diff --git a/common/container-puppet.sh b/common/container-puppet.sh
index 91c964019c..190c3e9b1d 100644
--- a/common/container-puppet.sh
+++ b/common/container-puppet.sh
@@ -24,7 +24,11 @@ if [ -n "$PUPPET_TAGS" ]; then
 fi
 
 if [ ! -z ${STEP_CONFIG+x} ]; then
-    echo -e "${STEP_CONFIG}" | tee /etc/config.pp
+    # package and service should NOT be managed inside containers
+    echo -e "noop_resource('package')" | tee /etc/config.pp
+    echo -e "noop_resource('service')" | tee -a /etc/config.pp
+
+    echo -e "${STEP_CONFIG}" | tee -a /etc/config.pp
 fi
 
 CHECK_MODE=""
diff --git a/deployment/containers-common.yaml b/deployment/containers-common.yaml
index a702f0bc90..dcbec5228b 100644
--- a/deployment/containers-common.yaml
+++ b/deployment/containers-common.yaml
@@ -80,7 +80,7 @@ outputs:
               --color=false \
               --modulepath /etc/puppet/modules:/opt/stack/puppet-modules:/usr/share/openstack-puppet/modules \
               --tags $TAGS \
-              -e "noop_resource('package'); ${CONFIG}"
+              -e "noop_resource('package'); noop_resource('service') ;${CONFIG}"
           rc=$?
           set -e
           set +ux
diff --git a/deployment/swift/swift-storage-container-puppet.yaml b/deployment/swift/swift-storage-container-puppet.yaml
index 3822ffe214..a2dda440ce 100644
--- a/deployment/swift/swift-storage-container-puppet.yaml
+++ b/deployment/swift/swift-storage-container-puppet.yaml
@@ -274,7 +274,6 @@ outputs:
             - "\n"
             - - "class xinetd() {}"
               - "define xinetd::service($bind='',$port='',$server='',$server_args='') {}"
-              - "noop_resource('service')"
               - "include tripleo::profile::base::swift::storage"
         config_image: {get_attr: [RoleParametersValue, value, ContainerSwiftConfigImage]}
       kolla_config: