can be used for
 # testing.
 
-FROM linuxkit/kernel:4.9.x AS ksrc
+FROM linuxkit/kernel:4.9.34 AS ksrc
 
 # Extract headers and compile module
 FROM linuxkit/kernel-compile:1b396c221af673757703258159ddc8539843b02b@sha256:6b32d205bfc6407568324337b707d195d027328dbfec554428ea93e7b0a8299b AS build
diff --git a/test/cases/020_kernel/010_kmod_4.9.x/kmod.yml b/test/cases/020_kernel/010_kmod_4.9.x/kmod.yml
index f6169ca0f..d87d17961 100644
--- a/test/cases/020_kernel/010_kmod_4.9.x/kmod.yml
+++ b/test/cases/020_kernel/010_kmod_4.9.x/kmod.yml
@@ -1,10 +1,10 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: check
     image: "kmod-test"
diff --git a/test/cases/020_kernel/010_kmod_4.9.x/test.sh b/test/cases/020_kernel/010_kmod_4.9.x/test.sh
index 8a1e8034d..9be3b2792 100644
--- a/test/cases/020_kernel/010_kmod_4.9.x/test.sh
+++ b/test/cases/020_kernel/010_kmod_4.9.x/test.sh
@@ -18,7 +18,7 @@ clean_up() {
 trap clean_up EXIT
 
 # Make sure we have the latest kernel image
-docker pull linuxkit/kernel:4.9.x
+docker pull linuxkit/kernel:4.9.34
 # Build a package
 docker build -t ${IMAGE_NAME} .
 
diff --git a/test/cases/030_security/000_docker-bench/test-docker-bench.yml b/test/cases/030_security/000_docker-bench/test-docker-bench.yml
index 26e441dea..0a8697d2d 100644
--- a/test/cases/030_security/000_docker-bench/test-docker-bench.yml
+++ b/test/cases/030_security/000_docker-bench/test-docker-bench.yml
@@ -1,30 +1,30 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
   - name: sysfs
-    image: "linuxkit/sysfs:1244c5a86dfa2318c4e304af68d37e12367e1b7f"
+    image: "linuxkit/sysfs:b4091d81261f4582ff899a8510110fc4f2be2b49"
   - name: binfmt
-    image: "linuxkit/binfmt:8ac5535f57f0c6f5fe88317b9d22a7677093c765"
+    image: "linuxkit/binfmt:24e2b996f7d6ad20bfa9c9f1564a3c6172db47ce"
   - name: format
-    image: "linuxkit/format:180cb2dc1de5e60373385080f8148abf10a3afac"
+    image: "linuxkit/format:ba085fdcac31c383acee3b4b91d78eb7095e5ac3"
   - name: mount
-    image: "linuxkit/mount:ff5338822f20375b8913f5a80f9ed4f6ea9a592b"
+    image: "linuxkit/mount:fe22dc5cbf109b4637b1caaafc76ccbf5140c3da"
     command: ["/mount.sh", "/var/lib/docker"]
 services:
   - name: rngd
-    image: "linuxkit/rngd:1fa4de44c961bb5075647181891a3e7e7ba51c31"
+    image: "linuxkit/rngd:b50b22dd574c5377708977af769f053009fff6d5"
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
   - name: docker
-    image: "linuxkit/docker-ce:dda71ff9fe5ebbfa794b98c57c32df286b212848"
+    image: "linuxkit/docker-ce:530912564c0b648aeeab2459c7b82ce40d48fd6a"
     capabilities:
      - all
     net: host
diff --git a/test/cases/030_security/010_ports/test.yml b/test/cases/030_security/010_ports/test.yml
index f8ceef8b6..1b7081c99 100644
--- a/test/cases/030_security/010_ports/test.yml
+++ b/test/cases/030_security/010_ports/test.yml
@@ -1,10 +1,10 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: test
     image: "alpine:3.6"
diff --git a/test/cases/040_packages/002_binfmt/test-binfmt.yml b/test/cases/040_packages/002_binfmt/test-binfmt.yml
index 3b59bff56..a787ce8fc 100644
--- a/test/cases/040_packages/002_binfmt/test-binfmt.yml
+++ b/test/cases/040_packages/002_binfmt/test-binfmt.yml
@@ -1,13 +1,13 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: binfmt
-    image: "linuxkit/binfmt:8ac5535f57f0c6f5fe88317b9d22a7677093c765"
+    image: "linuxkit/binfmt:24e2b996f7d6ad20bfa9c9f1564a3c6172db47ce"
   - name: test
     image: "alpine:3.6"
     readonly: true
diff --git a/test/cases/040_packages/003_ca-certificates/test-ca-certificates.yml b/test/cases/040_packages/003_ca-certificates/test-ca-certificates.yml
index 18c2834e1..1f672a2b6 100644
--- a/test/cases/040_packages/003_ca-certificates/test-ca-certificates.yml
+++ b/test/cases/040_packages/003_ca-certificates/test-ca-certificates.yml
@@ -1,11 +1,11 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
 onboot:
   - name: test
     image: "alpine:3.6"
diff --git a/test/cases/040_packages/003_containerd/test-containerd.yml b/test/cases/040_packages/003_containerd/test-containerd.yml
index 9bb0597c9..eb530f0e7 100644
--- a/test/cases/040_packages/003_containerd/test-containerd.yml
+++ b/test/cases/040_packages/003_containerd/test-containerd.yml
@@ -1,11 +1,11 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
diff --git a/test/cases/040_packages/004_dhcpcd/test-dhcpcd.yml b/test/cases/040_packages/004_dhcpcd/test-dhcpcd.yml
index 96a433eab..32fdfb1d7 100644
--- a/test/cases/040_packages/004_dhcpcd/test-dhcpcd.yml
+++ b/test/cases/040_packages/004_dhcpcd/test-dhcpcd.yml
@@ -1,13 +1,13 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: test
     image: "alpine:3.6"
diff --git a/test/cases/040_packages/007_getty-containerd/test-ctr.yml b/test/cases/040_packages/007_getty-containerd/test-ctr.yml
index 7ea29cdad..cbbf5fb3a 100644
--- a/test/cases/040_packages/007_getty-containerd/test-ctr.yml
+++ b/test/cases/040_packages/007_getty-containerd/test-ctr.yml
@@ -2,17 +2,17 @@ kernel:
   image: "linuxkit/kernel:4.9.x"
   cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
-  - linuxkit/ca-certificates:75cf419fb58770884c3464eb687ec8dfc704169d
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
+  - linuxkit/ca-certificates:46b59484919bfa9af700e54e042048cb06261de4
 onboot:
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
   - name: getty
-    image: "linuxkit/getty:9f27c1272b6d128c9a09745e916f151d09cb0d27"
+    image: "linuxkit/getty:6cbeee0392b0670053ce2bf05a5a0d67ec2bce05"
 files:
   - path: etc/getty.shadow
     # sample sets password for root to "abcdefgh" (without quotes)
diff --git a/test/cases/040_packages/013_mkimage/mkimage.yml b/test/cases/040_packages/013_mkimage/mkimage.yml
index 8db4b063d..89e21059e 100644
--- a/test/cases/040_packages/013_mkimage/mkimage.yml
+++ b/test/cases/040_packages/013_mkimage/mkimage.yml
@@ -1,13 +1,13 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: mkimage
-    image: "linuxkit/mkimage:f4bf0c24261f7d120c8674892805ab3054eb8ac3"
+    image: "linuxkit/mkimage:3c01548c7166e710f8332e18773a28284bc13179"
   - name: poweroff
     image: "linuxkit/poweroff:7404cf2295df89ccfa2dda41997a28307a90cf28"
 trust:
diff --git a/test/cases/040_packages/013_mkimage/run.yml b/test/cases/040_packages/013_mkimage/run.yml
index 541940396..001541971 100644
--- a/test/cases/040_packages/013_mkimage/run.yml
+++ b/test/cases/040_packages/013_mkimage/run.yml
@@ -1,10 +1,10 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: poweroff
     image: "linuxkit/poweroff:7404cf2295df89ccfa2dda41997a28307a90cf28"
diff --git a/test/cases/040_packages/019_sysctl/test-sysctl.yml b/test/cases/040_packages/019_sysctl/test-sysctl.yml
index 44e888253..d0a700b27 100644
--- a/test/cases/040_packages/019_sysctl/test-sysctl.yml
+++ b/test/cases/040_packages/019_sysctl/test-sysctl.yml
@@ -1,10 +1,10 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: sysctl
     image: "linuxkit/sysctl:3aa6bc663c2849ef239be7d941d3eaf3e6fcc018"
diff --git a/test/hack/test-ltp.yml b/test/hack/test-ltp.yml
index 67a9db499..dd4459b61 100644
--- a/test/hack/test-ltp.yml
+++ b/test/hack/test-ltp.yml
@@ -1,10 +1,10 @@
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
-  - linuxkit/runc:3a4e6cbf15470f62501b019b55e1caac5ee7689f
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
+  - linuxkit/runc:291131ec026430371e7c36165c3f43734fbc2541
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: ltp
     image: "linuxkit/test-ltp:6df23ac196332cafb9c0f8e32f328e22d612267d"
diff --git a/test/hack/test.yml b/test/hack/test.yml
index eac2b19fc..8b1b6fe76 100644
--- a/test/hack/test.yml
+++ b/test/hack/test.yml
@@ -1,15 +1,15 @@
 # FIXME: This should use the minimal example
 # We continue to use the kernel-config-test as CI is currently expecting to see a success message
 kernel:
-  image: "linuxkit/kernel:4.9.x"
+  image: "linuxkit/kernel:4.9.34"
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:17693d233dd009b2a3a8d23673cb85969e1dce80
+  - linuxkit/init:36c56f0664d49c5a6adc1120d1bf5ba6ac30b389
   - linuxkit/runc:2649198589ef0020d99f613adaeda45ce0093a38
-  - linuxkit/containerd:a33cdcf50b8107ffe14c92802c460fe7ada39acd
+  - linuxkit/containerd:1e3e8f207421de8deac8cedc26a138d6b1661a0d
 onboot:
   - name: dhcpcd
-    image: "linuxkit/dhcpcd:7d2b8aaaf20c24ad7d11a5ea2ea5b4a80dc966f1"
+    image: "linuxkit/dhcpcd:6c1ca76dbf808d5c27d10cbf22a8d4399be5c8ae"
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: check-kernel-config
     image: "linuxkit/test-kernel-config:9f08e3b99f8ac2f422251b3e8c94ce874ee34119"
diff --git a/tools/alpine/versions b/tools/alpine/versions
index 1b241bbc6..27d49f072 100644
--- a/tools/alpine/versions
+++ b/tools/alpine/versions
@@ -74,12 +74,12 @@ libattr-2.4.47-r6
 libblkid-2.28.2-r2
 libburn-1.4.6-r0
 libbz2-1.0.6-r5
+libc-dev-0.7.1-r0
+libc-utils-0.7.1-r0
 libcap-2.25-r1
 libcap-ng-0.7.8-r0
-libc-dev-0.7.1-r0
 libcom_err-1.43.4-r0
 libcurl-7.54.0-r0
-libc-utils-0.7.1-r0
 libdrm-2.4.80-r0
 libedit-20170329.3.1-r2
 libelf-0.8.13-r2
@@ -110,10 +110,10 @@ libogg-1.3.2-r1
 libpciaccess-0.13.4-r1
 libpng-1.6.29-r1
 libressl-2.5.4-r0
+libressl-dev-2.5.4-r0
 libressl2.5-libcrypto-2.5.4-r0
 libressl2.5-libssl-2.5.4-r0
 libressl2.5-libtls-2.5.4-r0
-libressl-dev-2.5.4-r0
 libsasl-2.1.26-r10
 libseccomp-2.3.2-r0
 libseccomp-dev-2.3.2-r0
@@ -150,11 +150,11 @@ ncurses-terminfo-base-6.0-r7
 nettle-3.3-r0
 npth-1.2-r0
 oniguruma-6.2.0-r0
+open-vm-tools-10.1.0-r7
 openntpd-6.0_p1-r3
 openrc-0.24.1-r2
 openssh-keygen-7.5_p1-r1
 openssh-server-7.5_p1-r1
-open-vm-tools-10.1.0-r7
 opus-1.1.4-r0
 p11-kit-0.23.2-r1
 patch-2.7.5-r1