diff --git a/confluent_osdeploy/suse16-diskless/initramfs/var/lib/dracut/hooks/cmdline/10-confluentdiskless.sh b/confluent_osdeploy/suse16-diskless/initramfs/var/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
index a2ff4cab..06f65314 100644
--- a/confluent_osdeploy/suse16-diskless/initramfs/var/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
+++ b/confluent_osdeploy/suse16-diskless/initramfs/var/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
@@ -123,6 +123,50 @@ cd - > /dev/null
 rm -rf $tpmdir
 touch /etc/confluent/confluent.info
 cd /sys/class/net
+confluentsrv=$(getarg confluent)
+DIDDHCP=0
+if [ ! -z "$confluentsrv" ]; then
+    for i in *; do
+        ip link set $i up
+    done
+    myids=uuid=$(cat /sys/devices/virtual/dmi/id/product_uuid)
+    for mac in $(ip -br link|grep -v LOOPBACK|awk '{print $3}'); do
+        myids=$myids"/mac="$mac
+    done
+    if [[ "$confluentsrv" = *":"* ]]; then
+        confluenthttpsrv=[$confluentsrv]
+        myname=$(curl -sH "CONFLUENT_IDS: $myids" https://$confluenthttpsrv/confluent-api/self/whoami)
+    else
+        confluenthttpsrv=$confluentsrv
+        # the first nic with a link may not reach the server, try each until whoami answers
+        for try in {1..30}; do
+            for ifname in $(ip -br link|grep LOWER_UP|grep -v ib|grep -v UNKNOWN|awk '{print $1}'); do
+                echo -n "Attempting to use dhcp to bring up $ifname..."
+                dhcpcd -4 -L -t 10 $ifname
+                if ip -4 -o addr show dev $ifname scope global | grep -q inet; then
+                    echo -n "Complete: "
+                    ip -br addr show dev $ifname
+                    myname=$(curl -sf --connect-timeout 10 --max-time 30 -H "CONFLUENT_IDS: $myids" https://$confluenthttpsrv/confluent-api/self/whoami)
+                    if [ ! -z "$myname" ]; then
+                        DIDDHCP=1
+                        break 2
+                    fi
+                    echo "No answer from $confluentsrv on $ifname"
+                else
+                    echo "No lease on $ifname"
+                fi
+                dhcpcd -4 -x $ifname > /dev/null 2>&1
+                ip -4 addr flush dev $ifname
+            done
+            sleep 1
+        done
+    fi
+    if [ ! -z "$myname" ]; then
+        echo NODENAME: $myname > /etc/confluent/confluent.info
+        echo MANAGER: $confluentsrv >> /etc/confluent/confluent.info
+        echo EXTMGRINFO: $confluentsrv'||1' >> /etc/confluent/confluent.info
+    fi
+fi
 echo -n "Scanning for network configuration..."
 while ! grep ^EXTMGRINFO: /etc/confluent/confluent.info | awk -F'|' '{print $3}' | grep 1 >& /dev/null && [ "$TRIES" -lt 30 ]; do
     TRIES=$((TRIES + 1))
@@ -217,10 +261,12 @@ if [ "$linktype" = infiniband ]; then
 fi
 autoconfigmethod=$(grep ipv4_method /etc/confluent/confluent.deploycfg |awk '{print $2}')
 if [ "$autoconfigmethod" = "dhcp" ]; then
-    echo -n "Attempting to use dhcp to bring up $ifname..."
-    dhcpcd $ifname
-    echo "Complete:"
-    ip addr show dev $ifname
+    if [ "$DIDDHCP" = "0" ]; then
+        echo -n "Attempting to use dhcp to bring up $ifname..."
+        dhcpcd $ifname
+        echo "Complete:"
+        ip addr show dev $ifname
+    fi
     printf '\n[ipv4]\nmethod=auto\n' >> $nmcfg
 else
     v4addr=$(grep ^ipv4_address: /etc/confluent/confluent.deploycfg)
@@ -232,6 +278,16 @@ else
     fi
     v4nm=$(grep ^prefix: /etc/confluent/confluent.deploycfg)
     v4nm=${v4nm#prefix: }
+    if [ "$DIDDHCP" = "1" ]; then
+        # the lease from the confluent= lookup would expire in the image
+        dhcpcd -4 -x $ifname > /dev/null 2>&1
+        TRIES=0
+        while grep -qx dhcpcd /proc/[0-9]*/comm 2> /dev/null && [ "$TRIES" -lt 20 ]; do
+            sleep 0.5
+            TRIES=$((TRIES + 1))
+        done
+        ip -4 addr flush dev $ifname
+    fi
     echo "Setting up $ifname as static at $v4addr/$v4nm"
     ip addr add dev $ifname $v4addr/$v4nm
     if [ ! -z "$v4gw" ]; then
diff --git a/confluent_osdeploy/suse16-diskless/profiles/default/scripts/imageboot.sh b/confluent_osdeploy/suse16-diskless/profiles/default/scripts/imageboot.sh
index 7add1718..4debbd65 100644
--- a/confluent_osdeploy/suse16-diskless/profiles/default/scripts/imageboot.sh
+++ b/confluent_osdeploy/suse16-diskless/profiles/default/scripts/imageboot.sh
@@ -134,4 +134,38 @@ if [ -d /lib/firmware ]; then
 fi
 ln -s /sysroot/lib/firmware /lib/firmware
 chroot /sysroot chkstat --system --set --noheader > /dev/null
+if [ -x /sysroot/usr/sbin/matchpathcon ] && grep -Eq '^SELINUX=(enforcing|permissive)' /sysroot/etc/selinux/config 2> /dev/null; then
+    # Files written to the upper layer before policy load are unlabeled.
+    # Label only those, using globstar since the initramfs has no find.
+    selinuxpolicy=$(sed -n 's/^SELINUXTYPE=//p' /sysroot/etc/selinux/config)
+    fcontexts=/etc/selinux/$selinuxpolicy/contexts/files/file_contexts
+    shopt -s globstar dotglob nullglob
+    relabel=()
+    if [ -f /tmp/mountparts.sh ]; then
+        overlayparts=$(awk '{print $3}' /tmp/mountparts.sh)
+    else
+        overlayparts=/mnt/remote
+    fi
+    for srcmount in $overlayparts; do
+        upperdir=/mnt/overlay/upper
+        if [ -f /tmp/mountparts.sh ]; then
+            upperdir=/mnt/overlay${srcmount}/upper
+        fi
+        prefix=${srcmount#/mnt/remote}
+        prefix=${prefix%/}
+        relabel+=("${prefix:-/}")
+        for relpath in "$upperdir"/**; do
+            relabel+=("$prefix${relpath#$upperdir}")
+        done
+    done
+    shopt -u globstar dotglob nullglob
+    # Not setfiles (recurses into the image) or restorecon (no-op before policy load).
+    # The initramfs has no chcon, the image does.
+    chroot /sysroot /usr/sbin/matchpathcon -f $fcontexts "${relabel[@]}" | while IFS=$'\t' read -r relpath context; do
+        # deleted files leave whiteouts in the upper layer
+        if [ "$context" != "<<none>>" ] && { [ -e "/sysroot$relpath" ] || [ -L "/sysroot$relpath" ]; }; then
+            chroot /sysroot chcon -h "$context" "$relpath"
+        fi
+    done
+fi
 exec /opt/confluent/bin/start_root
diff --git a/confluent_osdeploy/ubuntu20.04-diskless/initramfs/scripts/init-premount/confluent b/confluent_osdeploy/ubuntu20.04-diskless/initramfs/scripts/init-premount/confluent
index fbc50560..ff28b3e8 100644
--- a/confluent_osdeploy/ubuntu20.04-diskless/initramfs/scripts/init-premount/confluent
+++ b/confluent_osdeploy/ubuntu20.04-diskless/initramfs/scripts/init-premount/confluent
@@ -103,10 +103,59 @@ cd - > /dev/null
 mkdir -p /etc/ssl/certs
 cat /tls/*.pem > /etc/ssl/certs/ca-certificates.crt
 cat /tls/*.pem > /etc/confluent/ca.pem
+confluentsrv=$(sed -n 's/.*confluent=\([^ ]*\).*/\1/p' /proc/cmdline)
+DIDDHCP=0
 if [ -e /dev/disk/by-label/CNFLNT_MBI ]; then  # media based image
     mbimntpoint=$(mktemp -d)
     mount /dev/disk/by-label/CNFLNT_MBI $mbimntpoint
     echo 'EXTMGRINFO: media||1' > /etc/confluent/confluent.info
+elif [ ! -z "$confluentsrv" ]; then
+    touch /etc/confluent/confluent.info
+    myids=uuid=$(cat /sys/devices/virtual/dmi/id/product_uuid)
+    for mac in $(ip link | grep link/ether | awk '{print $2}'); do
+        myids=$myids"/mac="$mac
+    done
+    if echo $confluentsrv | grep : > /dev/null; then
+        myname=$(curl --cacert /etc/confluent/ca.pem -sf -H "CONFLUENT_IDS: $myids" https://[$confluentsrv]/confluent-api/self/whoami)
+    else
+        # the first nic with a link may not reach the server, try each until whoami answers
+        try=0
+        while [ $try -lt 30 ]; do
+            try=$((try + 1))
+            for ifname in /sys/class/net/*; do
+                ifname=${ifname##*/}
+                [ "$(cat /sys/class/net/$ifname/carrier 2> /dev/null)" = 1 ] || continue
+                [ "$(cat /sys/class/net/$ifname/type)" = 1 ] || continue  # ethernet only
+                echo -n "Attempting to use dhcp to bring up $ifname..."
+                # 24.04 and newer have dhcpcd in the initramfs, older ones only ipconfig
+                if command -v dhcpcd > /dev/null; then
+                    dhcpcd -1KL -4 -t 10 $ifname > /dev/null 2>&1
+                else
+                    ipconfig -t 10 $ifname > /dev/null 2>&1
+                fi
+                if ip -4 addr show dev $ifname scope global | grep -q inet; then
+                    echo "Complete"
+                    ip -4 addr show dev $ifname scope global | grep inet
+                    myname=$(curl --cacert /etc/confluent/ca.pem -sf --connect-timeout 10 --max-time 30 -H "CONFLUENT_IDS: $myids" https://$confluentsrv/confluent-api/self/whoami)
+                    if [ ! -z "$myname" ]; then
+                        DIDDHCP=1
+                        break 2
+                    fi
+                    echo "No answer from $confluentsrv on $ifname"
+                else
+                    echo "No lease on $ifname"
+                fi
+                ip -4 addr flush dev $ifname
+                rm -f /run/net-$ifname.conf
+            done
+            sleep 1
+        done
+    fi
+    if [ ! -z "$myname" ]; then
+        echo NODENAME: $myname > /etc/confluent/confluent.info
+        echo MANAGER: $confluentsrv >> /etc/confluent/confluent.info
+        echo EXTMGRINFO: $confluentsrv'||1' >> /etc/confluent/confluent.info
+    fi
 else
     /opt/confluent/bin/copernicus -t > /etc/confluent/confluent.info
 fi
@@ -180,6 +229,11 @@ v4meth=$(grep ^ipv4_method: /etc/confluent/confluent.deploycfg|awk '{print $2}')
 if [ "$v4meth" = static ]; then
     v4addr=$(grep ^ipv4_address: /etc/confluent/confluent.deploycfg | awk '{print $2}')
     v4prefix=$(grep ^prefix: /etc/confluent/confluent.deploycfg | awk '{print $2}')
+    if [ "$DIDDHCP" = 1 ]; then
+        # the lease from the confluent= lookup would expire in the image
+        ip -4 addr flush dev $ifname
+        rm -f /run/net-$ifname.conf
+    fi
     ip addr add dev $ifname $v4addr/$v4prefix
     v4gw=$(grep ^ipv4_gateway: /etc/confluent/confluent.deploycfg | awk '{print $2}')
     if [ ! -z "$v4gw" -a "$v4gw" != "null" ]; then
diff --git a/imgutil/suse16/dracut/installkernel b/imgutil/suse16/dracut/installkernel
index 6130b7d4..8c6686d0 100644
--- a/imgutil/suse16/dracut/installkernel
+++ b/imgutil/suse16/dracut/installkernel
@@ -1,5 +1,6 @@
 #!/bin/bash
 instmods nfsv3 nfs_acl nfsv4 dns_resolver lockd fscache sunrpc
+instmods af_packet  # dhcpcd needs packet sockets, a module on SUSE
 instmods e1000 e1000e igb sfc mlx5_ib mlx5_core mlx4_en cxgb3 cxgb4 tg3 bnx2 bnx2x bna ixgb ixgbe qlge mptsas mpt2sas mpt3sas megaraid_sas ahci xhci-hcd sd_mod pmcraid be2net vfat ext3 ext4 usb_storage scsi_wait_scan ipmi_si ipmi_devintf qlcnic xfs
 instmods nvme
 instmods cdc_ether r8152