diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/rkt/metadata.xml b/sdk_container/src/third_party/coreos-overlay/app-emulation/rkt/metadata.xml
index 015faef012..919084c4bb 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-emulation/rkt/metadata.xml
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/rkt/metadata.xml
@@ -10,6 +10,7 @@
 	<use>
 		<flag name="actool">Install the actool for ACI manipulation</flag>
 		<flag name="rkt_stage1_coreos">Download and use a prebuilt stage1.aci from CoreOS</flag>
+		<flag name="rkt_stage1_fly">Build the experimental fly stage1 for chroot-only isolation</flag>
 		<flag name="rkt_stage1_src">Build the stage1.aci from source</flag>
 		<flag name="rkt_stage1_host">Assemble stage1.aci from host binaries</flag>
 	</use>
diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/rkt/rkt-13.0.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/rkt/rkt-0.15.0.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/app-emulation/rkt/rkt-13.0.ebuild
rename to sdk_container/src/third_party/coreos-overlay/app-emulation/rkt/rkt-0.15.0.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/rkt/rkt-9999.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/rkt/rkt-9999.ebuild
index e892c88985..89990e3ccd 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-emulation/rkt/rkt-9999.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/rkt/rkt-9999.ebuild
@@ -14,12 +14,11 @@ CROS_WORKON_PROJECT="coreos/rkt"
 CROS_WORKON_LOCALNAME="rkt"
 CROS_WORKON_REPO="git://github.com"
 
-
 if [[ "${PV}" == "9999" ]]; then
 	KEYWORDS="~amd64"
 else
 	KEYWORDS="amd64"
-	CROS_WORKON_COMMIT="830d80ce39f3b68ca39dd5ec88920f7d7431d436" # v0.13.0
+	CROS_WORKON_COMMIT="36079186a84b27b3ac632c3732c7620f7ecb737c" # v0.15.0
 fi
 
 PXE_VERSION="794.1.0"
@@ -35,8 +34,8 @@ HOMEPAGE="https://github.com/coreos/rkt"
 
 LICENSE="Apache-2.0"
 SLOT="0"
-IUSE="doc examples +rkt_stage1_coreos rkt_stage1_host rkt_stage1_src +actool"
-REQUIRED_USE="^^ ( rkt_stage1_coreos rkt_stage1_host rkt_stage1_src )"
+IUSE="doc examples +rkt_stage1_coreos +rkt_stage1_fly rkt_stage1_host rkt_stage1_src +actool"
+REQUIRED_USE="|| ( rkt_stage1_coreos rkt_stage1_fly rkt_stage1_host rkt_stage1_src )"
 
 DEPEND=">=dev-lang/go-1.4.1
 	app-arch/cpio
@@ -55,20 +54,39 @@ RDEPEND="!app-emulation/rocket
 
 BUILDDIR="build-${P}"
 
+STAGE1INSTALLDIR="/usr/share/rkt/"
+STAGE1FIRST=""
+STAGE1FLAVORS=""
+
+function add_stage1() {
+	if [[ ${STAGE1FIRST} == "" ]]; then
+		STAGE1FIRST=$1
+		STAGE1FLAVORS=$1
+	else
+		STAGE1FLAVORS="${STAGE1FLAVORS},$1"
+	fi
+}
+
 src_configure() {
 	local myeconfargs=()
 
-	if use rkt_stage1_host; then
-		STAGE1FLAVOR="host"
-	elif use rkt_stage1_src; then
-		STAGE1FLAVOR="src"
-	elif use rkt_stage1_coreos; then
-		STAGE1FLAVOR="coreos"
+	if use rkt_stage1_coreos; then
+		add_stage1 "coreos"
 		myeconfargs+=( --with-coreos-local-pxe-image-path="${DISTDIR}/${PXE_FILE}" )
 		myeconfargs+=( --with-coreos-local-pxe-image-systemd-version=v"${PXE_SYSTEMD_VERSION}" )
 	fi
-	myeconfargs+=( --with-stage1-flavors="${STAGE1FLAVOR}" )
-	myeconfargs+=( --with-stage1-default-location="/usr/share/rkt/stage1-${STAGE1FLAVOR}.aci" )
+	if use rkt_stage1_fly; then
+		add_stage1 "fly"
+	fi
+	if use rkt_stage1_host; then
+		add_stage1 "host"
+	fi
+	if use rkt_stage1_src; then
+		add_stage1 "src"
+	fi
+
+	myeconfargs+=( --with-stage1-flavors="${STAGE1FLAVORS}" )
+	myeconfargs+=( --with-stage1-default-location="/usr/share/rkt/stage1-${STAGE1FIRST}.aci" )
 
 	# Go's 6l linker does not support PIE, disable so cgo binaries
 	# which use 6l+gcc for linking can be built correctly.
@@ -95,8 +113,12 @@ src_install() {
 
 	dobin "${S}/${BUILDDIR}/bin/rkt"
 
-	insinto /usr/share/rkt/
-	doins "${S}/${BUILDDIR}/bin/stage1-${STAGE1FLAVOR}.aci"
+	einfo The following stage1 ACIs have been installed to ${STAGE1INSTALLDIR}:
+	insinto ${STAGE1INSTALLDIR}
+	for stage1aci in "${S}/${BUILDDIR}"/bin/stage1-*.aci; do
+		doins "${stage1aci}"
+		einfo $(basename "${stage1aci}")
+	done
 
 	systemd_dounit "${S}"/dist/init/systemd/${PN}-gc.service
 	systemd_dounit "${S}"/dist/init/systemd/${PN}-gc.timer