diff --git a/src/paths.js b/src/paths.js
index c592f5a3a..0df61a191 100644
--- a/src/paths.js
+++ b/src/paths.js
@@ -32,6 +32,7 @@ exports = module.exports = {
     APP_CERTS_DIR: path.join(config.baseDir(), 'boxdata/certs'),
     CLOUDRON_AVATAR_FILE: path.join(config.baseDir(), 'boxdata/avatar.png'),
     UPDATE_CHECKER_FILE: path.join(config.baseDir(), 'boxdata/updatechecker.json'),
+    PLATFORM_CONFIG_FILE: path.join(config.baseDir(), 'boxdata/platform.json'),
 
     AUTO_PROVISION_FILE: path.join(config.baseDir(), 'configs/autoprovision.json')
 };
diff --git a/src/platform.js b/src/platform.js
index 8348e300d..0e5d21c63 100644
--- a/src/platform.js
+++ b/src/platform.js
@@ -47,6 +47,7 @@ function start(callback) {
     // short-circuit for the restart case
     if (_.isEqual(infra, existingInfra)) {
         debug('platform is uptodate at version %s', infra.version);
+        updateAddons();
         emitPlatformReady();
         return callback();
     }
@@ -67,6 +68,7 @@ function start(callback) {
 
         locker.unlock(locker.OP_PLATFORM_START);
 
+        updateAddons();
         emitPlatformReady();
 
         callback();
@@ -80,6 +82,21 @@ function stop(callback) {
     taskmanager.pauseTasks(callback);
 }
 
+function updateAddons() {
+    var platformConfig = safe.JSON.parse(safe.fs.readFileSync(paths.PLATFORM_CONFIG_FILE, 'utf8'));
+    if (!platformConfig) platformConfig = { };
+
+    for (var containerName of [ 'mysql', 'postgresql', 'mail', 'mongodb' ]) {
+        const containerConfig = platformConfig[containerName];
+        if (!containerConfig) continue;
+
+        if (!containerConfig.memory || !containerConfig.memorySwap) continue;
+
+        const cmd = `docker update --memory ${containerConfig.memory} --memory-swap ${containerConfig.memorySwap} ${containerName}`;
+        shell.execSync(`update${containerName}`, cmd);
+    }
+}
+
 function emitPlatformReady() {
     // give some time for the platform to "settle". For example, mysql might still be initing the
     // database dir and we cannot call service scripts until that's done.