diff --git a/roles/keystone/files/Dockerfile b/roles/keystone/files/Dockerfile
index eb9425e..c233e82 100644
--- a/roles/keystone/files/Dockerfile
+++ b/roles/keystone/files/Dockerfile
@@ -4,12 +4,16 @@
 # run keystone-manage db_sync from this docker first:
 # $ docker run hpc/keystone --add-host=mariadb:<ip mariadb> "keystone-manage db_sync"
 
-# wellicht ubuntu 16.04 of anders 18.04
-FROM ubuntu:zesty
+FROM ubuntu:16.04
 
-RUN apt-get update
+RUN apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 5EDB1B62EC4926EA
 
-RUN apt-get install --yes keystone python-openstackclient
+RUN set -x \
+    && echo "deb http://ubuntu-cloud.archive.canonical.com/ubuntu xenial-updates/ocata main" > /etc/apt/sources.list.d/ocata.list \
+    && apt-get -y update \
+    && apt-get -y install \
+    && apt-get -y install keystone python-openstackclient \
+    && apt-get -y clean
 
 # set admin token TODO: make this a secret
 # in volume of met env