@@ -256,6 +256,12 @@ func (daemon *Daemon) verifyContainerSettings(hostConfig *containertypes.HostCon

 		return nil, fmt.Errorf("can't create 'AutoRemove' container with restart policy")

 	}

+	for _, extraHost := range hostConfig.ExtraHosts {

+		if _, err := opts.ValidateExtraHost(extraHost); err != nil {

+			return nil, err

+		}

+	}

+

 	for port := range hostConfig.PortBindings {

 		_, portStr := nat.SplitProtoPort(string(port))

 		if _, err := nat.ParsePort(portStr); err != nil {

@@ -16,6 +16,7 @@ import (

 	networktypes "github.com/docker/docker/api/types/network"

 	"github.com/docker/docker/container"

 	"github.com/docker/docker/daemon/network"

+	"github.com/docker/docker/opts"

 	"github.com/docker/docker/pkg/stringid"

 	"github.com/docker/docker/runconfig"

 	"github.com/docker/go-connections/nat"

@@ -117,6 +118,9 @@ func (daemon *Daemon) buildSandboxOptions(container *container.Container) ([]lib

 	for _, extraHost := range container.HostConfig.ExtraHosts {

 		// allow IPv6 addresses in extra hosts; only split on first ":"

+		if _, err := opts.ValidateExtraHost(extraHost); err != nil {

+			return nil, err

+		}

 		parts := strings.SplitN(extraHost, ":", 2)

 		sboxOptions = append(sboxOptions, libnetwork.OptionExtraHost(parts[0], parts[1]))

 	}