diff --git a/libcontainer/cgroups/systemd/v1.go b/libcontainer/cgroups/systemd/v1.go
index 2d85fdefd..2679b9993 100644
--- a/libcontainer/cgroups/systemd/v1.go
+++ b/libcontainer/cgroups/systemd/v1.go
@@ -267,7 +267,7 @@ func (m *legacyManager) joinCgroups(pid int) error {
 }
 
 func getSubsystemPath(c *configs.Cgroup, subsystem string) (string, error) {
-	mountpoint, err := cgroups.FindCgroupMountpoint(c.Path, subsystem)
+	mountpoint, err := cgroups.FindCgroupMountpoint("", subsystem)
 	if err != nil {
 		return "", err
 	}
@@ -406,7 +406,10 @@ func (m *legacyManager) Set(container *configs.Config) error {
 
 func enableKmem(c *configs.Cgroup) error {
 	path, err := getSubsystemPath(c, "memory")
-	if err != nil && !cgroups.IsNotFound(err) {
+	if err != nil {
+		if cgroups.IsNotFound(err) {
+			return nil
+		}
 		return err
 	}
 
diff --git a/libcontainer/integration/checkpoint_test.go b/libcontainer/integration/checkpoint_test.go
index c0047ff63..627a013f2 100644
--- a/libcontainer/integration/checkpoint_test.go
+++ b/libcontainer/integration/checkpoint_test.go
@@ -11,9 +11,6 @@ import (
 	"testing"
 
 	"github.com/opencontainers/runc/libcontainer"
-	"github.com/opencontainers/runc/libcontainer/configs"
-
-	"golang.org/x/sys/unix"
 )
 
 func showFile(t *testing.T, fname string) error {
@@ -76,20 +73,10 @@ func testCheckpoint(t *testing.T, userns bool) {
 	}
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
-
-	if userns {
-		config.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
-		config.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
-		config.Namespaces = append(config.Namespaces, configs.Namespace{Type: configs.NEWUSER})
-	} else {
-		config.Mounts = append(config.Mounts, &configs.Mount{
-			Destination: "/sys/fs/cgroup",
-			Device:      "cgroup",
-			Flags:       defaultMountFlags | unix.MS_RDONLY,
-		})
-	}
-
+	config := newTemplateConfig(&tParam{
+		rootfs: rootfs,
+		userns: userns,
+	})
 	factory, err := libcontainer.New(root, libcontainer.Cgroupfs)
 
 	if err != nil {
diff --git a/libcontainer/integration/exec_test.go b/libcontainer/integration/exec_test.go
index a4183b658..ffb2bb81a 100644
--- a/libcontainer/integration/exec_test.go
+++ b/libcontainer/integration/exec_test.go
@@ -41,12 +41,10 @@ func testExecPS(t *testing.T, userns bool) {
 	rootfs, err := newRootfs()
 	ok(t, err)
 	defer remove(rootfs)
-	config := newTemplateConfig(rootfs)
-	if userns {
-		config.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
-		config.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
-		config.Namespaces = append(config.Namespaces, configs.Namespace{Type: configs.NEWUSER})
-	}
+	config := newTemplateConfig(&tParam{
+		rootfs: rootfs,
+		userns: userns,
+	})
 
 	buffers, exitCode, err := runContainer(config, "", "ps", "-o", "pid,user,comm")
 	if err != nil {
@@ -78,7 +76,7 @@ func TestIPCPrivate(t *testing.T) {
 	l, err := os.Readlink("/proc/1/ns/ipc")
 	ok(t, err)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	buffers, exitCode, err := runContainer(config, "", "readlink", "/proc/self/ns/ipc")
 	ok(t, err)
 
@@ -103,7 +101,7 @@ func TestIPCHost(t *testing.T) {
 	l, err := os.Readlink("/proc/1/ns/ipc")
 	ok(t, err)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	config.Namespaces.Remove(configs.NEWIPC)
 	buffers, exitCode, err := runContainer(config, "", "readlink", "/proc/self/ns/ipc")
 	ok(t, err)
@@ -129,7 +127,7 @@ func TestIPCJoinPath(t *testing.T) {
 	l, err := os.Readlink("/proc/1/ns/ipc")
 	ok(t, err)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	config.Namespaces.Add(configs.NEWIPC, "/proc/1/ns/ipc")
 
 	buffers, exitCode, err := runContainer(config, "", "readlink", "/proc/self/ns/ipc")
@@ -153,7 +151,7 @@ func TestIPCBadPath(t *testing.T) {
 	ok(t, err)
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	config.Namespaces.Add(configs.NEWIPC, "/proc/1/ns/ipcc")
 
 	_, _, err = runContainer(config, "", "true")
@@ -183,12 +181,10 @@ func testRlimit(t *testing.T, userns bool) {
 	ok(t, err)
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
-	if userns {
-		config.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
-		config.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
-		config.Namespaces = append(config.Namespaces, configs.Namespace{Type: configs.NEWUSER})
-	}
+	config := newTemplateConfig(&tParam{
+		rootfs: rootfs,
+		userns: userns,
+	})
 
 	// ensure limit is lower than what the config requests to test that in a user namespace
 	// the Setrlimit call happens early enough that we still have permissions to raise the limit.
@@ -213,7 +209,7 @@ func TestEnter(t *testing.T) {
 	ok(t, err)
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 
 	container, err := newContainerWithName("test", config)
 	ok(t, err)
@@ -300,7 +296,7 @@ func TestProcessEnv(t *testing.T) {
 	ok(t, err)
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 
 	container, err := newContainerWithName("test", config)
 	ok(t, err)
@@ -348,7 +344,7 @@ func TestProcessEmptyCaps(t *testing.T) {
 	ok(t, err)
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	config.Capabilities = nil
 
 	container, err := newContainerWithName("test", config)
@@ -397,7 +393,7 @@ func TestProcessCaps(t *testing.T) {
 	ok(t, err)
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 
 	container, err := newContainerWithName("test", config)
 	ok(t, err)
@@ -465,7 +461,7 @@ func TestAdditionalGroups(t *testing.T) {
 	ok(t, err)
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 
 	container, err := newContainerWithName("test", config)
 	ok(t, err)
@@ -519,7 +515,10 @@ func testFreeze(t *testing.T, systemd bool) {
 	ok(t, err)
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{
+		rootfs:  rootfs,
+		systemd: systemd,
+	})
 	container, err := newContainerWithName("test", config)
 	ok(t, err)
 	defer container.Destroy()
@@ -576,10 +575,10 @@ func testCpuShares(t *testing.T, systemd bool) {
 	ok(t, err)
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
-	if systemd {
-		config.Cgroups.Parent = "system.slice"
-	}
+	config := newTemplateConfig(&tParam{
+		rootfs:  rootfs,
+		systemd: systemd,
+	})
 	config.Cgroups.Resources.CpuShares = 1
 
 	_, _, err = runContainer(config, "", "ps")
@@ -608,10 +607,10 @@ func testPids(t *testing.T, systemd bool) {
 	ok(t, err)
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
-	if systemd {
-		config.Cgroups.Parent = "system.slice"
-	}
+	config := newTemplateConfig(&tParam{
+		rootfs:  rootfs,
+		systemd: systemd,
+	})
 	config.Cgroups.Resources.PidsLimit = -1
 
 	// Running multiple processes.
@@ -694,10 +693,10 @@ func testRunWithKernelMemory(t *testing.T, systemd bool) {
 	ok(t, err)
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
-	if systemd {
-		config.Cgroups.Parent = "system.slice"
-	}
+	config := newTemplateConfig(&tParam{
+		rootfs:  rootfs,
+		systemd: systemd,
+	})
 	config.Cgroups.Resources.KernelMemory = 52428800
 
 	_, _, err = runContainer(config, "", "ps")
@@ -728,10 +727,10 @@ func testCgroupResourcesUnifiedErrorOnV1(t *testing.T, systemd bool) {
 	ok(t, err)
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
-	if systemd {
-		config.Cgroups.Parent = "system.slice"
-	}
+	config := newTemplateConfig(&tParam{
+		rootfs:  rootfs,
+		systemd: systemd,
+	})
 	config.Cgroups.Resources.Unified = map[string]string{
 		"memory.min": "10240",
 	}
@@ -763,18 +762,13 @@ func testCgroupResourcesUnified(t *testing.T, systemd bool) {
 	ok(t, err)
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{
+		rootfs:  rootfs,
+		systemd: systemd,
+	})
 	config.Cgroups.Resources.Memory = 536870912     // 512M
 	config.Cgroups.Resources.MemorySwap = 536870912 // 512M, i.e. no swap
 	config.Namespaces.Add(configs.NEWCGROUP, "")
-	config.Mounts = append(config.Mounts, &configs.Mount{
-		Destination: "/sys/fs/cgroup",
-		Device:      "cgroup",
-		Flags:       defaultMountFlags | unix.MS_RDONLY,
-	})
-	if systemd {
-		config.Cgroups.Parent = "system.slice"
-	}
 
 	testCases := []struct {
 		name     string
@@ -871,7 +865,7 @@ func TestContainerState(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	config.Namespaces = configs.Namespaces([]configs.Namespace{
 		{Type: configs.NEWNS},
 		{Type: configs.NEWUTS},
@@ -932,7 +926,7 @@ func TestPassExtraFiles(t *testing.T) {
 	}
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 
 	container, err := newContainerWithName("test", config)
 	if err != nil {
@@ -1007,7 +1001,7 @@ func TestMountCmds(t *testing.T) {
 	}
 	defer os.RemoveAll(tmpDir)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	config.Mounts = append(config.Mounts, &configs.Mount{
 		Source:      tmpDir,
 		Destination: "/tmp",
@@ -1064,7 +1058,7 @@ func TestSysctl(t *testing.T) {
 	ok(t, err)
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	config.Sysctl = map[string]string{
 		"kernel.shmmni": "8192",
 	}
@@ -1101,14 +1095,7 @@ func TestMountCgroupRO(t *testing.T) {
 	rootfs, err := newRootfs()
 	ok(t, err)
 	defer remove(rootfs)
-	config := newTemplateConfig(rootfs)
-
-	config.Mounts = append(config.Mounts, &configs.Mount{
-		Destination: "/sys/fs/cgroup",
-		Device:      "cgroup",
-		Flags:       defaultMountFlags | unix.MS_RDONLY,
-	})
-
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	buffers, exitCode, err := runContainer(config, "", "mount")
 	if err != nil {
 		t.Fatalf("%s: %s", buffers, err)
@@ -1150,13 +1137,14 @@ func TestMountCgroupRW(t *testing.T) {
 	rootfs, err := newRootfs()
 	ok(t, err)
 	defer remove(rootfs)
-	config := newTemplateConfig(rootfs)
-
-	config.Mounts = append(config.Mounts, &configs.Mount{
-		Destination: "/sys/fs/cgroup",
-		Device:      "cgroup",
-		Flags:       defaultMountFlags,
-	})
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
+	// clear the RO flag from cgroup mount
+	for _, m := range config.Mounts {
+		if m.Device == "cgroup" {
+			m.Flags = defaultMountFlags
+			break
+		}
+	}
 
 	buffers, exitCode, err := runContainer(config, "", "mount")
 	if err != nil {
@@ -1201,7 +1189,7 @@ func TestOomScoreAdj(t *testing.T) {
 	ok(t, err)
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	config.OomScoreAdj = ptrInt(200)
 
 	container, err := newContainerWithName("test", config)
@@ -1243,7 +1231,7 @@ func TestHook(t *testing.T) {
 	ok(t, err)
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	expectedBundle := bundle
 	config.Labels = append(config.Labels, "bundle="+expectedBundle)
 
@@ -1389,7 +1377,7 @@ func TestSTDIOPermissions(t *testing.T) {
 	rootfs, err := newRootfs()
 	ok(t, err)
 	defer remove(rootfs)
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	buffers, exitCode, err := runContainer(config, "", "sh", "-c", "echo hi > /dev/stderr")
 	ok(t, err)
 	if exitCode != 0 {
@@ -1422,7 +1410,7 @@ func TestRootfsPropagationSlaveMount(t *testing.T) {
 	rootfs, err := newRootfs()
 	ok(t, err)
 	defer remove(rootfs)
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 
 	config.RootPropagation = unix.MS_SLAVE | unix.MS_REC
 
@@ -1538,7 +1526,7 @@ func TestRootfsPropagationSharedMount(t *testing.T) {
 	rootfs, err := newRootfs()
 	ok(t, err)
 	defer remove(rootfs)
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	config.RootPropagation = unix.MS_PRIVATE
 
 	// Bind mount a volume
@@ -1647,7 +1635,7 @@ func TestPIDHost(t *testing.T) {
 	l, err := os.Readlink("/proc/1/ns/pid")
 	ok(t, err)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	config.Namespaces.Remove(configs.NEWPID)
 	buffers, exitCode, err := runContainer(config, "", "readlink", "/proc/self/ns/pid")
 	ok(t, err)
@@ -1723,7 +1711,7 @@ func TestInitJoinPID(t *testing.T) {
 	defer remove(rootfs)
 
 	// Execute a long-running container
-	container1, err := newContainer(newTemplateConfig(rootfs))
+	container1, err := newContainer(newTemplateConfig(&tParam{rootfs: rootfs}))
 	ok(t, err)
 	defer container1.Destroy()
 
@@ -1747,7 +1735,7 @@ func TestInitJoinPID(t *testing.T) {
 	pidns1 := state1.NamespacePaths[configs.NEWPID]
 
 	// Run a container inside the existing pidns but with different cgroups
-	config2 := newTemplateConfig(rootfs)
+	config2 := newTemplateConfig(&tParam{rootfs: rootfs})
 	config2.Namespaces.Add(configs.NEWPID, pidns1)
 	config2.Cgroups.Path = "integration/test2"
 	container2, err := newContainerWithName("testCT2", config2)
@@ -1826,10 +1814,10 @@ func TestInitJoinNetworkAndUser(t *testing.T) {
 	defer remove(rootfs)
 
 	// Execute a long-running container
-	config1 := newTemplateConfig(rootfs)
-	config1.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
-	config1.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
-	config1.Namespaces = append(config1.Namespaces, configs.Namespace{Type: configs.NEWUSER})
+	config1 := newTemplateConfig(&tParam{
+		rootfs: rootfs,
+		userns: true,
+	})
 	container1, err := newContainer(config1)
 	ok(t, err)
 	defer container1.Destroy()
@@ -1859,9 +1847,10 @@ func TestInitJoinNetworkAndUser(t *testing.T) {
 	ok(t, err)
 	defer remove(rootfs2)
 
-	config2 := newTemplateConfig(rootfs2)
-	config2.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
-	config2.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
+	config2 := newTemplateConfig(&tParam{
+		rootfs: rootfs2,
+		userns: true,
+	})
 	config2.Namespaces.Add(configs.NEWNET, netns1)
 	config2.Namespaces.Add(configs.NEWUSER, userns1)
 	config2.Cgroups.Path = "integration/test2"
@@ -1919,7 +1908,7 @@ func TestTmpfsCopyUp(t *testing.T) {
 	ok(t, err)
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 
 	config.Mounts = append(config.Mounts, &configs.Mount{
 		Source:      "tmpfs",
@@ -1969,7 +1958,7 @@ func TestCGROUPPrivate(t *testing.T) {
 	l, err := os.Readlink("/proc/1/ns/cgroup")
 	ok(t, err)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	config.Namespaces.Add(configs.NEWCGROUP, "")
 	buffers, exitCode, err := runContainer(config, "", "readlink", "/proc/self/ns/cgroup")
 	ok(t, err)
@@ -1998,7 +1987,7 @@ func TestCGROUPHost(t *testing.T) {
 	l, err := os.Readlink("/proc/1/ns/cgroup")
 	ok(t, err)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	buffers, exitCode, err := runContainer(config, "", "readlink", "/proc/self/ns/cgroup")
 	ok(t, err)
 
diff --git a/libcontainer/integration/execin_test.go b/libcontainer/integration/execin_test.go
index 14f8a5964..583faa29f 100644
--- a/libcontainer/integration/execin_test.go
+++ b/libcontainer/integration/execin_test.go
@@ -25,7 +25,7 @@ func TestExecIn(t *testing.T) {
 	rootfs, err := newRootfs()
 	ok(t, err)
 	defer remove(rootfs)
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	container, err := newContainer(config)
 	ok(t, err)
 	defer container.Destroy()
@@ -91,12 +91,10 @@ func testExecInRlimit(t *testing.T, userns bool) {
 	ok(t, err)
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
-	if userns {
-		config.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
-		config.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
-		config.Namespaces = append(config.Namespaces, configs.Namespace{Type: configs.NEWUSER})
-	}
+	config := newTemplateConfig(&tParam{
+		rootfs: rootfs,
+		userns: userns,
+	})
 
 	container, err := newContainer(config)
 	ok(t, err)
@@ -152,7 +150,7 @@ func TestExecInAdditionalGroups(t *testing.T) {
 	ok(t, err)
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	container, err := newContainer(config)
 	ok(t, err)
 	defer container.Destroy()
@@ -209,7 +207,7 @@ func TestExecInError(t *testing.T) {
 	rootfs, err := newRootfs()
 	ok(t, err)
 	defer remove(rootfs)
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	container, err := newContainer(config)
 	ok(t, err)
 	defer container.Destroy()
@@ -262,7 +260,7 @@ func TestExecInTTY(t *testing.T) {
 	rootfs, err := newRootfs()
 	ok(t, err)
 	defer remove(rootfs)
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	container, err := newContainer(config)
 	ok(t, err)
 	defer container.Destroy()
@@ -359,7 +357,7 @@ func TestExecInEnvironment(t *testing.T) {
 	rootfs, err := newRootfs()
 	ok(t, err)
 	defer remove(rootfs)
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	container, err := newContainer(config)
 	ok(t, err)
 	defer container.Destroy()
@@ -421,7 +419,7 @@ func TestExecinPassExtraFiles(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer remove(rootfs)
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	container, err := newContainer(config)
 	if err != nil {
 		t.Fatal(err)
@@ -505,7 +503,7 @@ func TestExecInOomScoreAdj(t *testing.T) {
 	rootfs, err := newRootfs()
 	ok(t, err)
 	defer remove(rootfs)
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	config.OomScoreAdj = ptrInt(200)
 	container, err := newContainer(config)
 	ok(t, err)
@@ -557,10 +555,10 @@ func TestExecInUserns(t *testing.T) {
 	rootfs, err := newRootfs()
 	ok(t, err)
 	defer remove(rootfs)
-	config := newTemplateConfig(rootfs)
-	config.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
-	config.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
-	config.Namespaces = append(config.Namespaces, configs.Namespace{Type: configs.NEWUSER})
+	config := newTemplateConfig(&tParam{
+		rootfs: rootfs,
+		userns: true,
+	})
 	container, err := newContainer(config)
 	ok(t, err)
 	defer container.Destroy()
diff --git a/libcontainer/integration/seccomp_test.go b/libcontainer/integration/seccomp_test.go
index 75319e7e8..b40a7a585 100644
--- a/libcontainer/integration/seccomp_test.go
+++ b/libcontainer/integration/seccomp_test.go
@@ -25,7 +25,7 @@ func TestSeccompDenyGetcwdWithErrno(t *testing.T) {
 
 	errnoRet := uint(syscall.ESRCH)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	config.Seccomp = &configs.Seccomp{
 		DefaultAction: configs.Allow,
 		Syscalls: []*configs.Syscall{
@@ -95,7 +95,7 @@ func TestSeccompDenyGetcwd(t *testing.T) {
 	}
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	config.Seccomp = &configs.Seccomp{
 		DefaultAction: configs.Allow,
 		Syscalls: []*configs.Syscall{
@@ -164,7 +164,7 @@ func TestSeccompPermitWriteConditional(t *testing.T) {
 	}
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	config.Seccomp = &configs.Seccomp{
 		DefaultAction: configs.Allow,
 		Syscalls: []*configs.Syscall{
@@ -226,7 +226,7 @@ func TestSeccompDenyWriteConditional(t *testing.T) {
 	}
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	config.Seccomp = &configs.Seccomp{
 		DefaultAction: configs.Allow,
 		Syscalls: []*configs.Syscall{
@@ -304,7 +304,7 @@ func TestSeccompPermitWriteMultipleConditions(t *testing.T) {
 	}
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	config.Seccomp = &configs.Seccomp{
 		DefaultAction: configs.Allow,
 		Syscalls: []*configs.Syscall{
@@ -359,7 +359,7 @@ func TestSeccompDenyWriteMultipleConditions(t *testing.T) {
 	}
 	defer remove(rootfs)
 
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	config.Seccomp = &configs.Seccomp{
 		DefaultAction: configs.Allow,
 		Syscalls: []*configs.Syscall{
@@ -409,7 +409,7 @@ func TestSeccompMultipleConditionSameArgDeniesStdout(t *testing.T) {
 	defer remove(rootfs)
 
 	// Prevent writing to both stdout and stderr
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	config.Seccomp = &configs.Seccomp{
 		DefaultAction: configs.Allow,
 		Syscalls: []*configs.Syscall{
@@ -457,7 +457,7 @@ func TestSeccompMultipleConditionSameArgDeniesStderr(t *testing.T) {
 	defer remove(rootfs)
 
 	// Prevent writing to both stdout and stderr
-	config := newTemplateConfig(rootfs)
+	config := newTemplateConfig(&tParam{rootfs: rootfs})
 	config.Seccomp = &configs.Seccomp{
 		DefaultAction: configs.Allow,
 		Syscalls: []*configs.Syscall{
diff --git a/libcontainer/integration/template_test.go b/libcontainer/integration/template_test.go
index 702f918f1..51a6b5361 100644
--- a/libcontainer/integration/template_test.go
+++ b/libcontainer/integration/template_test.go
@@ -1,6 +1,9 @@
 package integration
 
 import (
+	"math/rand"
+	"strconv"
+
 	"github.com/opencontainers/runc/libcontainer/configs"
 	"github.com/opencontainers/runc/libcontainer/specconv"
 
@@ -16,17 +19,23 @@ var standardEnvironment = []string{
 
 const defaultMountFlags = unix.MS_NOEXEC | unix.MS_NOSUID | unix.MS_NODEV
 
+type tParam struct {
+	rootfs  string
+	userns  bool
+	systemd bool
+}
+
 // newTemplateConfig returns a base template for running a container
 //
 // it uses a network strategy of just setting a loopback interface
 // and the default setup for devices
-func newTemplateConfig(rootfs string) *configs.Config {
+func newTemplateConfig(p *tParam) *configs.Config {
 	var allowedDevices []*configs.DeviceRule
 	for _, device := range specconv.AllowedDevices {
 		allowedDevices = append(allowedDevices, &device.DeviceRule)
 	}
-	return &configs.Config{
-		Rootfs: rootfs,
+	config := &configs.Config{
+		Rootfs: p.rootfs,
 		Capabilities: &configs.Capabilities{
 			Bounding: []string{
 				"CAP_CHOWN",
@@ -117,7 +126,6 @@ func newTemplateConfig(rootfs string) *configs.Config {
 			{Type: configs.NEWNET},
 		}),
 		Cgroups: &configs.Cgroup{
-			Path: "/sys/fs/cgroup/",
 			Resources: &configs.Resources{
 				MemorySwappiness: nil,
 				Devices:          allowedDevices,
@@ -191,4 +199,28 @@ func newTemplateConfig(rootfs string) *configs.Config {
 			},
 		},
 	}
+
+	if p.userns {
+		config.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
+		config.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
+		config.Namespaces = append(config.Namespaces, configs.Namespace{Type: configs.NEWUSER})
+	} else {
+		config.Mounts = append(config.Mounts, &configs.Mount{
+			Destination: "/sys/fs/cgroup",
+			Device:      "cgroup",
+			Flags:       defaultMountFlags | unix.MS_RDONLY,
+		})
+	}
+
+	if p.systemd {
+		id := strconv.FormatUint(rand.Uint64(), 36)
+		config.Cgroups.Name = "test" + id
+		// do not change Parent (see newContainerWithName)
+		config.Cgroups.Parent = "system.slice"
+		config.Cgroups.ScopePrefix = "runc-test"
+	} else {
+		config.Cgroups.Path = "/test/integration"
+	}
+
+	return config
 }