diff --git a/docker/dnsmasq/extend_start.sh b/docker/dnsmasq/extend_start.sh
index c09ce03273..0c9734fa19 100644
--- a/docker/dnsmasq/extend_start.sh
+++ b/docker/dnsmasq/extend_start.sh
@@ -1,5 +1,8 @@
 #!/bin/bash
 
+DNSMASQ_PIDFILE=${DNSMASQ_PIDFILE:-/run/ironic/dnsmasq.pid}
+DNSMASQ_PIDFILE_DIR="$(dirname $DNSMASQ_PIDFILE)"
+
 if [[ ! -d "/var/log/kolla/ironic" ]]; then
     mkdir -p /var/log/kolla/ironic
 fi
@@ -10,3 +13,19 @@ if [[ ! -r "/var/log/kolla/ironic/dnsmasq.log" ]]; then
     touch /var/log/kolla/ironic/dnsmasq.log
     chown ironic:ironic /var/log/kolla/ironic/dnsmasq.log
 fi
+
+if [[ ! -d "$DNSMASQ_PIDFILE_DIR" ]]; then
+    mkdir -p "$DNSMASQ_PIDFILE_DIR"
+fi
+
+# NOTE(wszumski): This writes the PID of dnsmasq out to a file. The PIDFILE can be used in
+# another container to send a signal to dnsmasq to reload its config (providing that the two
+# containers share a PID namespace). The concrete use case is for the Ironic PXE filter to
+# clean up stale host entries on startup as documented in:
+#
+# https://docs.openstack.org/ironic/latest/admin/inspection/pxe_filter.html
+#
+# We cannot use the pid-file option in dnsmasq, since it will only write the PIDFILE if you
+# run dnsmasq in its non-forking mode i.e you do use the --no-daemon or --keep-in-foreground
+# options.
+echo $$ > "$DNSMASQ_PIDFILE"
diff --git a/docker/ironic/ironic-pxe-filter/Dockerfile.j2 b/docker/ironic/ironic-pxe-filter/Dockerfile.j2
new file mode 100644
index 0000000000..b8bc2cc636
--- /dev/null
+++ b/docker/ironic/ironic-pxe-filter/Dockerfile.j2
@@ -0,0 +1,24 @@
+FROM {{ namespace }}/{{ image_prefix }}ironic-base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build_date }}"
+{% endblock %}
+
+{% block ironic_pxe_filter_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% set ironic_pxe_filter_packages = [] %}
+
+{% set ironic_pxe_filter_pip_packages = [] %}
+
+RUN {{ macros.install_pip(ironic_pxe_filter_pip_packages | customizable("pip_packages")) }}
+
+{{ macros.install_packages(ironic_pxe_filter_packages | customizable("packages")) }}
+
+{{ macros.kolla_patch_sources() }}
+
+COPY extend_start.sh /usr/local/bin/kolla_ironic_extend_start
+RUN chmod 644 /usr/local/bin/kolla_ironic_extend_start
+
+{% block ironic_pxe_filter_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/docker/ironic/ironic-pxe-filter/extend_start.sh b/docker/ironic/ironic-pxe-filter/extend_start.sh
new file mode 100644
index 0000000000..c7a807c8d6
--- /dev/null
+++ b/docker/ironic/ironic-pxe-filter/extend_start.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+IRONIC_DHCP_HOSTS_DIR=${IRONIC_DHCP_HOSTS_DIR:-/etc/dnsmasq/dhcp-hostsdir}
+DNSMASQ_PIDFILE=${DNSMASQ_PIDFILE:-/run/ironic/dnsmasq.pid}
+
+# NOTE(wszumski): This container must be in same process namespace as dnsmasq
+rm -f $IRONIC_DHCP_HOSTS_DIR/* && kill -HUP $(cat "$DNSMASQ_PIDFILE") || true
diff --git a/releasenotes/notes/ironic-pxe-filter-b3b29090b0661ca2.yaml b/releasenotes/notes/ironic-pxe-filter-b3b29090b0661ca2.yaml
new file mode 100644
index 0000000000..ffe875c345
--- /dev/null
+++ b/releasenotes/notes/ironic-pxe-filter-b3b29090b0661ca2.yaml
@@ -0,0 +1,4 @@
+---
+features:
+  - |
+    Adds ``ironic-pxe-filter`` container image.