diff --git a/17.06/Dockerfile b/17.06/Dockerfile
index 77bd47643..f4838595e 100644
--- a/17.06/Dockerfile
+++ b/17.06/Dockerfile
@@ -3,6 +3,12 @@ FROM alpine:3.6
 RUN apk add --no-cache \
 		ca-certificates
 
+# set up nsswitch.conf for Go's "netgo" implementation (which Docker explicitly uses)
+# - https://github.com/docker/docker-ce/blob/v17.09.0-ce/components/engine/hack/make.sh#L149
+# - https://github.com/golang/go/blob/go1.9.1/src/net/conf.go#L194-L275
+# - docker run --rm debian:stretch grep '^hosts:' /etc/nsswitch.conf
+RUN [ ! -e /etc/nsswitch.conf ] && echo 'hosts: files dns' > /etc/nsswitch.conf
+
 ENV DOCKER_CHANNEL stable
 ENV DOCKER_VERSION 17.06.2-ce
 # TODO ENV DOCKER_SHA256
diff --git a/17.07/Dockerfile b/17.07/Dockerfile
index c81ede06f..c7c56fa70 100644
--- a/17.07/Dockerfile
+++ b/17.07/Dockerfile
@@ -3,6 +3,12 @@ FROM alpine:3.6
 RUN apk add --no-cache \
 		ca-certificates
 
+# set up nsswitch.conf for Go's "netgo" implementation (which Docker explicitly uses)
+# - https://github.com/docker/docker-ce/blob/v17.09.0-ce/components/engine/hack/make.sh#L149
+# - https://github.com/golang/go/blob/go1.9.1/src/net/conf.go#L194-L275
+# - docker run --rm debian:stretch grep '^hosts:' /etc/nsswitch.conf
+RUN [ ! -e /etc/nsswitch.conf ] && echo 'hosts: files dns' > /etc/nsswitch.conf
+
 ENV DOCKER_CHANNEL edge
 ENV DOCKER_VERSION 17.07.0-ce
 # TODO ENV DOCKER_SHA256
diff --git a/17.09/Dockerfile b/17.09/Dockerfile
index 755b8d004..9460164cc 100644
--- a/17.09/Dockerfile
+++ b/17.09/Dockerfile
@@ -3,6 +3,12 @@ FROM alpine:3.6
 RUN apk add --no-cache \
 		ca-certificates
 
+# set up nsswitch.conf for Go's "netgo" implementation (which Docker explicitly uses)
+# - https://github.com/docker/docker-ce/blob/v17.09.0-ce/components/engine/hack/make.sh#L149
+# - https://github.com/golang/go/blob/go1.9.1/src/net/conf.go#L194-L275
+# - docker run --rm debian:stretch grep '^hosts:' /etc/nsswitch.conf
+RUN [ ! -e /etc/nsswitch.conf ] && echo 'hosts: files dns' > /etc/nsswitch.conf
+
 ENV DOCKER_CHANNEL stable
 ENV DOCKER_VERSION 17.09.0-ce
 # TODO ENV DOCKER_SHA256
diff --git a/17.10-rc/Dockerfile b/17.10-rc/Dockerfile
index 7c3437684..fafd392d4 100644
--- a/17.10-rc/Dockerfile
+++ b/17.10-rc/Dockerfile
@@ -3,6 +3,12 @@ FROM alpine:3.6
 RUN apk add --no-cache \
 		ca-certificates
 
+# set up nsswitch.conf for Go's "netgo" implementation (which Docker explicitly uses)
+# - https://github.com/docker/docker-ce/blob/v17.09.0-ce/components/engine/hack/make.sh#L149
+# - https://github.com/golang/go/blob/go1.9.1/src/net/conf.go#L194-L275
+# - docker run --rm debian:stretch grep '^hosts:' /etc/nsswitch.conf
+RUN [ ! -e /etc/nsswitch.conf ] && echo 'hosts: files dns' > /etc/nsswitch.conf
+
 ENV DOCKER_CHANNEL test
 ENV DOCKER_VERSION 17.10.0-ce-rc1
 # TODO ENV DOCKER_SHA256
diff --git a/Dockerfile.template b/Dockerfile.template
index e73c99973..9e7e4efe0 100644
--- a/Dockerfile.template
+++ b/Dockerfile.template
@@ -3,6 +3,12 @@ FROM alpine:%%ALPINE-VERSION%%
 RUN apk add --no-cache \
 		ca-certificates
 
+# set up nsswitch.conf for Go's "netgo" implementation (which Docker explicitly uses)
+# - https://github.com/docker/docker-ce/blob/v17.09.0-ce/components/engine/hack/make.sh#L149
+# - https://github.com/golang/go/blob/go1.9.1/src/net/conf.go#L194-L275
+# - docker run --rm debian:stretch grep '^hosts:' /etc/nsswitch.conf
+RUN [ ! -e /etc/nsswitch.conf ] && echo 'hosts: files dns' > /etc/nsswitch.conf
+
 ENV DOCKER_CHANNEL %%DOCKER-CHANNEL%%
 ENV DOCKER_VERSION %%DOCKER-VERSION%%
 # TODO ENV DOCKER_SHA256