diff --git a/vendor/k8s.io/kubernetes/pkg/kubelet/dockertools/docker.go b/vendor/k8s.io/kubernetes/pkg/kubelet/dockertools/docker.go
index bf95954b8697..2c0d9fe4a6c8 100644
--- a/vendor/k8s.io/kubernetes/pkg/kubelet/dockertools/docker.go
+++ b/vendor/k8s.io/kubernetes/pkg/kubelet/dockertools/docker.go
@@ -45,6 +45,7 @@ import (
 const (
 	PodInfraContainerName = leaky.PodInfraContainerName
 	DockerPrefix          = "docker://"
+	DockerPullablePrefix  = "docker-pullable://"
 	LogSuffix             = "log"
 	ext4MaxFileNameLen    = 255
 )
diff --git a/vendor/k8s.io/kubernetes/pkg/kubelet/dockertools/docker_manager.go b/vendor/k8s.io/kubernetes/pkg/kubelet/dockertools/docker_manager.go
index 053249ee7178..fe0f5a4c91dc 100644
--- a/vendor/k8s.io/kubernetes/pkg/kubelet/dockertools/docker_manager.go
+++ b/vendor/k8s.io/kubernetes/pkg/kubelet/dockertools/docker_manager.go
@@ -397,11 +397,26 @@ func (dm *DockerManager) inspectContainer(id string, podName, podNamespace strin
 		parseTimestampError("FinishedAt", iResult.State.FinishedAt)
 	}
 
+	// default to the image ID, but try and inspect for the RepoDigests
+	imageID := DockerPrefix + iResult.Image
+	imgInspectResult, err := dm.client.InspectImage(iResult.Image)
+	if err != nil {
+		utilruntime.HandleError(fmt.Errorf("unable to inspect docker image %q while inspecting docker container %q: %v", containerName, iResult.Image, err))
+	} else {
+		if len(imgInspectResult.RepoDigests) > 1 {
+			glog.V(4).Infof("Container %q had more than one associated RepoDigest (%v), only using the first", containerName, imgInspectResult.RepoDigests)
+		}
+
+		if len(imgInspectResult.RepoDigests) > 0 {
+			imageID = DockerPullablePrefix + imgInspectResult.RepoDigests[0]
+		}
+	}
+
 	status := kubecontainer.ContainerStatus{
 		Name:         containerName,
 		RestartCount: containerInfo.RestartCount,
 		Image:        iResult.Config.Image,
-		ImageID:      DockerPrefix + iResult.Image,
+		ImageID:      imageID,
 		ID:           kubecontainer.DockerID(id).ContainerID(),
 		ExitCode:     iResult.State.ExitCode,
 		CreatedAt:    createdAt,
diff --git a/vendor/k8s.io/kubernetes/pkg/kubelet/dockertools/docker_manager_test.go b/vendor/k8s.io/kubernetes/pkg/kubelet/dockertools/docker_manager_test.go
index 51ebc4b03b46..e9d530e8df1f 100644
--- a/vendor/k8s.io/kubernetes/pkg/kubelet/dockertools/docker_manager_test.go
+++ b/vendor/k8s.io/kubernetes/pkg/kubelet/dockertools/docker_manager_test.go
@@ -141,6 +141,9 @@ func createTestDockerManager(fakeHTTPClient *fakeHTTP, fakeDocker *FakeDockerCli
 		fakeHTTPClient,
 		flowcontrol.NewBackOff(time.Second, 300*time.Second))
 
+	// default this to an empty result, so that we never have a nil non-error response from InspectImage
+	fakeDocker.Image = &dockertypes.ImageInspect{}
+
 	return dockerManager, fakeDocker
 }