diff --git a/sdk_container/src/third_party/coreos-overlay/changelog/updates/2022-05-23-python-update.md b/sdk_container/src/third_party/coreos-overlay/changelog/updates/2022-05-23-python-update.md
new file mode 100644
index 0000000000..d850c9c262
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/changelog/updates/2022-05-23-python-update.md
@@ -0,0 +1,2 @@
+- OEM: python ([3.9.12](https://www.python.org/downloads/release/python-3912/))
+- OEM: distro ([1.7.0](https://github.com/python-distro/distro/releases/tag/v1.7.0))
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild
index 0873ae409e..3a2067df1c 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild
@@ -50,8 +50,11 @@ RDEPEND="${RDEPEND}
 	dev-libs/libyaml
 	dev-libs/nspr
 	dev-libs/protobuf
+	dev-python/flit_core
+	dev-python/gpep517
 	dev-python/mako
 	dev-python/setuptools
+	dev-python/wheel
 	dev-util/gdbus-codegen
 	dev-util/gperf
 	>=dev-util/gtk-doc-am-1.13
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/Manifest b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/Manifest
index 4e3c4098c0..a7e7c5ade1 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/Manifest
@@ -1,2 +1,3 @@
-DIST Python-3.9.8.tar.xz 19149464 BLAKE2B 739eb22bae8b44cf5be9a24ca6ecacb80eaca65684abf1fef18b7adcac9adede2eff60e8a9ac5db2672511d180d6079c39e2ff2901ab454c0876ae8e1bfe96cc SHA512 5d5b46a242525b2e6a7f9c69c63c6d7cd985e1443a7d9b716107e75f14fef7b5c9c2e5e8a90adbbbf5f7a8b90a483d01e18c1732470e6e54b611b5aba9f99fe1
-DIST python-gentoo-patches-3.9.8.tar.xz 13192 BLAKE2B 995bead7e87b1d2eb9984012065c0f752d51e5a78dd9019270e071f83660cdab71c39e5be0104919f5af9089dede71d9c918a521f76e67c6ef1aeab5ffb58991 SHA512 80dfa3766bb5546924a5fccf4f469ce409cb8a4b0873c3d2fb737b3eb27b7c2b29337e0179624bbe077273b8e475f7921d6479ca7eb8e31ba423d0cea2f3d1cf
+DIST Python-3.9.12.tar.xz 19740524 BLAKE2B 05f2469aa53ca36221ef4976b17bfde3e5b86afd5a8114e5a7fd899f975a8e55022555ef718d5352ab68de1b7b23865a0bf713768c9c2b30d591438c9a396d25 SHA512 081981901e14149748fd35228db0b3b1d96fef227ae7404f07b8bad0fda4b02649bf31c348c94aefdaf3327565d78f9489437c2c02f647b15d41376a27a23e97
+DIST Python-3.9.12.tar.xz.asc 833 BLAKE2B 33436d0404a643215a8fd2b967ffd216201da24f374941bf65b888159ccfabcbe79b751eca2dd489b06605604338c8bbaab74aa10abbe4bcffaa54236301228e SHA512 dddaa27f8a29034f458edb6739398a5455c87fe37b6349e161865a9deedca118ffe9cb82663cc75bbe60b3b556399c0c6855f5262aac1fe90d36a3694fca65b2
+DIST python-gentoo-patches-3.9.12.tar.xz 12848 BLAKE2B 5dd66fa94b136a463d2c4be3a5b7dfad770c3905467a1d81af02a35b2783ce7d614881c915ee8f8e764c1656963d6886d9c60c6e524f512e1bc496e42d01307b SHA512 07de63e47a8e547724099062239df8fcfd254f19d38be28131e6bbb094ffbab8483861fb6a5905e60d7fa7a1a5dc06785951fa31984ecad89516b0b742c47f91
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md
index 18793b7c57..8b27d3d896 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md
+++ b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md
@@ -1,5 +1,9 @@
 Modifications made:
 
+- Drop `pgo` and `lto` USE flags, so flags passed to configure are
+  `--without-lto` and `--disable-optimizations`. Also drop `pgo` code
+  in `src_configure` and `src_compile`.
+
 - We are not running any tests, so drop the `test` use flag and
   `src_test` function. Drop also `pkg_pretend` and `pkg_setup`
   functions as they were only doing some stuff if `test` use flag was
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.8.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.12.ebuild
similarity index 80%
rename from sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.8.ebuild
rename to sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.12.ebuild
index 42b146ebc3..0cdb068420 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.8.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.12.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI="7"
@@ -14,17 +14,18 @@ PATCHSET="python-gentoo-patches-${MY_PV}"
 
 DESCRIPTION="An interpreted, interactive, object-oriented programming language"
 HOMEPAGE="https://www.python.org/"
-SRC_URI="https://www.python.org/ftp/python/${PV%_*}/${MY_P}.tar.xz
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%_*}/${MY_P}.tar.xz
 	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/python/${PATCHSET}.tar.xz
 	verify-sig? (
 		https://www.python.org/ftp/python/${PV%_*}/${MY_P}.tar.xz.asc
-	)"
+	)
+"
 S="${WORKDIR}/${MY_P}"
 
 LICENSE="PSF-2"
 SLOT="${PYVER}"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86"
 IUSE="hardened"
 
 # Do not add a dependency on dev-lang/python to this ebuild.
@@ -32,24 +33,30 @@ IUSE="hardened"
 # run the bootstrap code on your dev box and include the results in the
 # patchset. See bug 447752.
 
-DEPEND="app-arch/bzip2:=
+DEPEND="
+	app-arch/bzip2:=
 	app-arch/xz-utils:=
+	dev-lang/python-exec[python_targets_python3_9(-)]
 	sys-apps/util-linux:=
 	>=sys-libs/zlib-1.1.3:=
 	virtual/libcrypt:=
-	virtual/libintl"
+	virtual/libintl
+"
 BDEPEND="
 	virtual/awk
 	virtual/pkgconfig
 	sys-devel/autoconf-archive
-	verify-sig? ( app-crypt/openpgp-keys-python )
-	!sys-devel/gcc[libffi(-)]"
+	verify-sig? ( sec-keys/openpgp-keys-python )
+	!sys-devel/gcc[libffi(-)]
+"
 
 VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/python.org.asc
 
 # large file tests involve a 2.5G file being copied (duplicated)
 CHECKREQS_DISK_BUILD=5500M
 
+QA_PKGCONFIG_VERSION=${PYVER}
+
 src_unpack() {
 	if use verify-sig; then
 		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
@@ -143,9 +150,19 @@ src_configure() {
 		--without-ensurepip
 		--without-system-expat
 		--without-system-ffi
+		--without-lto
+		--disable-optimizations
 	)
 
-	OPT="" econf "${myeconfargs[@]}"
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	econf "${myeconfargs[@]}"
 
 	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
 		eerror "configure has detected that the sem_open function is broken."
@@ -162,7 +179,17 @@ src_compile() {
 	# https://bugs.gentoo.org/823728
 	export SETUPTOOLS_USE_DISTUTILS=stdlib
 
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
 	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
 }
 
 src_install() {
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/boto-2.49.0-r4.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/boto-2.49.0-r4.ebuild
index 00a2041688..4dd30bd7dc 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/boto-2.49.0-r4.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/boto-2.49.0-r4.ebuild
@@ -3,7 +3,7 @@
 
 EAPI="7"
 
-PYTHON_COMPAT=( python3_{7..9} )
+PYTHON_COMPAT=( python3_{8..10} )
 DISTUTILS_USE_SETUPTOOLS=bdepend
 
 inherit distutils-r1
@@ -14,7 +14,7 @@ SRC_URI="mirror://pypi/${PN:0:1}/${PN}/${P}.tar.gz"
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="amd64 arm arm64 ppc ~ppc64 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+KEYWORDS="amd64 arm arm64 ppc ~ppc64 ~riscv sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
 
 PATCHES=(
 	# taken from https://bugs.debian.org/909545
@@ -24,6 +24,7 @@ PATCHES=(
 	"${FILESDIR}"/${P}-py3-httplib-strict.patch
 	"${FILESDIR}"/${P}-py3-server-port.patch
 	"${FILESDIR}"/${P}-unbundle-six.patch
+	"${FILESDIR}"/${P}-py310.patch
 )
 
 RDEPEND=">=dev-python/six-1.12.0[${PYTHON_USEDEP}]"
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py310.patch b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py310.patch
new file mode 100644
index 0000000000..7b427f1f15
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py310.patch
@@ -0,0 +1,44 @@
+diff --git a/boto/dynamodb/types.py b/boto/dynamodb/types.py
+index d9aaaa4c..3f8d8601 100644
+--- a/boto/dynamodb/types.py
++++ b/boto/dynamodb/types.py
+@@ -27,7 +27,7 @@ Python types and vice-versa.
+ import base64
+ from decimal import (Decimal, DecimalException, Context,
+                      Clamped, Overflow, Inexact, Underflow, Rounded)
+-from collections import Mapping
++from collections.abc import Mapping
+ from boto.dynamodb.exceptions import DynamoDBNumberError
+ from boto.compat import filter, map, six, long_type
+ 
+diff --git a/boto/mws/connection.py b/boto/mws/connection.py
+index 687fae74..3a1f5f80 100644
+--- a/boto/mws/connection.py
++++ b/boto/mws/connection.py
+@@ -21,7 +21,7 @@
+ import xml.sax
+ import hashlib
+ import string
+-import collections
++import collections.abc
+ from boto.connection import AWSQueryConnection
+ from boto.exception import BotoServerError
+ import boto.mws.exception
+@@ -109,7 +109,7 @@ def http_body(field):
+ def destructure_object(value, into, prefix, members=False):
+     if isinstance(value, boto.mws.response.ResponseElement):
+         destructure_object(value.__dict__, into, prefix, members=members)
+-    elif isinstance(value, collections.Mapping):
++    elif isinstance(value, collections.abc.Mapping):
+         for name in value:
+             if name.startswith('_'):
+                 continue
+@@ -117,7 +117,7 @@ def destructure_object(value, into, prefix, members=False):
+                                members=members)
+     elif isinstance(value, six.string_types):
+         into[prefix] = value
+-    elif isinstance(value, collections.Iterable):
++    elif isinstance(value, collections.abc.Iterable):
+         for index, element in enumerate(value):
+             suffix = (members and '.member.' or '.') + str(index + 1)
+             destructure_object(element, into, prefix + suffix,
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/Manifest b/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/Manifest
index 2f76217d5a..fbb1ae14b6 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/Manifest
@@ -1 +1 @@
-DIST distro-1.6.0.tar.gz 69377 BLAKE2B 69119c3acfc12327a55e8b16f4e183fe1b039e965a5432081d83c6e5d0f6367846c403eb34764f2436beec173d3ceaa5265e0e1e7d786d1008e84772426ef049 SHA512 1682a52e617ba440eb0fac28ed653dd3bbc53012e3dc81099d792f088d399c1a6aba62d638e7b50aad88de2cd0935579a0bdd29a9abb5aad9d0c68bd90311268
+DIST distro-1.7.0.tar.gz 58164 BLAKE2B 22bbd2daf9cac589530eac9a58767db6b9e389b77719516f7386a9377b49ba4c9b696165701acc42366b760b9a632c70a2243a58c12a367fef2a0a770a4aea44 SHA512 14516ecab33ee8c57c35a8279eb515fd699031fabac7d8886092ea98696797d55503179870aeb513a85e1a66c7e69f2f60bb6ea9fc935be975cb5135e1917ecc
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.6.0-r1.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.7.0.ebuild
similarity index 56%
rename from sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.6.0-r1.ebuild
rename to sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.7.0.ebuild
index e7c12f03f3..146f015bd5 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.6.0-r1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.7.0.ebuild
@@ -1,14 +1,17 @@
-# Copyright 2021 Microsoft Corporation
+# Copyright 2021-2022 Microsoft Corporation
 # Distributed under the terms of GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 MY_PN='distro'
 MY_P="${MY_PN}-${PV}"
 
-DESCRIPTION="OS platform information API"
-HOMEPAGE="https://github.com/python-distro/distro"
-SRC_URI="${HOMEPAGE}/releases/download/v${PV}/${MY_P}.tar.gz"
+DESCRIPTION="Reliable machine-readable Linux distribution information for Python"
+HOMEPAGE="
+	https://distro.readthedocs.io/en/latest/
+	https://pypi.org/project/distro/
+	https://github.com/python-distro/distro/"
+SRC_URI="mirror://pypi/${MY_PN:0:1}/${MY_PN}/${MY_P}.tar.gz"
 
 LICENSE="Apache-2.0"
 KEYWORDS="amd64 arm64"
@@ -30,5 +33,9 @@ src_compile() {
 
 src_install() {
 	insinto "/usr/share/oem/python/$(get_libdir)/python${DEP_PYVER}/site-packages"
-	doins "${S}/distro.py"
+	local ssd="${S}/src/distro"
+	doins "${ssd}/distro.py"
+	doins "${ssd}/__init__.py"
+	doins "${ssd}/__main__.py"
+	doins "${ssd}/py.typed"
 }
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
index b6be334a2d..7d04948e69 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
@@ -17,3 +17,7 @@
 # libxcrypt -> glibc -> python), and also we need to update gcc to
 # version 10 or later.
 >=virtual/libcrypt-2
+
+# Python 3.10 is stable in portage-stable, so avoid picking it
+# up. Drop this when we switch to it.
+>=dev-lang/python-3.10
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
index 2d051ed4c3..35e7a8fe88 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
@@ -16,7 +16,9 @@ sys-devel/gettext	-git
 
 sys-apps/gptfdisk -icu
 
-# for profile migration
+# for profile migration, needs to be enabled despite the fact it's
+# enabled by default in the ebuild, because berkdb is disabled
+# globally in make.defaults.
 sys-libs/gdbm berkdb
 
 dev-vcs/git -perl -iconv
@@ -54,7 +56,7 @@ net-nds/openldap minimal sasl
 sys-libs/glibc nscd
 
 # disable database build because otherwise it tries to generate a database in /etc
-dev-libs/cyrus-sasl kerberos -berkdb -gdbm
+dev-libs/cyrus-sasl kerberos -gdbm
 
 # don't build manpages for sssd
 sys-auth/sssd -python samba kerberos gssapi ssh sudo selinux
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
index 5fb4a7c3d1..c675c12b17 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
@@ -3,7 +3,7 @@
 
 app-admin/sudo		ldap sssd
 app-editors/vim		minimal
-dev-lang/python		-berkdb gdbm
+dev-lang/python		gdbm
 dev-libs/dbus-glib	tools
 dev-libs/elfutils	-utils
 dev-libs/openssl	pkcs11
@@ -14,8 +14,7 @@ sys-apps/smartmontools	-daemon -update-drivedb -systemd
 sys-block/parted        device-mapper
 sys-fs/lvm2		-readline
 sys-libs/ncurses	minimal
-sys-libs/pam		-berkdb audit
-sys-libs/gdbm		berkdb
+sys-libs/pam		audit
 
 # enable journal gateway, bootctl and container features
 sys-apps/systemd audit gnuefi importd http nat
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.use
index 4c1f3550ab..1bd1d2dcb6 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.use
@@ -2,8 +2,6 @@ coreos-base/update_engine delta_generator
 
 dev-vcs/git pcre
 
-dev-lang/python sqlite
-
 dev-lang/rust rustfmt
 
 # Allow smartcard support in the SDK for image signing
diff --git a/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base/selinux-base-2.20200818-r2.ebuild b/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base/selinux-base-2.20200818-r2.ebuild
index 50935ad704..f17de9ee5b 100644
--- a/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base/selinux-base-2.20200818-r2.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base/selinux-base-2.20200818-r2.ebuild
@@ -4,8 +4,10 @@
 EAPI="7"
 
 # flatcar changes
+PYTHON_COMPAT=( python3_{8,9,10} )
+PYTHON_REQ_USE="xml"
 TMPFILES_OPTIONAL=1
-inherit systemd tmpfiles
+inherit systemd tmpfiles python-any-r1
 
 if [[ ${PV} == 9999* ]]; then
 	EGIT_REPO_URI="${SELINUX_GIT_REPO:-https://anongit.gentoo.org/git/proj/hardened-refpolicy.git}"
@@ -32,10 +34,10 @@ RDEPEND=">=sys-apps/policycoreutils-2.8
 	>=sys-apps/checkpolicy-2.8
 "
 DEPEND="${RDEPEND}"
-# flatcar: BDEPEND on python3[xml] - normally pulled in through policycoreutils
+# flatcar: BDEPEND on python - normally pulled in through policycoreutils
 # but we made that dep conditional on USE=python
 BDEPEND="sys-devel/m4
-    >=dev-lang/python-3[xml]
+    ${PYTHON_DEPS}
 "