diff --git a/cmd/network/network.go b/cmd/network/network.go
index 8acef78e..e47be68c 100644
--- a/cmd/network/network.go
+++ b/cmd/network/network.go
@@ -2,7 +2,7 @@ package network
 
 import (
 	"bufio"
-	"fmt"
+	"flag"
 	"io/ioutil"
 	"os"
 	"os/exec"
@@ -21,6 +21,16 @@ const (
 	WAIT_FOR_NETWORK = "wait-for-network"
 )
 
+var (
+	daemon bool
+	flags  *flag.FlagSet
+)
+
+func init() {
+	flags = flag.NewFlagSet(os.Args[0], flag.ContinueOnError)
+	flags.BoolVar(&daemon, "daemon", false, "run dhcpd as daemon")
+}
+
 func sendTerm(proc string) {
 	cmd := exec.Command("killall", "-TERM", proc)
 	cmd.Stderr = os.Stderr
@@ -29,11 +39,10 @@ func sendTerm(proc string) {
 }
 
 func Main() {
-	args := os.Args
-	if len(args) > 1 {
-		fmt.Println("call " + args[0] + " to load network config from cloud-config.yml")
-		return
-	}
+	flags.Parse(os.Args[1:])
+
+	log.Infof("Running network: daemon=%v", daemon)
+
 	os.Remove(NETWORK_DONE) // ignore error
 	cfg, err := config.LoadConfig()
 	if err != nil {
@@ -79,5 +88,8 @@ func Main() {
 		f.Close()
 	}
 	sendTerm(WAIT_FOR_NETWORK)
-	select {}
+
+	if daemon {
+		select {}
+	}
 }
diff --git a/os-config.tpl.yml b/os-config.tpl.yml
index 41e5d1a5..f0a0e817 100644
--- a/os-config.tpl.yml
+++ b/os-config.tpl.yml
@@ -105,7 +105,7 @@ rancher:
         io.rancher.os.detach: "false"
         io.rancher.os.reloadconfig: "true"
         io.rancher.os.scope: system
-        io.rancher.os.after: cloud-init-pre, wait-for-network, ntp
+        io.rancher.os.after: ntp
       net: host
       uts: host
       privileged: true
@@ -180,7 +180,7 @@ rancher:
       - /var/lib/docker:/var/lib/docker
       - /var/lib/system-docker:/var/lib/system-docker
       - /var/lib/rkt:/var/lib/rkt
-    network:
+    network-pre:
       image: {{.OS_IMAGES_ROOT}}/os-network:{{.VERSION}}{{.SUFFIX}}
       labels:
         io.rancher.os.scope: system
@@ -192,6 +192,32 @@ rancher:
       volumes_from:
       - command-volumes
       - system-volumes
+    network:
+      image: {{.OS_IMAGES_ROOT}}/os-network:{{.VERSION}}{{.SUFFIX}}
+      labels:
+        io.rancher.os.scope: system
+        io.rancher.os.after: cloud-init
+      environment:
+      - DAEMON=true
+      net: host
+      uts: host
+      pid: host
+      privileged: true
+      volumes_from:
+      - command-volumes
+      - system-volumes
+    wait-for-network-pre:
+      image: {{.OS_IMAGES_ROOT}}/os-network:{{.VERSION}}{{.SUFFIX}}
+      command: wait-for-network
+      labels:
+        io.rancher.os.detach: "false"
+        io.rancher.os.scope: system
+        io.rancher.os.after: network-pre
+      pid: host
+      privileged: true
+      volumes_from:
+      - command-volumes
+      - system-volumes
     wait-for-network:
       image: {{.OS_IMAGES_ROOT}}/os-network:{{.VERSION}}{{.SUFFIX}}
       command: wait-for-network
@@ -208,7 +234,7 @@ rancher:
       image: {{.OS_IMAGES_ROOT}}/os-ntp:{{.VERSION}}{{.SUFFIX}}
       labels:
         io.rancher.os.scope: system
-        io.rancher.os.after: wait-for-network
+        io.rancher.os.after: wait-for-network-pre
       net: host
       uts: host
       privileged: true
diff --git a/tests/integration/assets/test_10/cloud-config.yml b/tests/integration/assets/test_10/cloud-config.yml
new file mode 100644
index 00000000..a42d3e9d
--- /dev/null
+++ b/tests/integration/assets/test_10/cloud-config.yml
@@ -0,0 +1,5 @@
+#cloud-config
+rancher:
+  cloud_init:
+    datasources:
+    - url:https://s3-us-west-2.amazonaws.com/rancher-os-test/cloud-config.yml
diff --git a/tests/integration/rostest/test_10_network_from_url.py b/tests/integration/rostest/test_10_network_from_url.py
new file mode 100644
index 00000000..d5223242
--- /dev/null
+++ b/tests/integration/rostest/test_10_network_from_url.py
@@ -0,0 +1,52 @@
+import pytest
+import rostest.util as u
+from rostest.util import SSH
+
+pytestmark = pytest.mark.skipif(u.arch != 'amd64', reason='amd64 network setup impossible to replicate for arm64')
+
+cloud_config_path = './tests/integration/assets/test_10/cloud-config.yml'
+
+net_args_arch = {'amd64': ['-net', 'nic,vlan=0,model=virtio'],
+                 'arm64': ['-device', 'virtio-net-device']}
+net_args_arch['arm'] = net_args_arch['arm64']
+net_args = net_args_arch[u.arch]
+
+
+@pytest.fixture(scope="module")
+def qemu(request):
+    q = u.run_qemu(request,
+                   run_args=['--cloud-config', cloud_config_path] +
+                   net_args + net_args + net_args + net_args + net_args + net_args + net_args)
+    u.flush_out(q.stdout)
+    return q
+
+
+def test_network_conf(qemu):
+    SSH(qemu).check_call('''cat > test-merge << "SCRIPT"
+set -x -e
+
+ip link show dev br0
+ip link show dev br0.100 | grep br0.100@br0
+ip link show dev eth1.100 | grep 'master br0'
+ip link show dev eth6 | grep 'master bond0'
+ip link show dev eth7 | grep 'master bond0'
+[ "$(</sys/class/net/bond0/bonding/mode)" = "active-backup 1" ]
+
+SCRIPT
+sudo bash test-merge
+    '''.strip())
+
+
+def test_network_dns_ros_set(qemu):
+    SSH(qemu).check_call('''
+set -x -e
+
+sudo ros config set rancher.network.dns.search '[a,b]'
+if [ "$(sudo ros config get rancher.network.dns.search)" == "- a
+ - b
+
+ " ]; then
+    sudo ros config get rancher.network.dns.search
+    exit 1
+ fi
+    '''.strip())
diff --git a/trash.yml b/trash.yml
index e5a38349..c6a08a61 100644
--- a/trash.yml
+++ b/trash.yml
@@ -70,7 +70,7 @@ import:
   version: v1.10.3
 
 - package: github.com/rancher/netconf
-  version: d7d620ef4ea62a9d04b51c7b3d9dc83fe7ffaa1b
+  version: f953ace624d8bade198682d343eb7e25d9c8899c
 
 - package: github.com/ryanuber/go-glob
   version: 0067a9abd927e50aed5190662702f81231413ae0
diff --git a/vendor/github.com/rancher/netconf/netconf_linux.go b/vendor/github.com/rancher/netconf/netconf_linux.go
index d580a727..74c66f37 100644
--- a/vendor/github.com/rancher/netconf/netconf_linux.go
+++ b/vendor/github.com/rancher/netconf/netconf_linux.go
@@ -273,6 +273,10 @@ func setGateway(gateway string) error {
 
 func applyInterfaceConfig(link netlink.Link, netConf InterfaceConfig) error {
 	if netConf.Bond != "" {
+		if err := netlink.LinkSetDown(link); err != nil {
+			return err
+		}
+
 		b, err := Bond(netConf.Bond)
 		if err != nil {
 			return err