diff --git a/chrootarchive/archive.go b/chrootarchive/archive.go
index fc2bea2..8d139fa 100644
--- a/chrootarchive/archive.go
+++ b/chrootarchive/archive.go
@@ -6,6 +6,7 @@ import (
 	"flag"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
 	"runtime"
 	"strings"
@@ -33,6 +34,10 @@ func untar() {
 	if err := archive.Untar(os.Stdin, "/", options); err != nil {
 		fatal(err)
 	}
+	// fully consume stdin in case it is zero padded
+	if _, err := ioutil.ReadAll(os.Stdin); err != nil {
+		fatal(err)
+	}
 	os.Exit(0)
 }
 
diff --git a/chrootarchive/archive_test.go b/chrootarchive/archive_test.go
index 69e18e3..8477c06 100644
--- a/chrootarchive/archive_test.go
+++ b/chrootarchive/archive_test.go
@@ -1,10 +1,12 @@
 package chrootarchive
 
 import (
+	"io"
 	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
+	"time"
 
 	"github.com/docker/docker/pkg/archive"
 	"github.com/docker/docker/pkg/reexec"
@@ -42,3 +44,42 @@ func TestChrootTarUntar(t *testing.T) {
 		t.Fatal(err)
 	}
 }
+
+type slowEmptyTarReader struct {
+	size      int
+	offset    int
+	chunkSize int
+}
+
+// Read is a slow reader of an empty tar (like the output of "tar c --files-from /dev/null")
+func (s *slowEmptyTarReader) Read(p []byte) (int, error) {
+	time.Sleep(100 * time.Millisecond)
+	count := s.chunkSize
+	if len(p) < s.chunkSize {
+		count = len(p)
+	}
+	for i := 0; i < count; i++ {
+		p[i] = 0
+	}
+	s.offset += count
+	if s.offset > s.size {
+		return count, io.EOF
+	}
+	return count, nil
+}
+
+func TestChrootUntarEmptyArchiveFromSlowReader(t *testing.T) {
+	tmpdir, err := ioutil.TempDir("", "docker-TestChrootUntarEmptyArchiveFromSlowReader")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(tmpdir)
+	dest := filepath.Join(tmpdir, "dest")
+	if err := os.MkdirAll(dest, 0700); err != nil {
+		t.Fatal(err)
+	}
+	stream := &slowEmptyTarReader{size: 10240, chunkSize: 1024}
+	if err := Untar(stream, dest, nil); err != nil {
+		t.Fatal(err)
+	}
+}