  	// TODO(euank): This has significant security concerns as a stage1 image is
  	// effectively root.
  	// Furthermore, this (using an annotation) is a hack to pass an extra
-@@ -1128,6 +1130,24 @@ func constructSyslogIdentifier(generateName string, podName string) string {
+@@ -1148,6 +1150,23 @@ func constructSyslogIdentifier(generateName string, podName string) string {
  	return podName
  }
  
 +// Setup additional systemd field specified in the Pod Annotation
-+func setupSystemdCustomFields(annotations map[string]string, unitOptionArray *[]*unit.UnitOption) error {
-+
++func setupSystemdCustomFields(annotations map[string]string, unitOptionArray []*unit.UnitOption) ([]*unit.UnitOption, error) {
 +	// LimitNOFILE
 +	if strSize := annotations[k8sRktLimitNoFileAnno]; strSize != "" {
 +		size, err := strconv.Atoi(strSize)
 +		if err != nil {
-+			return err
++			return unitOptionArray, err
 +		}
 +		if size < 1 {
-+			return fmt.Errorf("invalid value for %s: %s", k8sRktLimitNoFileAnno, strSize)
++			return unitOptionArray, fmt.Errorf("invalid value for %s: %s", k8sRktLimitNoFileAnno, strSize)
 +		}
-+		*unitOptionArray = append(*unitOptionArray, newUnitOption("Service", "LimitNOFILE", strSize))
++		unitOptionArray = append(unitOptionArray, newUnitOption("Service", "LimitNOFILE", strSize))
 +	}
 +
-+	return nil
++	return unitOptionArray, nil
 +}
 +
  // preparePod will:
  //
  // 1. Invoke 'rkt prepare' to prepare the pod, and get the rkt pod uuid.
-@@ -1214,6 +1234,11 @@ func (r *Runtime) preparePod(pod *v1.Pod, podIP string, pullSecrets []v1.Secret,
+@@ -1235,6 +1254,11 @@ func (r *Runtime) preparePod(pod *v1.Pod, podIP string, pullSecrets []v1.Secret,
  		units = append(units, newUnitOption("Service", "SELinuxContext", selinuxContext))
  	}
  
-+	err = setupSystemdCustomFields(pod.Annotations, &units)
++	units, err = setupSystemdCustomFields(pod.Annotations, units)
 +	if err != nil {
 +		glog.Warningf("fail to add custom systemd fields provided by pod Annotations: %q", err)
 +	}

 	glog.V(4).Infof("rkt: Creating service file %q for pod %q", serviceName, format.Pod(pod))
 	serviceFile, err := r.os.Create(serviceFilePath(serviceName))
diff --git a/pkg/kubelet/rkt/rkt_test.go b/pkg/kubelet/rkt/rkt_test.go
index d38a48c..eded9ed 100644
--- a/pkg/kubelet/rkt/rkt_test.go
+++ b/pkg/kubelet/rkt/rkt_test.go
@@ -28,6 +28,7 @@ import (

 	rktapi "github.com/coreos/rkt/api/v1alpha"
 	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
@@ -2075,3 +2076,53 @@ func TestGetPodSystemdServiceFiles(t *testing.T) {
 		}
 	}
 }
+
+func TestSetupSystemdCustomFields(t *testing.T) {
+	testCases := []struct {
+		unitOpts       []*unit.UnitOption
+		podAnnotations map[string]string
