diff --git a/scripts/replace-resolve-conf b/scripts/replace-resolve-conf
new file mode 100755
index 0000000..6c2ad7f
--- /dev/null
+++ b/scripts/replace-resolve-conf
@@ -0,0 +1,18 @@
+#!/bin/sh
+# replace-resolve-conf -- with a generic fallback
+# Copyright (C) 2017  Olaf Meeuwissen
+#
+# License: GPL-3.0+
+
+# The build environment's /etc/resolv.conf gets copied into the rootfs
+# which is unlikely to work and may unintentionally disclose info.  We
+# replace it with a version that uses two google-public-dns servers.
+# The docker engine should replace this with a copy of the file that's
+# used by the host.
+
+cat > /etc/resolv.conf <<EOF
+nameserver 8.8.8.8
+nameserver 8.8.4.4
+EOF
+
+rm $0