diff --git a/.gitignore b/.gitignore
index 149f18ed..d58ded87 100644
--- a/.gitignore
+++ b/.gitignore
@@ -32,6 +32,7 @@ coverage.html
 # Project specific
 weaver/weaver
 weavedns/weavedns
+sigproxy/sigproxy
 tools/bin
 tools/build
 releases
@@ -39,4 +40,5 @@ weave.tar
 weavedns.tar
 weaveexec.tar
 weaveexec/weave
+weaveexec/sigproxy
 weaveexec/docker*.tgz
diff --git a/Makefile b/Makefile
index 6b6a0d9d..496eb684 100644
--- a/Makefile
+++ b/Makefile
@@ -10,6 +10,7 @@ DOCKERHUB_USER=zettio
 WEAVE_VERSION=git-$(shell git rev-parse --short=12 HEAD)
 WEAVER_EXE=weaver/weaver
 WEAVEDNS_EXE=weavedns/weavedns
+SIGPROXY_EXE=sigproxy/sigproxy
 WEAVER_IMAGE=$(DOCKERHUB_USER)/weave
 WEAVEDNS_IMAGE=$(DOCKERHUB_USER)/weavedns
 WEAVEEXEC_IMAGE=$(DOCKERHUB_USER)/weaveexec
@@ -43,6 +44,11 @@ $(WEAVER_EXE) $(WEAVEDNS_EXE): common/*.go
 $(WEAVER_EXE): router/*.go weaver/main.go
 $(WEAVEDNS_EXE): nameserver/*.go weavedns/main.go
 
+# Sigproxy needs separate rule as it fails the netgo check in the main
+# build stanza due to not importing net package
+$(SIGPROXY_EXE): sigproxy/main.go
+	go build -o $@ ./$(shell dirname $@)
+
 $(WEAVER_EXPORT): weaver/Dockerfile $(WEAVER_EXE)
 	$(SUDO) docker build -t $(WEAVER_IMAGE) weaver
 	$(SUDO) docker save $(WEAVER_IMAGE):latest > $@
@@ -51,8 +57,9 @@ $(WEAVEDNS_EXPORT): weavedns/Dockerfile $(WEAVEDNS_EXE)
 	$(SUDO) docker build -t $(WEAVEDNS_IMAGE) weavedns
 	$(SUDO) docker save $(WEAVEDNS_IMAGE):latest > $@
 
-$(WEAVEEXEC_EXPORT): weaveexec/Dockerfile $(DOCKER_DISTRIB) weave
+$(WEAVEEXEC_EXPORT): weaveexec/Dockerfile $(DOCKER_DISTRIB) weave $(SIGPROXY_EXE)
 	cp weave weaveexec/weave
+	cp sigproxy/sigproxy weaveexec/sigproxy
 	cp $(DOCKER_DISTRIB) weaveexec/docker.tgz
 	$(SUDO) docker build -t $(WEAVEEXEC_IMAGE) weaveexec
 	$(SUDO) docker save $(WEAVEEXEC_IMAGE):latest > $@
@@ -81,7 +88,7 @@ publish: $(PUBLISH)
 
 clean:
 	-$(SUDO) docker rmi $(WEAVER_IMAGE) $(WEAVEDNS_IMAGE) $(WEAVEEXEC_IMAGE)
-	rm -f $(WEAVER_EXE) $(WEAVEDNS_EXE) $(WEAVER_EXPORT) $(WEAVEDNS_EXPORT) $(WEAVEEXEC_EXPORT)
+	rm -f $(WEAVER_EXE) $(WEAVEDNS_EXE) $(SIGPROXY_EXE) $(WEAVER_EXPORT) $(WEAVEDNS_EXPORT) $(WEAVEEXEC_EXPORT)
 
 build:
 	$(SUDO) go clean -i net
diff --git a/sigproxy/main.go b/sigproxy/main.go
new file mode 100644
index 00000000..99af2be3
--- /dev/null
+++ b/sigproxy/main.go
@@ -0,0 +1,50 @@
+package main
+
+import (
+	"log"
+	"os"
+	"os/exec"
+	"os/signal"
+	"syscall"
+)
+
+func main() {
+	if len(os.Args) == 1 {
+		log.Fatal("USAGE: sigproxy <command> [arguments ...]")
+	}
+
+	// Install signal handler as soon as possible - channel is buffered so
+	// we'll catch signals that arrive whilst child process is starting
+	sc := make(chan os.Signal, 1)
+	signal.Notify(sc, syscall.SIGINT, syscall.SIGTERM)
+
+	cmd := exec.Command(os.Args[1], os.Args[2:]...)
+
+	// These default to /dev/null, so set them explicitly to ours
+	cmd.Stdin = os.Stdin
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+
+	if err := cmd.Start(); err != nil {
+		log.Fatal(err)
+	}
+
+	// Only begin delivering signals after the child has started
+	go func() {
+		for {
+			// Signalling PID 0 delivers to our process group
+			syscall.Kill(0, (<-sc).(syscall.Signal))
+		}
+	}()
+
+	if err := cmd.Wait(); err != nil {
+		// Exit status is platform specific so not directly accessible - casts
+		// required to access system-dependent exit information
+		if exitErr, ok := err.(*exec.ExitError); ok {
+			waitStatus := exitErr.Sys().(syscall.WaitStatus)
+			os.Exit(waitStatus.ExitStatus())
+		}
+		os.Exit(1)
+	}
+	os.Exit(0)
+}
diff --git a/weave b/weave
index 0eb30edf..3bb5003e 100755
--- a/weave
+++ b/weave
@@ -52,7 +52,7 @@ DNS_IMAGE=$BASE_DNS_IMAGE:$IMAGE_VERSION
 EXEC_IMAGE=$BASE_EXEC_IMAGE:$IMAGE_VERSION
 
 exec_remote() {
-    docker run -t --rm \
+    docker run --rm \
         -v /var/run/docker.sock:/var/run/docker.sock \
         -v "$PROCFS":/hostproc \
         -e VERSION \
diff --git a/weaveexec/Dockerfile b/weaveexec/Dockerfile
index 408b3a75..54b32c7c 100644
--- a/weaveexec/Dockerfile
+++ b/weaveexec/Dockerfile
@@ -4,5 +4,6 @@ WORKDIR /home/weave
 RUN ["apk", "add", "--update", "ethtool", "conntrack-tools", "curl", "iptables", "iproute2"]
 RUN ["sh", "-c", "rm -rf /var/cache/apk/*"]
 ADD ./weave /home/weave/
+ADD ./sigproxy /home/weave/
 ADD ./docker.tgz /
-ENTRYPOINT ["/home/weave/weave"]
+ENTRYPOINT ["/home/weave/sigproxy", "/home/weave/weave"]