diff --git a/Dockerfile.kube-dns b/Dockerfile.kube-dns
index c6245b3a1..257d9fdbb 100644
--- a/Dockerfile.kube-dns
+++ b/Dockerfile.kube-dns
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM ARG_FROM
+FROM ARG_FROM_BASE
 
 MAINTAINER Bowei Du <bowei@google.com>
 
diff --git a/Dockerfile.node-cache b/Dockerfile.node-cache
index 4a704ad95..ca77efd2f 100644
--- a/Dockerfile.node-cache
+++ b/Dockerfile.node-cache
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM ARG_FROM
+FROM ARG_FROM_IPT
 ADD bin/ARG_ARCH/ARG_BIN /ARG_BIN
 EXPOSE 53 53/udp
 EXPOSE 53 53/tcp
diff --git a/Dockerfile.sidecar b/Dockerfile.sidecar
index b748e1ec2..08a631f24 100644
--- a/Dockerfile.sidecar
+++ b/Dockerfile.sidecar
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM ARG_FROM
+FROM ARG_FROM_BASE
 
 MAINTAINER Bowei Du <bowei@google.com>
 
diff --git a/rules.mk b/rules.mk
index 947568fd4..34b8c49f1 100644
--- a/rules.mk
+++ b/rules.mk
@@ -29,11 +29,8 @@ export VERSION
 SRC_DIRS := cmd pkg
 
 ALL_ARCH := amd64 arm arm64 ppc64le s390x
-ifeq ($(BINARY),node-cache)
-BASEIMAGE ?= k8s.gcr.io/debian-iptables-$(ARCH):v12.0.1
-else
 BASEIMAGE ?= k8s.gcr.io/debian-base-$(ARCH):v2.0.0
-endif
+IPTIMAGE ?= k8s.gcr.io/debian-iptables-$(ARCH):v12.0.1
 
 # These rules MUST be expanded at reference time (hence '=') as BINARY
 # is dynamically scoped.
@@ -122,7 +119,8 @@ define DOCKERFILE_RULE
 	    -e 's|ARG_ARCH|$(ARCH)|g' \
 	    -e 's|ARG_BIN|$(BINARY)|g' \
 	    -e 's|ARG_REGISTRY|$(REGISTRY)|g' \
-	    -e 's|ARG_FROM|$(BASEIMAGE)|g' \
+	    -e 's|ARG_FROM_BASE|$(BASEIMAGE)|g' \
+	    -e 's|ARG_FROM_IPT|$(IPTIMAGE)|g' \
 	    -e 's|ARG_VERSION|$(VERSION)|g' \
 	    $$< > $$@
 .$(BUILDSTAMP_NAME)-container: .$(BINARY)-$(ARCH)-dockerfile
@@ -134,7 +132,6 @@ $(foreach BINARY,$(CONTAINER_BINARIES),$(eval $(DOCKERFILE_RULE)))
 define CONTAINER_RULE
 .$(BUILDSTAMP_NAME)-container: bin/$(ARCH)/$(BINARY)
 	@echo "container: bin/$(ARCH)/$(BINARY) ($(CONTAINER_NAME))"
-	@docker pull $(BASEIMAGE)
 	@docker build					\
 		$(DOCKER_BUILD_FLAGS)			\
 		-t $(CONTAINER_NAME):$(VERSION)		\