diff --git a/.gitignore b/.gitignore
index 95bb841f..91961534 100644
--- a/.gitignore
+++ b/.gitignore
@@ -40,6 +40,7 @@ prog/weaveproxy/weaveproxy
 prog/sigproxy/sigproxy
 prog/weavewait/weavewait
 prog/netcheck/netcheck
+prog/docker_tls_args/docker_tls_args
 testing/cover/cover
 testing/runner/runner
 tools/bin
@@ -55,6 +56,7 @@ prog/weaveexec/weaveproxy
 prog/weaveexec/weavewait
 prog/weaveexec/sigproxy
 prog/weaveexec/netcheck
+prog/weaveexec/docker_tls_args
 prog/weaveexec/docker*.tgz
 Vagrantfile.local
 test/tls/*.pem
diff --git a/Makefile b/Makefile
index cbbd0f83..c375a7ab 100644
--- a/Makefile
+++ b/Makefile
@@ -15,10 +15,11 @@ SIGPROXY_EXE=prog/sigproxy/sigproxy
 WEAVEWAIT_EXE=prog/weavewait/weavewait
 WEAVEHOSTS_EXE=prog/weavehosts/weavehosts
 NETCHECK_EXE=prog/netcheck/netcheck
+DOCKERTLSARGS_EXE=prog/docker_tls_args/docker_tls_args
 COVER_EXE=testing/cover/cover
 RUNNER_EXE=testing/runner/runner
 
-EXES=$(WEAVER_EXE) $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEHOSTS_EXE) $(NETCHECK_EXE) $(COVER_EXE) $(RUNNER_EXE)
+EXES=$(WEAVER_EXE) $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEHOSTS_EXE) $(NETCHECK_EXE) $(DOCKERTLSARGS_EXE) $(COVER_EXE) $(RUNNER_EXE)
 
 WEAVER_UPTODATE=.weaver.uptodate
 WEAVEEXEC_UPTODATE=.weaveexec.uptodate
@@ -79,8 +80,9 @@ $(WEAVEWAIT_EXE): prog/weavewait/main.go net/*.go
 $(WEAVEHOSTS_EXE): prog/weavehosts/weavehosts.go
 $(COVER_EXE): testing/cover/cover.go
 $(RUNNER_EXE): testing/runner/runner.go
+$(DOCKERTLSARGS_EXE): prog/docker_tls_args/*.go
 
-$(WEAVEWAIT_EXE) $(SIGPROXY_EXE) $(WEAVEHOSTS_EXE) $(COVER_EXE) $(RUNNER_EXE):
+$(WEAVEWAIT_EXE) $(SIGPROXY_EXE) $(WEAVEHOSTS_EXE) $(COVER_EXE) $(RUNNER_EXE) $(DOCKERTLSARGS_EXE):
 	go get ./$(@D)
 	go build -o $@ ./$(@D)
 
@@ -88,13 +90,14 @@ $(WEAVER_UPTODATE): prog/weaver/Dockerfile $(WEAVER_EXE)
 	$(SUDO) docker build -t $(WEAVER_IMAGE) prog/weaver
 	touch $@
 
-$(WEAVEEXEC_UPTODATE): prog/weaveexec/Dockerfile $(DOCKER_DISTRIB) weave $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEHOSTS_EXE) $(NETCHECK_EXE)
+$(WEAVEEXEC_UPTODATE): prog/weaveexec/Dockerfile $(DOCKER_DISTRIB) weave $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEHOSTS_EXE) $(NETCHECK_EXE) $(DOCKERTLSARGS_EXE)
 	cp weave prog/weaveexec/weave
 	cp $(SIGPROXY_EXE) prog/weaveexec/sigproxy
 	cp $(WEAVEPROXY_EXE) prog/weaveexec/weaveproxy
 	cp $(WEAVEWAIT_EXE) prog/weaveexec/weavewait
 	cp $(WEAVEHOSTS_EXE) prog/weaveexec/weavehosts
 	cp $(NETCHECK_EXE) prog/weaveexec/netcheck
+	cp $(DOCKERTLSARGS_EXE) prog/weaveexec/docker_tls_args
 	cp $(DOCKER_DISTRIB) prog/weaveexec/docker.tgz
 	$(SUDO) docker build -t $(WEAVEEXEC_IMAGE) prog/weaveexec
 	touch $@
diff --git a/prog/docker_tls_args/main.go b/prog/docker_tls_args/main.go
new file mode 100644
index 00000000..6560a3ea
--- /dev/null
+++ b/prog/docker_tls_args/main.go
@@ -0,0 +1,77 @@
+// docker_tls_args: find the docker daemon's tls args
+// This reimplements pgrep, because pgrep will only look in /proc, but not in
+// $PROCFS.
+package main
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+)
+
+func main() {
+	procRoot := os.Getenv("PROCFS")
+	if procRoot == "" {
+		procRoot = "/proc"
+	}
+
+	dirEntries, err := ioutil.ReadDir(procRoot)
+	checkErr(err)
+
+	for _, dirEntry := range dirEntries {
+		dirName := dirEntry.Name()
+		if _, err := strconv.Atoi(dirName); err != nil {
+			continue
+		}
+
+		if comm, err := ioutil.ReadFile(filepath.Join(procRoot, dirName, "comm")); err != nil || string(comm) != "docker\n" {
+			continue
+		}
+
+		cmdline, err := ioutil.ReadFile(filepath.Join(procRoot, dirName, "cmdline"))
+		if err != nil {
+			continue
+		}
+
+		isDaemon := false
+		tlsArgs := []string{}
+		args := bytes.Split(cmdline, []byte{'\000'})
+		for i := 0; i < len(args); i++ {
+			arg := string(args[i])
+			switch {
+			case arg == "-d":
+				isDaemon = true
+				break
+			case arg == "--tls", arg == "--tlsverify":
+				tlsArgs = append(tlsArgs, arg)
+			case strings.HasPrefix(arg, "--tls"):
+				tlsArgs = append(tlsArgs, arg)
+				if len(args) > i+1 &&
+					!strings.Contains(arg, "=") &&
+					!strings.HasPrefix(string(args[i+1]), "-") {
+					tlsArgs = append(tlsArgs, string(args[i+1]))
+					i++
+				}
+			}
+		}
+		if !isDaemon {
+			continue
+		}
+
+		fmt.Println(strings.Join(tlsArgs, " "))
+		os.Exit(0)
+	}
+
+	os.Exit(1)
+}
+
+func checkErr(err error) {
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
diff --git a/prog/weaveexec/Dockerfile b/prog/weaveexec/Dockerfile
index 1d35b419..bb189584 100644
--- a/prog/weaveexec/Dockerfile
+++ b/prog/weaveexec/Dockerfile
@@ -18,6 +18,6 @@ RUN apk add --update \
   && rm -rf /var/cache/apk/*
 
 ADD ./weave ./sigproxy ./weaveproxy /home/weave/
-ADD ./netcheck ./weavehosts /usr/bin/
+ADD ./netcheck ./weavehosts ./docker_tls_args /usr/bin/
 ADD ./weavewait /w/w
 ADD ./docker.tgz /
diff --git a/weave b/weave
index 08a040be..70eae910 100755
--- a/weave
+++ b/weave
@@ -995,11 +995,7 @@ tls_arg() {
     PROXY_ARGS="$PROXY_ARGS $1 /home/weave/tls/$3.pem"
 }
 
-proxy_args() {
-    PROXY_VOLUMES=""
-    PROXY_ARGS=""
-    PROXY_TLS_ENABLED=""
-    PROXY_HOST=""
+proxy_parse_args() {
     while [ $# -gt 0 ]; do
         case "$1" in
           -H)
@@ -1042,10 +1038,20 @@ proxy_args() {
         esac
         shift
     done
+}
+
+proxy_args() {
+    PROXY_VOLUMES=""
+    PROXY_ARGS=""
+    PROXY_TLS_ENABLED=""
+    PROXY_HOST=""
+    proxy_parse_args "$@"
 
     if [ -z "$PROXY_HOST" -a -n "$CLIENT_TLS_ENABLED" -a -z "$PROXY_TLS_ENABLED" ] ; then
-      echo "When launching the proxy via TLS, -H and/or TLS options are required." >&2
-      exit 1
+      if ! proxy_parse_args $(docker_tls_args) ; then
+        echo "When launching the proxy via TLS, -H and/or TLS options are required." >&2
+        exit 1
+      fi
     fi
     if [ -z "$PROXY_HOST" ] ; then
       case "$DOCKER_CLIENT_HOST" in