diff --git a/sdk_container/src/third_party/coreos-overlay/sys-firmware/intel-microcode/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-firmware/intel-microcode/Manifest
new file mode 100644
index 0000000000..e4bbfa3cd9
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/sys-firmware/intel-microcode/Manifest
@@ -0,0 +1 @@
+DIST microcode-20180312.tgz 3789662 BLAKE2B e948d74833fe75b9bbdff1e4676f5d49a13bdd06aa6525c39be3448b822203947a5f55515484401ee0c96e8ade19ea580718949bed65883d983509661a16e637 SHA512 cc2cabf6d12c83b65eeb30fca7eb0b503e037dbee3d7ce9cb307b02ed8ac9426b2bafc2c1f1281dddff0945f8308f0d3cd320edea4596551354188d64760b854
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-firmware/intel-microcode/intel-microcode-20180312-r1.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-firmware/intel-microcode/intel-microcode-20180312-r1.ebuild
new file mode 100644
index 0000000000..992dedccfa
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/sys-firmware/intel-microcode/intel-microcode-20180312-r1.ebuild
@@ -0,0 +1,95 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="6"
+
+inherit toolchain-funcs mount-boot
+
+# Find updates by searching and clicking the first link (hopefully it's the one):
+# http://www.intel.com/content/www/us/en/search.html?keyword=Processor+Microcode+Data+File
+
+NUM="27591"
+DESCRIPTION="Intel IA32/IA64 microcode update data"
+HOMEPAGE="http://inertiawar.com/microcode/ https://downloadcenter.intel.com/Detail_Desc.aspx?DwnldID=${NUM}"
+SRC_URI="https://downloadmirror.intel.com/${NUM}/eng/microcode-${PV}.tgz"
+
+LICENSE="intel-ucode"
+SLOT="0/${PVR}"
+KEYWORDS="-* amd64 x86"
+IUSE="initramfs +split-ucode"
+REQUIRED_USE="|| ( initramfs split-ucode )"
+
+DEPEND="sys-apps/iucode_tool"
+RDEPEND="!<sys-apps/microcode-ctl-1.17-r2" #268586
+
+S=${WORKDIR}
+
+# TODO: 
+# Blacklist bad microcode here.
+DEFAULT_MICROCODE_SIGNATURES=""
+
+# Advanced users only:
+# merge with:
+# only current CPU: MICROCODE_SIGNATURES="-S"
+# only specific CPU: MICROCODE_SIGNATURES="-s 0x00000f4a -s 0x00010676"
+# exclude specific CPU: MICROCODE_SIGNATURES="-s !0x00000686"
+MICROCODE_SIGNATURES="${MICROCODE_SIGNATURES:=${DEFAULT_MICROCODE_SIGNATURES}}"
+
+pkg_pretend() {
+	if [[ "${MICROCODE_SIGNATURES}" != "${DEFAULT_MICROCODE_SIGNATURES}" ]]; then
+		ewarn "MICROCODE_SIGNATURES is set!"
+		ewarn "The user has decided to install only a SUBSET of microcode."
+	fi
+	use initramfs && mount-boot_pkg_pretend
+}
+
+src_install() {
+	# This will take ALL of the upstream microcode sources:
+	# - microcode.dat
+	# - intel-ucode/
+	# In some cases, they have not contained the same content (eg the directory has newer stuff).
+	MICROCODE_SRC=(
+		"${S}"/microcode.dat
+		"${S}"/intel-ucode/
+	)
+	opts=(
+		${MICROCODE_SIGNATURES}
+		# be strict about what we are doing
+		--overwrite
+		--strict-checks
+		--no-ignore-broken
+		# show everything we find
+		--list-all
+		# show what we selected
+		--list
+	)
+
+	# The earlyfw cpio needs to be in /boot because it must be loaded before
+	# rootfs is mounted.
+	use initramfs && dodir /boot && opts+=( --write-earlyfw="${ED%/}"/boot/intel-uc.img )
+	# split location:
+	use split-ucode && dodir /lib/firmware/intel-ucode && opts+=( --write-firmware="${ED%/}"/lib/firmware/intel-ucode )
+
+	iucode_tool \
+		"${opts[@]}" \
+		"${MICROCODE_SRC[@]}" \
+		|| die "iucode_tool ${opts[@]} ${MICROCODE_SRC[@]}"
+
+	dodoc releasenote
+}
+
+pkg_preinst() {
+	use initramfs && mount-boot_pkg_preinst
+}
+
+pkg_prerm() {
+	use initramfs && mount-boot_pkg_prerm
+}
+
+pkg_postrm() {
+	use initramfs && mount-boot_pkg_postrm
+}
+
+pkg_postinst() {
+	use initramfs && mount-boot_pkg_postinst
+}
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-firmware/intel-microcode/metadata.xml b/sdk_container/src/third_party/coreos-overlay/sys-firmware/intel-microcode/metadata.xml
new file mode 100644
index 0000000000..f8bcf6658d
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/sys-firmware/intel-microcode/metadata.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<maintainer type="project">
+	<email>base-system@gentoo.org</email>
+	<name>Gentoo Base System</name>
+</maintainer>
+<use>
+	<flag name="initramfs">install a small initramfs for use with CONFIG_MICROCODE_EARLY</flag>
+	<flag name="monolithic">install the large text microcode.dat (used by older kernels via microcode_ctl)</flag>
+	<flag name="split-ucode">install the split binary ucode files (used by the kernel directly)</flag>
+</use>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.14.36.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.14.36-r1.ebuild
similarity index 98%
rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.14.36.ebuild
rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.14.36-r1.ebuild
index 8e6f61c1ee..77eaa0bc62 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.14.36.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.14.36-r1.ebuild
@@ -30,7 +30,7 @@ DEPEND="${RDEPEND}
 	>=sys-kernel/bootengine-0.0.4:=
 	sys-kernel/dracut
 	virtual/udev
-	amd64? ( sys-firmware/intel-microcode )"
+	amd64? ( sys-firmware/intel-microcode:= )"
 
 # We are bad, we want to get around the sandbox.  So do the creation of the
 # cpio image in pkg_setup() where we are free to mount filesystems, chroot,
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.16.4.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.16.4-r1.ebuild
similarity index 98%
rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.16.4.ebuild
rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.16.4-r1.ebuild
index 8e6f61c1ee..77eaa0bc62 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.16.4.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.16.4-r1.ebuild
@@ -30,7 +30,7 @@ DEPEND="${RDEPEND}
 	>=sys-kernel/bootengine-0.0.4:=
 	sys-kernel/dracut
 	virtual/udev
-	amd64? ( sys-firmware/intel-microcode )"
+	amd64? ( sys-firmware/intel-microcode:= )"
 
 # We are bad, we want to get around the sandbox.  So do the creation of the
 # cpio image in pkg_setup() where we are free to mount filesystems, chroot,
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.14.36.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.14.36-r1.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.14.36.ebuild
rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.14.36-r1.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.16.4.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.16.4-r1.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.16.4.ebuild
rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.16.4-r1.ebuild