diff --git a/cluster/saltbase/salt/etcd/etcd.manifest b/cluster/saltbase/salt/etcd/etcd.manifest
index f263eb5d04..8b4130f886 100644
--- a/cluster/saltbase/salt/etcd/etcd.manifest
+++ b/cluster/saltbase/salt/etcd/etcd.manifest
@@ -8,6 +8,11 @@
     {
     "name": "etcd-container",
     "image": "gcr.io/google_containers/etcd:2.0.12",
+    "resources": {
+      "limits": {
+        "cpu": "200m"
+      }
+    },
     "command": [
               "/bin/sh",
               "-c",
diff --git a/cluster/saltbase/salt/kube-apiserver/kube-apiserver.manifest b/cluster/saltbase/salt/kube-apiserver/kube-apiserver.manifest
index 07162880a6..24b8b04b2c 100644
--- a/cluster/saltbase/salt/kube-apiserver/kube-apiserver.manifest
+++ b/cluster/saltbase/salt/kube-apiserver/kube-apiserver.manifest
@@ -98,6 +98,11 @@
     {
     "name": "kube-apiserver",
     "image": "gcr.io/google_containers/kube-apiserver:{{pillar['kube-apiserver_docker_tag']}}",
+    "resources": {
+      "limits": {
+        "cpu": "200m"
+      }
+    },
     "command": [
                  "/bin/sh",
                  "-c",
diff --git a/cluster/saltbase/salt/kube-controller-manager/kube-controller-manager.manifest b/cluster/saltbase/salt/kube-controller-manager/kube-controller-manager.manifest
index c16eb803c9..3303c2f0bc 100644
--- a/cluster/saltbase/salt/kube-controller-manager/kube-controller-manager.manifest
+++ b/cluster/saltbase/salt/kube-controller-manager/kube-controller-manager.manifest
@@ -46,6 +46,11 @@
     {
     "name": "kube-controller-manager",
     "image": "gcr.io/google_containers/kube-controller-manager:{{pillar['kube-controller-manager_docker_tag']}}",
+    "resources": {
+      "limits": {
+        "cpu": "200m"
+      }
+    },
     "command": [
                  "/bin/sh",
                  "-c",
diff --git a/cluster/saltbase/salt/kube-scheduler/kube-scheduler.manifest b/cluster/saltbase/salt/kube-scheduler/kube-scheduler.manifest
index 0c0a625a84..d8ad3608b9 100644
--- a/cluster/saltbase/salt/kube-scheduler/kube-scheduler.manifest
+++ b/cluster/saltbase/salt/kube-scheduler/kube-scheduler.manifest
@@ -8,6 +8,11 @@
     {
     "name": "kube-scheduler",
     "image": "gcr.io/google_containers/kube-scheduler:{{pillar['kube-scheduler_docker_tag']}}",
+    "resources": {
+      "limits": {
+        "cpu": "200m"
+      }
+    },
     "command": [
                  "/bin/sh",
                  "-c",
diff --git a/cluster/saltbase/salt/nginx/nginx.json b/cluster/saltbase/salt/nginx/nginx.json
index 0ddd23d848..44c41c27d1 100644
--- a/cluster/saltbase/salt/nginx/nginx.json
+++ b/cluster/saltbase/salt/nginx/nginx.json
@@ -8,6 +8,11 @@
     {
     "name": "nginx",
     "image": "gcr.io/google-containers/nginx:v1",
+    "resources": {
+      "limits": {
+        "cpu": "200m"
+      }
+    },
     "command": [
               "nginx",
 	      "-g",
diff --git a/pkg/kubelet/dockertools/docker.go b/pkg/kubelet/dockertools/docker.go
index d0945931aa..fe3a145bec 100644
--- a/pkg/kubelet/dockertools/docker.go
+++ b/pkg/kubelet/dockertools/docker.go
@@ -306,8 +306,10 @@ func ConnectToDockerOrDie(dockerEndpoint string) DockerInterface {
 
 func milliCPUToShares(milliCPU int64) int64 {
 	if milliCPU == 0 {
-		// zero milliCPU means unset. Use kernel default.
-		return 0
+		// Docker converts zero milliCPU to unset, which maps to kernel default
+		// for unset: 1024. Return 2 here to really match kernel default for
+		// zero milliCPU.
+		return minShares
 	}
 	// Conceptually (milliCPU / milliCPUToCPU) * sharesPerCPU, but factored to improve rounding.
 	shares := (milliCPU * sharesPerCPU) / milliCPUToCPU