diff --git a/baseimage/initializeBaseUbuntuImage.sh b/baseimage/initializeBaseUbuntuImage.sh
index 3da6b5040..b494de4cd 100644
--- a/baseimage/initializeBaseUbuntuImage.sh
+++ b/baseimage/initializeBaseUbuntuImage.sh
@@ -32,13 +32,13 @@ apt-get install -y curl iptables
 echo "==== Install btrfs tools ==="
 apt-get -y install btrfs-tools
 
+# https://docs.docker.com/engine/installation/linux/ubuntulinux/
 echo "==== Install docker ===="
-# install docker from binary to pin it to a specific version. the current debian repo does not allow pinning
-# IMPORTANT: docker 1.11.x breaks the --dns option hack that we use below
-curl https://get.docker.com/builds/Linux/x86_64/docker-1.10.2 > /usr/bin/docker
-apt-get -y install aufs-tools
-chmod +x /usr/bin/docker
-groupadd docker
+apt-key adv --keyserver hkp://ha.pool.sks-keyservers.net:80 --recv-keys 58118E89F3A912897C070ADBF76221572C52609D
+echo "deb https://apt.dockerproject.org/repo ubuntu-xenial main" > /etc/apt/sources.list.d/docker.list
+apt-get -y update
+apt-get -y install aufs-tools linux-image-extra-$(uname -r) linux-image-extra-virtual
+apt-get -y install docker-engine=1.12.5-0~ubuntu-xenial # apt-cache madison docker-engine
 usermod "${USER}" -a -G docker
 
 echo "=== Enable memory accounting =="
diff --git a/setup/container.sh b/setup/container.sh
index da2b251ef..2ea8224a4 100755
--- a/setup/container.sh
+++ b/setup/container.sh
@@ -45,36 +45,8 @@ fi
 # so it gets restored across reboot
 mkdir -p /etc/iptables && iptables-save > /etc/iptables/rules.v4
 
-cat > /etc/systemd/system/docker.socket <<EOF
-[Unit]
-Description=Docker Socket for the API
-PartOf=docker.service
-
-[Socket]
-ListenStream=/var/run/docker.sock
-SocketMode=0660
-SocketUser=root
-SocketGroup=docker
-
-[Install]
-WantedBy=sockets.target
-EOF
-cat > /etc/systemd/system/docker.service <<EOF
-[Unit]
-Description=Docker Application Container Engine
-After=network.target docker.socket
-Requires=docker.socket
-
-[Service]
-ExecStart=/usr/bin/docker daemon -H fd:// --log-driver=journald --exec-opt native.cgroupdriver=cgroupfs --dns 127.0.0.1 --dns-search=.
-MountFlags=slave
-LimitNOFILE=1048576
-LimitNPROC=1048576
-LimitCORE=infinity
-
-[Install]
-WantedBy=multi-user.target
-EOF
+# make docker use the internal unbound dns server
+sed -e 's,^ExecStart=.*$,ExecStart=/usr/bin/docker daemon -H fd:// --log-driver=journald --exec-opt native.cgroupdriver=cgroupfs,' -i /lib/systemd/system/docker.service
 
 # caas has ssh on port 202 and we disable password login
 if [[ "${provider}" == "caas" ]]; then
diff --git a/src/infra_version.js b/src/infra_version.js
index 858014113..cb98b7912 100644
--- a/src/infra_version.js
+++ b/src/infra_version.js
@@ -6,7 +6,7 @@
 
 exports = module.exports = {
     // a version bump means that all containers (apps and addons) are recreated
-    'version': 42,
+    'version': 43,
 
     'baseImages': [ 'cloudron/base:0.9.0' ],