diff --git a/contrib/docker-integration/docker-compose.yml b/contrib/docker-integration/docker-compose.yml
index 4d4f3856..374197ac 100644
--- a/contrib/docker-integration/docker-compose.yml
+++ b/contrib/docker-integration/docker-compose.yml
@@ -64,7 +64,7 @@ registryv2tokenoauthnotls:
     - ./tokenserver-oauth/certs/signing.cert:/etc/docker/registry/tokenbundle.pem
 tokenserveroauth:
   build: "tokenserver-oauth"
-  command: "--debug -addr 0.0.0.0:5559 -issuer registry-test -passwd .htpasswd -tlscert tls.cert -tlskey tls.key -key sign.key -realm http://auth.localregistry:5559"
+  command: "--debug -addr 0.0.0.0:5559 -issuer registry-test -passwd .htpasswd -tlscert tls.cert -tlskey tls.key -key sign.key -realm http://auth.localregistry:5559 -enforce-class"
   ports:
     - "5559"
 malevolent:
diff --git a/contrib/docker-integration/golem.conf b/contrib/docker-integration/golem.conf
index 99c8d600..eb175707 100644
--- a/contrib/docker-integration/golem.conf
+++ b/contrib/docker-integration/golem.conf
@@ -1,6 +1,6 @@
 [[suite]]
   dind=true
-  images=[ "nginx:1.9", "dmcgowan/token-server:simple", "dmcgowan/token-server:oauth", "dmcgowan/malevolent:0.1.0" ]
+  images=[ "nginx:1.9", "dmcgowan/token-server:simple", "dmcgowan/token-server:oauth", "dmcgowan/malevolent:0.1.0", "dmcgowan/ncat:latest" ]
 
   [[suite.pretest]]
     command="sh ./install_certs.sh /etc/generated_certs.d"
diff --git a/contrib/docker-integration/plugins.bats b/contrib/docker-integration/plugins.bats
new file mode 100644
index 00000000..3b1d9aa4
--- /dev/null
+++ b/contrib/docker-integration/plugins.bats
@@ -0,0 +1,101 @@
+#!/usr/bin/env bats
+
+# This tests pushing and pulling plugins
+
+load helpers
+
+user="testuser"
+password="testpassword"
+base="hello-world"
+
+#TODO: Create plugin image
+function create_plugin() {
+	plugindir=$(mktemp -d)
+
+	cat - > $plugindir/config.json <<CONFIGJSON
+{
+	"manifestVersion": "v0",
+	"description": "A test plugin for integration tests",
+	"entrypoint": ["/usr/bin/ncat", "-l", "-U", "//run/docker/plugins/plugin.sock"],
+	"interface" : {
+		"types": ["docker.volumedriver/1.0"],
+		"socket": "plugin.sock"
+	}
+}
+CONFIGJSON
+
+	cid=$(docker create dmcgowan/ncat:latest /bin/sh)
+
+	mkdir $plugindir/rootfs
+
+	docker export $cid | tar -x -C $plugindir/rootfs
+
+	daemontmp=$(docker exec dockerdaemon mktemp -d)
+
+	tar -c -C $plugindir . | docker exec -i dockerdaemon tar -x -C $daemontmp
+
+	docker exec dockerdaemon docker plugin create $1 $daemontmp
+
+	docker exec dockerdaemon rm -rf $daemontmp
+
+	rm -rf $plugindir
+}
+
+@test "Test plugin push and pull" {
+	version_check docker "$GOLEM_DIND_VERSION" "1.13.0-rc3"
+	version_check docker "$GOLEM_DISTRIBUTION_VERSION" "2.6.0"
+
+	login_oauth localregistry:5558
+	image="localregistry:5558/testuser/plugin1"
+
+	create_plugin $image
+
+	run docker_t plugin push $image
+	echo $output
+	[ "$status" -eq 0 ]
+
+	docker_t plugin rm $image
+
+	docker_t plugin install --grant-all-permissions $image
+}
+
+@test "Test plugin push and failed image pull" {
+	version_check docker "$GOLEM_DIND_VERSION" "1.13.0-rc3"
+	version_check docker "$GOLEM_DISTRIBUTION_VERSION" "2.6.0"
+
+
+	login_oauth localregistry:5558
+	image="localregistry:5558/testuser/plugin-not-image"
+
+	create_plugin $image
+
+	run docker_t plugin push $image
+	echo $output
+	[ "$status" -eq 0 ]
+
+	docker_t plugin rm $image
+
+	run docker_t pull $image
+
+	[ "$status" -ne 0 ]
+}
+
+@test "Test image push and failed plugin pull" {
+	version_check docker "$GOLEM_DIND_VERSION" "1.13.0-rc3"
+	version_check docker "$GOLEM_DISTRIBUTION_VERSION" "2.6.0"
+
+	login_oauth localregistry:5558
+	image="localregistry:5558/testuser/image-not-plugin"
+
+	build $image "$base:latest"
+
+	run docker_t push $image
+	echo $output
+	[ "$status" -eq 0 ]
+
+	docker_t rmi $image
+
+	run docker_t plugin install --grant-all-permissions $image
+
+	[ "$status" -ne 0 ]
+}
diff --git a/contrib/docker-integration/tokenserver-oauth/Dockerfile b/contrib/docker-integration/tokenserver-oauth/Dockerfile
index d8c7b5cc..5b607132 100644
--- a/contrib/docker-integration/tokenserver-oauth/Dockerfile
+++ b/contrib/docker-integration/tokenserver-oauth/Dockerfile
@@ -1,4 +1,4 @@
-FROM dmcgowan/token-server:oauth
+FROM dmcgowan/token-server@sha256:5a6f76d3086cdf63249c77b521108387b49d85a30c5e1c4fe82fdf5ae3b76ba7
 
 WORKDIR /
 
diff --git a/contrib/docker-integration/tokenserver/Dockerfile b/contrib/docker-integration/tokenserver/Dockerfile
index 34524687..762330cd 100644
--- a/contrib/docker-integration/tokenserver/Dockerfile
+++ b/contrib/docker-integration/tokenserver/Dockerfile
@@ -1,4 +1,4 @@
-FROM dmcgowan/token-server:simple
+FROM dmcgowan/token-server@sha256:0eab50ebdff5b6b95b3addf4edbd8bd2f5b940f27b41b43c94afdf05863a81af
 
 WORKDIR /