diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask
index 097022d351..5e88db4a1f 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask
@@ -5,3 +5,6 @@
 # remove this when upstream portage-stable package.mask is sync'd.
 =sys-block/open-iscsi-2.0.873
 
+# masked upstream due to testing
+# we've disabled most of the functionality
+=net-fs/samba-4.5.1