diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/amd64/generic/oem-aci/parent b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/amd64/generic/oem-aci/parent
new file mode 100644
index 0000000000..cfacbaa8c8
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/amd64/generic/oem-aci/parent
@@ -0,0 +1,2 @@
+..
+:coreos/targets/generic/oem-aci
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/generic/oem-aci/parent b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/generic/oem-aci/parent
new file mode 100644
index 0000000000..cfacbaa8c8
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/generic/oem-aci/parent
@@ -0,0 +1,2 @@
+..
+:coreos/targets/generic/oem-aci
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/oem-aci/README b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/oem-aci/README
new file mode 100644
index 0000000000..74dbd3ea6a
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/oem-aci/README
@@ -0,0 +1,7 @@
+Profile settings specific to "oem-aci" images.
+
+Settings here must *ONLY* influence installing binary packages and never
+change build time settings like USE or CFLAGS because binary packages
+are shared between dev and prod, dev just includes more stuff.
+
+For example INSTALL_MASK, package.mask, and package.provided are ok.
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/oem-aci/make.defaults b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/oem-aci/make.defaults
new file mode 100644
index 0000000000..cc26153410
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/oem-aci/make.defaults
@@ -0,0 +1,54 @@
+# Copyright (c) 2016 The CoreOS Authors. All rights reserved.
+# Distributed under the terms of the GNU General Public License v2
+
+# Restrictive mask for OEM ACIs.
+INSTALL_MASK="${INSTALL_MASK}
+  *.a *.la *.hpp *.o
+  /etc/sandbox.d
+  /usr/include
+  /usr/lib*/*/include
+  /usr/lib/debug
+  /usr/lib*/pkgconfig
+  /usr/share/aclocal*
+  /usr/share/awk
+  /usr/share/gdb
+  /usr/share/gettext
+  /usr/share/gobject-introspection-1.0
+  /usr/share/pkgconfig
+  /usr/share/readline
+  /usr/src
+"
+
+# Exclude nmap from OEM ACI, we just want ncat/nping in there.
+# Also remove ncat's second ca-bundle.crt, just use the system's.
+INSTALL_MASK="${INSTALL_MASK}
+  /usr/bin/nmap
+  /usr/share/ncat
+  /usr/share/nmap
+"
+
+# Remove files which depend on interpreters not present in boards.
+INSTALL_MASK="${INSTALL_MASK}
+  /usr/share/git/contrib/*
+  /usr/bin/diff-highlight
+  /usr/bin/autoscan-2.13
+  /usr/bin/autoupdate-2.69
+  /usr/bin/autoreconf-2.69
+  /usr/bin/automake-1.14
+  /usr/bin/autom4te-2.69
+  /usr/bin/autoheader-2.69
+  /usr/bin/aclocal-1.14
+  /usr/bin/aclocal-1.15
+  /usr/bin/automake-1.15
+  /usr/bin/ifnames-2.69
+  /usr/bin/intltool-update
+  /usr/bin/intltool-merge
+  /usr/bin/intltool-prepare
+  /usr/bin/intltool-extract
+  /usr/bin/autoscan-2.69
+"
+
+# There is no need to have boot stuff in a container.
+INSTALL_MASK="${INSTALL_MASK}
+  /boot
+"
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/oem-aci/package.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/oem-aci/package.mask
new file mode 100644
index 0000000000..8e2929318b
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/oem-aci/package.mask
@@ -0,0 +1,6 @@
+# Packages that we do not want to ship in OEM ACI images. Masking these is
+# merely as a safe guard against pulling them in accidentally.
+
+# OEM ACIs have no reason to include boot-related packages.
+sys-boot/*
+sys-kernel/*