diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md
new file mode 100644
index 0000000000..b8b8890aef
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md
@@ -0,0 +1,65 @@
+Modifications made:
+
+- Drop python updater and eselect python stuff (so the pkg_ functions).
+
+- Drop src_test and the test use flag.
+
+- Rename one patch in PATCHES variable, so I don't need to rename the
+  file (the name in ebuild was using `${PN}`, which in
+  `dev-lang/python` expands to `python`, whereas in
+  `dev-lang/python-oem` it would expand to `python-oem`).
+
+- Drop the following use flags and simplify the ebuild assuming that
+  they were disabled: examples, gdbm, libressl, ncurses, sqlite, ssl,
+  tk, wininst.
+
+- Drop the following use flags and simplify the ebuild assuming that
+  they were enabled: build, ipv6, threads.
+
+- Drop xml use flag, but keep the internal copies of expat, do not
+  disable _elementtree and pyexpat modules and tell the configure
+  script to use the internal stuff.
+
+- Keep using internal libffi, instead of depending on system-provided
+  libffi.
+
+- Move RDEPEND to DEPEND, so RDEPEND remains empty. OEM packages are
+  installed after prod images are pruned of the previously installed
+  package database.
+
+- Make the following changes in configure flags:
+
+  - Add --prefix=/usr/share/oem/python to the myeconfargs variable.
+
+  - Change --enable-shared to --disable-shared.
+
+  - Set --mandir, --infodir and --includedir to some subdirectory of
+    /discard, so during installation this could be easily removed.
+
+- Export some configure variables for the cross-compilation:
+  ac_cv_file__dev_ptc and ac_cv_file__dev_ptmx. If not done, build
+  will fail with a message saying that these should be set to either
+  yes or no.
+
+- Simplify src_install:
+
+  - Replace the hardcoded ${ED}/usr/bin with bindir variable set to
+    ${ED}/usr/share/oem/python/bin.
+
+  - Create versionless links (python and python3) to python executable.
+
+  - Drop sed stuff mucking with LDFLAGS.
+
+  - Drop collision fixes.
+
+  - Drop ABIFLAGS hack.
+
+  - Do not install ACKS, HISTORY and NEWS files.
+
+  - Drop gdb autoload stuff.
+
+  - Drop pydoc.{conf,init} stuff.
+
+  - Drop python-exec stuff.
+
+  - Remove installed stuff in /discard.
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.6.5.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.6.5.ebuild
index 07d92a8c3a..cfeef9768e 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.6.5.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.6.5.ebuild
@@ -17,54 +17,32 @@ SRC_URI="https://www.python.org/ftp/python/${PV}/${MY_P}.tar.xz
 LICENSE="PSF-2"
 SLOT="3.6/3.6m"
 KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~amd64-fbsd ~x86-fbsd"
-IUSE="build examples gdbm hardened ipv6 libressl +ncurses +readline sqlite +ssl test +threads tk wininst +xml"
-RESTRICT="!test? ( test )"
+IUSE="hardened"
 
 # Do not add a dependency on dev-lang/python to this ebuild.
 # If you need to apply a patch which requires python for bootstrapping, please
 # run the bootstrap code on your dev box and include the results in the
 # patchset. See bug 447752.
 
-RDEPEND="app-arch/bzip2:0=
+RDEPEND=""
+DEPEND="app-arch/bzip2:0=
 	app-arch/xz-utils:0=
 	>=sys-libs/zlib-1.1.3:0=
-	virtual/libffi:=
 	virtual/libintl
-	gdbm? ( sys-libs/gdbm:0=[berkdb] )
-	ncurses? ( >=sys-libs/ncurses-5.2:0= )
-	readline? ( >=sys-libs/readline-4.1:0= )
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? (
-		!libressl? ( dev-libs/openssl:0= )
-		libressl? ( dev-libs/libressl:0= )
-	)
-	tk? (
-		>=dev-lang/tcl-8.0:0=
-		>=dev-lang/tk-8.0:0=
-		dev-tcltk/blt:0=
-		dev-tcltk/tix
-	)
-	xml? ( >=dev-libs/expat-2.1:0= )
-	!!<sys-apps/sandbox-2.6-r1"
-DEPEND="${RDEPEND}
-	test? ( app-arch/xz-utils[extra-filters(+)] )
+	!!<sys-apps/sandbox-2.6-r1
 	virtual/pkgconfig
 	!sys-devel/gcc[libffi(-)]"
-RDEPEND+=" !build? ( app-misc/mime-types )"
-PDEPEND=">=app-eselect/eselect-python-20140125-r1"
 
 S="${WORKDIR}/${MY_P}"
 PYVER=${SLOT%/*}
 
 src_prepare() {
-	# Ensure that internal copies of expat, libffi and zlib are not used.
-	rm -fr Modules/expat
-	rm -fr Modules/_ctypes/libffi*
+	# Ensure that internal copies of zlib are not used.
 	rm -fr Modules/zlib
 
 	local PATCHES=(
 		"${WORKDIR}/patches"
-		"${FILESDIR}/${PN}-3.5-distutils-OO-build.patch"
+		"${FILESDIR}/python-3.5-distutils-OO-build.patch"
 		"${FILESDIR}/3.6.5-disable-nis.patch"
 		"${FILESDIR}/python-3.6.5-libressl-compatibility.patch"
 		"${FILESDIR}/python-3.6.5-hash-unaligned.patch"
@@ -89,21 +67,14 @@ src_prepare() {
 
 src_configure() {
 	local disable
-	use gdbm     || disable+=" gdbm"
-	use ncurses  || disable+=" _curses _curses_panel"
-	use readline || disable+=" readline"
-	use sqlite   || disable+=" _sqlite3"
-	use ssl      || export PYTHON_DISABLE_SSL="1"
-	use tk       || disable+=" _tkinter"
-	use xml      || disable+=" _elementtree pyexpat" # _elementtree uses pyexpat.
+	disable+=" gdbm"
+	disable+=" _curses _curses_panel"
+	disable+=" readline"
+	disable+=" _sqlite3"
+	export PYTHON_DISABLE_SSL="1"
+	disable+=" _tkinter"
 	export PYTHON_DISABLE_MODULES="${disable}"
 
-	if ! use xml; then
-		ewarn "You have configured Python without XML support."
-		ewarn "This is NOT a recommended configuration as you"
-		ewarn "may face problems parsing any XML documents."
-	fi
-
 	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
 		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
 	fi
@@ -120,6 +91,12 @@ src_configure() {
 		use hardened && replace-flags -O3 -O2
 	fi
 
+	if tc-is-cross-compiler; then
+		# Force some tests that try to poke fs paths.
+		export ac_cv_file__dev_ptc=no
+		export ac_cv_file__dev_ptmx=yes
+	fi
+
 	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
 	tc-export CXX
 
@@ -129,29 +106,27 @@ src_configure() {
 	append-ldflags "-L."
 
 	local dbmliborder
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
 
 	local myeconfargs=(
+		--prefix=/usr/share/oem/python
 		--with-fpectl
-		--enable-shared
-		$(use_enable ipv6)
-		$(use_with threads)
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
+		--disable-shared
+		--enable-ipv6
+		--with-threads
+		--includedir='/discard/include'
+		--infodir='/discard/info'
+		--mandir='/discard/man'
 		--with-computed-gotos
 		--with-dbmliborder="${dbmliborder}"
 		--with-libc=
-		--enable-loadable-sqlite-extensions
 		--without-ensurepip
-		--with-system-expat
-		--with-system-ffi
+		--without-system-expat
+		--without-system-ffi
 	)
 
 	OPT="" econf "${myeconfargs[@]}"
 
-	if use threads && grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
 		eerror "configure has detected that the sem_open function is broken."
 		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
 		die "Broken sem_open function (bug 496328)"
@@ -164,183 +139,23 @@ src_compile() {
 	local -x LC_ALL=C
 
 	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax_kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# Skip failing tests.
-	local skipped_tests="gdb"
-
-	for test in ${skipped_tests}; do
-		mv "${S}"/Lib/test/test_${test}.py "${T}"
-	done
-
-	local -x PYTHONDONTWRITEBYTECODE=
-
-	emake test EXTRATESTOPTS="-u-network" CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local result=$?
-
-	for test in ${skipped_tests}; do
-		mv "${T}/test_${test}.py" "${S}"/Lib/test
-	done
-
-	elog "The following tests have been skipped:"
-	for test in ${skipped_tests}; do
-		elog "test_${test}.py"
-	done
-
-	elog "If you would like to run them, you may:"
-	elog "cd '${EPREFIX}/usr/$(get_libdir)/python${PYVER}/test'"
-	elog "and run the tests separately."
-
-	if [[ ${result} -ne 0 ]]; then
-		die "emake test failed"
-	fi
 }
 
 src_install() {
-	local libdir=${ED}/usr/$(get_libdir)/python${PYVER}
+	local rawbindir=/usr/share/oem/python/bin
+	local bindir=${ED}${rawbindir}
+	local libdir=${ED}/usr/share/oem/python/$(get_libdir)/python${PYVER}
 
 	emake DESTDIR="${D}" altinstall
 
-	sed \
-		-e "s/\(CONFIGURE_LDFLAGS=\).*/\1/" \
-		-e "s/\(PY_LDFLAGS=\).*/\1/" \
-		-i "${libdir}/config-${PYVER}"*/Makefile || die "sed failed"
+	# create a simple versionless 'python' symlink
+	dosym "python${PYVER}" "${rawbindir}/python"
+	dosym "python${PYVER}" "${rawbindir}/python3"
 
-	# Fix collisions between different slots of Python.
-	rm -f "${ED}usr/$(get_libdir)/libpython3.so"
+	rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
+	rm -r "${bindir}/idle${PYVER}" "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
 
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
+	rm "${libdir}/distutils/command/"wininst-*.exe || die
 
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax_kernel]; then
-		pax-mark E "${ED}usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}usr/bin/${abiver}"
-	fi
-
-	use sqlite || rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
-	use tk || rm -r "${ED}usr/bin/idle${PYVER}" "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-
-	use threads || rm -r "${libdir}/multiprocessing" || die
-	use wininst || rm "${libdir}/distutils/command/"wininst-*.exe || die
-
-	dodoc "${S}"/Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		insinto /usr/share/doc/${PF}/examples
-		find "${S}"/Tools -name __pycache__ -print0 | xargs -0 rm -fr
-		doins -r "${S}"/Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' | \
-		emake --no-print-directory -s -f - 2>/dev/null)
-	newins "${S}"/Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}etc/conf.d/pydoc-${PYVER}" "${ED}etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# for python-exec
-	local vars=( EPYTHON PYTHON_SITEDIR PYTHON_SCRIPTDIR )
-
-	# if not using a cross-compiler, use the fresh binary
-	if ! tc-is-cross-compiler; then
-		local -x PYTHON=./python
-		local -x LD_LIBRARY_PATH=${LD_LIBRARY_PATH+${LD_LIBRARY_PATH}:}${PWD}
-	else
-		vars=( PYTHON "${vars[@]}" )
-	fi
-
-	python_export "python${PYVER}" "${vars[@]}"
-	echo "EPYTHON='${EPYTHON}'" > epython.py || die
-	python_domodule epython.py
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	mkdir -p "${D}${PYTHON_SCRIPTDIR}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" \
-		"${D}${PYTHON_SCRIPTDIR}/python${pymajor}" || die
-	ln -s "python${pymajor}" \
-		"${D}${PYTHON_SCRIPTDIR}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${D}${PYTHON_SCRIPTDIR}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${D}${PYTHON_SCRIPTDIR}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" \
-		"${D}${PYTHON_SCRIPTDIR}/python-config" || die
-	# 2to3, pydoc, pyvenv
-	ln -s "../../../bin/2to3-${PYVER}" \
-		"${D}${PYTHON_SCRIPTDIR}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" \
-		"${D}${PYTHON_SCRIPTDIR}/pydoc" || die
-	ln -s "../../../bin/pyvenv-${PYVER}" \
-		"${D}${PYTHON_SCRIPTDIR}/pyvenv" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" \
-			"${D}${PYTHON_SCRIPTDIR}/idle" || die
-	fi
-}
-
-pkg_preinst() {
-	if has_version "<${CATEGORY}/${PN}-${PYVER}" && ! has_version ">=${CATEGORY}/${PN}-${PYVER}_alpha"; then
-		python_updater_warning="1"
-	fi
-}
-
-eselect_python_update() {
-	if [[ -z "$(eselect python show)" || ! -f "${EROOT}usr/bin/$(eselect python show)" ]]; then
-		eselect python update
-	fi
-
-	if [[ -z "$(eselect python show --python${PV%%.*})" || ! -f "${EROOT}usr/bin/$(eselect python show --python${PV%%.*})" ]]; then
-		eselect python update --python${PV%%.*}
-	fi
-}
-
-pkg_postinst() {
-	eselect_python_update
-
-	if [[ "${python_updater_warning}" == "1" ]]; then
-		ewarn "You have just upgraded from an older version of Python."
-		ewarn
-		ewarn "Please adjust PYTHON_TARGETS (if so desired), and run emerge with the --newuse or --changed-use option to rebuild packages installing python modules."
-	fi
-}
-
-pkg_postrm() {
-	eselect_python_update
+	rm -r "${ED}/discard" || die
 }