diff --git a/xos/synchronizer/Dockerfile.synchronizer b/xos/synchronizer/Dockerfile.synchronizer
index 93e7ac7..d6dea27 100644
--- a/xos/synchronizer/Dockerfile.synchronizer
+++ b/xos/synchronizer/Dockerfile.synchronizer
@@ -6,4 +6,4 @@
 
 WORKDIR "/opt/xos/synchronizers/openstack"
 
-CMD bash -c "cd /opt/xos/synchronizers/openstack; ./run-from-api.sh"
+CMD bash -c "update-ca-certificates; cd /opt/xos/synchronizers/openstack; ./run-from-api.sh"
diff --git a/xos/synchronizer/model_policies/model_policy_Image.py b/xos/synchronizer/model_policies/model_policy_Image.py
index 6d6982e..7e1a6f3 100644
--- a/xos/synchronizer/model_policies/model_policy_Image.py
+++ b/xos/synchronizer/model_policies/model_policy_Image.py
@@ -5,7 +5,7 @@
         # container images do not get instantiated
         return
 
-    controller_images = ControllerImages.objects.filter(image=image)
+    controller_images = ControllerImages.objects.filter(image_id=image.id)
     existing_controllers = [cs.controller for cs in controller_images] 
     
     all_controllers = Controller.objects.all() 
diff --git a/xos/synchronizer/model_policies/model_policy_Slice.py b/xos/synchronizer/model_policies/model_policy_Slice.py
index 953d2c9..68aa596 100644
--- a/xos/synchronizer/model_policies/model_policy_Slice.py
+++ b/xos/synchronizer/model_policies/model_policy_Slice.py
@@ -20,13 +20,14 @@
     # slice = Slice.get(slice_id)
 
     controller_slices = ControllerSlice.objects.filter(slice_id=slice.id)
-    existing_controllers = [cs.controller for cs in controller_slices] 
-        
+    existing_controllers = [cs.controller for cs in controller_slices]
+    existing_controllers_ids = [x.id for x in existing_controllers]
+
     print "MODEL POLICY: slice existing_controllers=", existing_controllers
 
     all_controllers = Controller.objects.all()
     for controller in all_controllers:
-        if controller not in existing_controllers:
+        if controller.id not in existing_controllers_ids:
             print "MODEL POLICY: slice adding controller", controller
             sd = ControllerSlice(slice=slice, controller=controller)
             sd.save()
diff --git a/xos/synchronizer/openstack_from_api_config b/xos/synchronizer/openstack_from_api_config
index 9c37359..486e848 100644
--- a/xos/synchronizer/openstack_from_api_config
+++ b/xos/synchronizer/openstack_from_api_config
@@ -4,6 +4,10 @@
 [nova]
 ca_ssl_cert=/etc/ssl/certs/ca-certificates.crt
 
+[log]
+file=console
+level=debug
+
 # Sets options for the synchronizer
 [observer]
 name=openstack
@@ -20,6 +24,7 @@
 accessor_kind=api
 accessor_password=@/opt/xos/services/openstack/credentials/xosadmin@opencord.org
 images_directory=/opt/xos/images
+required_models=ControllerImages,ControllerNetwork,ControllerSitePrivilege,ControllerSite,ControllerSlicePrivilege,ControllerSlice,ControllerUser,Image,Instance,Port,Role
 
 [networking]
 use_vtn=True
diff --git a/xos/synchronizer/steps/sync_controller_networks.py b/xos/synchronizer/steps/sync_controller_networks.py
index 8187e84..329bb57 100644
--- a/xos/synchronizer/steps/sync_controller_networks.py
+++ b/xos/synchronizer/steps/sync_controller_networks.py
@@ -102,7 +102,7 @@
         controller_network.subnet_id = subnet_id
 	controller_network.backend_status = '1 - OK'
         if not controller_network.segmentation_id:
-            controller_network.segmentation_id = self.get_segmentation_id(controller_network)
+            controller_network.segmentation_id = str(self.get_segmentation_id(controller_network))
         controller_network.save()
 
 
diff --git a/xos/synchronizer/steps/sync_instances.py b/xos/synchronizer/steps/sync_instances.py
index c43498f..bb6c665 100644
--- a/xos/synchronizer/steps/sync_instances.py
+++ b/xos/synchronizer/steps/sync_instances.py
@@ -100,9 +100,10 @@
         if (instance.numberCores):
             metadata_update["cpu_cores"] = str(instance.numberCores)
 
-        for tag in instance.slice.tags.all():
-            if tag.name.startswith("sysctl-"):
-                metadata_update[tag.name] = tag.value
+# not supported by API... assuming it's not used ... look into enabling later
+#        for tag in instance.slice.tags.all():
+#            if tag.name.startswith("sysctl-"):
+#                metadata_update[tag.name] = tag.value
 
 	slice_memberships = SlicePrivilege.objects.filter(slice_id=instance.slice.id)
         pubkeys = set([sm.user.public_key for sm in slice_memberships if sm.user.public_key])
@@ -195,6 +196,9 @@
         if instance.userData:
             userData += instance.userData
 
+        # make sure nics is pickle-able
+        sanitized_nics = [{"kind": nic["kind"], "value": nic["value"]} for nic in nics]
+
         controller = instance.node.site_deployment.controller
         fields = {'endpoint':controller.auth_url,
                      'endpoint_v3': controller.auth_url_v3,
@@ -209,7 +213,7 @@
                      'availability_zone': availability_zone_filter,
                      'image_name':image_name,
                      'flavor_name':instance.flavor.name,
-                     'nics':nics,
+                     'nics':sanitized_nics,
                      'meta':metadata_update,
                      'user_data':r'%s'%escape(userData)}
         return fields