diff --git a/sdk_container/src/third_party/coreos-overlay/eclass/coreos-kernel.eclass b/sdk_container/src/third_party/coreos-overlay/eclass/coreos-kernel.eclass
index 45bb8036e2..a6d5542081 100644
--- a/sdk_container/src/third_party/coreos-overlay/eclass/coreos-kernel.eclass
+++ b/sdk_container/src/third_party/coreos-overlay/eclass/coreos-kernel.eclass
@@ -214,7 +214,24 @@ coreos-kernel_src_configure() {
 	# Use default for any options not explitly set in defconfig
 	kmake olddefconfig
 
-	# For convinence, generate a minimal defconfig of the build
+	# Verify that olddefconfig has not converted any y or m options to n
+	# (implying a new, disabled dependency). Allow options to be converted
+	# from m to y.
+	#
+	# generate regexes from enabled boolean/tristate options |
+	#	filter them out of the defconfig |
+	#	filter for boolean/tristate options, and format |
+	#	sort (why not)
+	local missing=$( \
+		gawk -F = '/=[ym]$/ {print "^" $1 "="}' "${S}/build/.config" | \
+		grep -vf - "${S}/build/.config.old" | \
+		gawk -F = '/=[ym]$/ {print "    " $1}' | \
+		sort)
+	if [[ -n "${missing}" ]]; then
+		die "Requested options not enabled in build:\n${missing}"
+	fi
+
+	# For convenience, generate a minimal defconfig of the build
 	kmake savedefconfig
 }
 
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.10.1-r1.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.10.1-r2.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.10.1-r1.ebuild
rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-4.10.1-r2.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.10.1-r1.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.10.1-r2.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.10.1-r1.ebuild
rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-4.10.1-r2.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-4.10 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-4.10
index b1865259d8..256c42c1f2 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-4.10
+++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/amd64_defconfig-4.10
@@ -49,7 +49,6 @@ CONFIG_X86_ACPI_CPUFREQ=m
 # CONFIG_X86_ACPI_CPUFREQ_CPB is not set
 CONFIG_X86_AMD_FREQ_SENSITIVITY=m
 CONFIG_INTEL_IDLE=y
-CONFIG_I7300_IDLE=m
 CONFIG_PCI_MMCONFIG=y
 CONFIG_XEN_PCIDEV_FRONTEND=m
 CONFIG_HOTPLUG_PCI_ACPI=y
@@ -146,7 +145,6 @@ CONFIG_DELL_RBU=m
 CONFIG_DCDBAS=m
 CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
-CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
 CONFIG_SCHED_TRACER=y
 CONFIG_FTRACE_SYSCALLS=y
 CONFIG_STACK_TRACER=y
@@ -162,3 +160,7 @@ CONFIG_KVM=m
 CONFIG_KVM_INTEL=m
 CONFIG_KVM_AMD=m
 CONFIG_ENA_ETHERNET=m
+CONFIG_OPTPROBES=y
+CONFIG_KPROBES_ON_FTRACE=y
+CONFIG_FCOE_FNIC=m
+CONFIG_ISCSI_IBFT_FIND=y
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-4.10 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-4.10
index 1481def5a7..f89aaf21aa 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-4.10
+++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/arm64_defconfig-4.10
@@ -39,10 +39,6 @@ CONFIG_NF_CONNTRACK=y
 # CONFIG_NETFILTER_XT_MATCH_SCTP is not set
 CONFIG_NF_CONNTRACK_IPV4=y
 CONFIG_BRIDGE=y
-CONFIG_DNS_RESOLVER=y
-CONFIG_CFG80211=m
-# CONFIG_CFG80211_DEFAULT_PS is not set
-CONFIG_MAC80211=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DMA_CMA=y
 CONFIG_BLK_DEV_LOOP=y
@@ -69,12 +65,9 @@ CONFIG_NET_XGENE=y
 CONFIG_THUNDER_NIC_PF=y
 CONFIG_THUNDER_NIC_VF=y
 CONFIG_SKY2=y
-CONFIG_SMC91X=y
-CONFIG_SMSC911X=y
 CONFIG_MDIO_BITBANG=m
 CONFIG_MDIO_GPIO=m
 CONFIG_MDIO_OCTEON=y
-CONFIG_RTL8192CE=m
 CONFIG_INPUT_EVDEV=y
 CONFIG_SERIO_AMBAKMI=y
 CONFIG_LEGACY_PTY_COUNT=16
@@ -89,6 +82,8 @@ CONFIG_SERIAL_XILINX_PS_UART_CONSOLE=y
 CONFIG_HW_RANDOM=y
 CONFIG_TCG_TPM=y
 CONFIG_TCG_TIS_ST33ZP24=m
+CONFIG_TCG_TIS_ST33ZP24_I2C=m
+CONFIG_TCG_TIS_ST33ZP24_SPI=m
 CONFIG_SPI=y
 CONFIG_SPI_PL022=y
 CONFIG_SPI_QUP=y
@@ -98,7 +93,6 @@ CONFIG_GPIO_XGENE=y
 CONFIG_GPIO_XGENE_SB=y
 CONFIG_POWER_RESET_XGENE=y
 CONFIG_POWER_RESET_SYSCON=y
-# CONFIG_HWMON is not set
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
 CONFIG_FB_ARMCLCD=y
@@ -135,7 +129,6 @@ CONFIG_KVM=y
 CONFIG_DEBUG_FS=y
 CONFIG_SCHEDSTATS=y
 # CONFIG_DEBUG_PREEMPT is not set
-# CONFIG_FTRACE is not set
 CONFIG_CRYPTO_ANSI_CPRNG=y
 CONFIG_ARM64_CRYPTO=y
 CONFIG_CRYPTO_SHA1_ARM64_CE=y
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-4.10 b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-4.10
index 5504ed15f3..2d150b6360 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-4.10
+++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-4.10
@@ -37,8 +37,6 @@ CONFIG_BPF_SYSCALL=y
 CONFIG_PROFILING=y
 CONFIG_KPROBES=y
 CONFIG_JUMP_LABEL=y
-CONFIG_OPTPROBES=y
-CONFIG_KPROBES_ON_FTRACE=y
 CONFIG_KRETPROBES=y
 CONFIG_CC_STACKPROTECTOR_STRONG=y
 CONFIG_MODULES=y
@@ -150,7 +148,7 @@ CONFIG_NF_CONNTRACK_ZONES=y
 CONFIG_NF_CONNTRACK_EVENTS=y
 CONFIG_NF_CONNTRACK_TIMEOUT=y
 CONFIG_NF_CONNTRACK_TIMESTAMP=y
-CONFIG_NF_CT_PROTO_UDPLITE=m
+CONFIG_NF_CT_PROTO_UDPLITE=y
 CONFIG_NF_CONNTRACK_AMANDA=m
 CONFIG_NF_CONNTRACK_FTP=m
 CONFIG_NF_CONNTRACK_H323=m
@@ -163,6 +161,8 @@ CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
 CONFIG_NF_CT_NETLINK=m
 CONFIG_NF_CT_NETLINK_TIMEOUT=m
+CONFIG_NF_SOCKET_IPV4=m
+CONFIG_NF_SOCKET_IPV6=m
 CONFIG_NETFILTER_XTABLES=y
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
@@ -409,7 +409,6 @@ CONFIG_CONNECTOR=m
 CONFIG_MTD=m
 CONFIG_BLK_DEV_PCIESSD_MTIP32XX=m
 CONFIG_ZRAM=m
-CONFIG_ZRAM_LZ4_COMPRESS=y
 CONFIG_BLK_CPQ_CISS_DA=m
 CONFIG_BLK_DEV_DRBD=m
 CONFIG_BLK_DEV_NBD=m
@@ -432,7 +431,6 @@ CONFIG_SCSI_FC_ATTRS=m
 CONFIG_SCSI_SAS_ATA=y
 CONFIG_ISCSI_TCP=m
 CONFIG_ISCSI_BOOT_SYSFS=m
-CONFIG_ISCSI_IBFT_FIND=y
 CONFIG_BLK_DEV_3W_XXXX_RAID=m
 CONFIG_SCSI_HPSA=m
 CONFIG_SCSI_3W_9XXX=m
@@ -452,7 +450,6 @@ CONFIG_XEN_SCSI_FRONTEND=m
 CONFIG_LIBFC=m
 CONFIG_LIBFCOE=m
 CONFIG_FCOE=m
-CONFIG_FCOE_FNIC=m
 CONFIG_SCSI_SYM53C8XX_2=m
 CONFIG_SCSI_QLA_FC=m
 CONFIG_SCSI_LPFC=m
@@ -550,7 +547,6 @@ CONFIG_IXGB=m
 CONFIG_IXGBE=m
 CONFIG_IXGBEVF=m
 CONFIG_I40E=m
-CONFIG_I40E_VXLAN=y
 CONFIG_I40EVF=m
 CONFIG_JME=m
 CONFIG_SKGE=m
@@ -693,6 +689,7 @@ CONFIG_MMC_SDHCI_PCI=m
 # CONFIG_MMC_RICOH_MMC is not set
 CONFIG_INFINIBAND=m
 CONFIG_INFINIBAND_USER_MAD=m
+CONFIG_INFINIBAND_RDMAVT=m
 CONFIG_INFINIBAND_MTHCA=m
 CONFIG_INFINIBAND_QIB=m
 CONFIG_INFINIBAND_CXGB3=m