diff --git a/taskcluster/taskgraph/transforms/docker_image.py b/taskcluster/taskgraph/transforms/docker_image.py
index ad7cf4151ef7..bff7002f0c00 100644
--- a/taskcluster/taskgraph/transforms/docker_image.py
+++ b/taskcluster/taskgraph/transforms/docker_image.py
@@ -179,6 +179,8 @@ def fill_template(config, tasks):
                 'docker-in-docker': True,
                 'taskcluster-proxy': True,
                 'max-run-time': 7200,
+                # Retry on apt-get errors.
+                'retry-exit-status': [100],
             },
         }
         # Retry for 'funsize-update-generator' if exit status code is -1
diff --git a/taskcluster/taskgraph/transforms/job/debian_package.py b/taskcluster/taskgraph/transforms/job/debian_package.py
index f354c379ec97..0c4f11fb4b9d 100644
--- a/taskcluster/taskgraph/transforms/job/debian_package.py
+++ b/taskcluster/taskgraph/transforms/job/debian_package.py
@@ -82,6 +82,8 @@ def docker_worker_debian_package(config, job, taskdesc):
         repo=docker_repo,
         dist=run['dist'],
         date=run['snapshot'][:8])
+    # Retry on apt-get errors.
+    worker['retry-exit-status'] = [100]
 
     add_artifacts(config, job, taskdesc, path='/tmp/artifacts')
 
diff --git a/taskcluster/taskgraph/util/docker.py b/taskcluster/taskgraph/util/docker.py
index e078ec7676b7..541e03ba7300 100644
--- a/taskcluster/taskgraph/util/docker.py
+++ b/taskcluster/taskgraph/util/docker.py
@@ -104,7 +104,15 @@ def post_to_docker(tar, api_path, **kwargs):
         elif 'stream' in data:
             sys.stderr.write(data['stream'])
         elif 'error' in data:
-            raise Exception(data['error'])
+            sys.stderr.write('{}\n'.format(data['error']))
+            # Sadly, docker doesn't give more than a plain string for errors,
+            # so the best we can do to propagate the error code from the command
+            # that failed is to parse the error message...
+            errcode = 1
+            m = re.search(r'returned a non-zero code: (\d+)', data['error'])
+            if m:
+                errcode = int(m.group(1))
+            sys.exit(errcode)
         else:
             raise NotImplementedError(repr(data))
         sys.stderr.flush()