diff --git a/libcontainer/cgroups/utils.go b/libcontainer/cgroups/utils.go
index 8ab80a7f2..c97dab020 100644
--- a/libcontainer/cgroups/utils.go
+++ b/libcontainer/cgroups/utils.go
@@ -57,6 +57,7 @@ func FindCgroupMountpointDir() (string, error) {
 
 type Mount struct {
 	Mountpoint string
+	Root       string
 	Subsystems []string
 }
 
@@ -87,7 +88,7 @@ func GetCgroupMounts() ([]Mount, error) {
 	res := []Mount{}
 	for _, mount := range mounts {
 		if mount.Fstype == "cgroup" {
-			m := Mount{Mountpoint: mount.Mountpoint}
+			m := Mount{Mountpoint: mount.Mountpoint, Root: mount.Root}
 
 			for _, opt := range strings.Split(mount.VfsOpts, ",") {
 				if strings.HasPrefix(opt, "name=") {
diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go
index 8a9e38a25..a211d8de9 100644
--- a/libcontainer/rootfs_linux.go
+++ b/libcontainer/rootfs_linux.go
@@ -180,18 +180,22 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel string) error {
 			if err != nil {
 				return err
 			}
+			relDir, err := filepath.Rel(mm.Root, dir)
+			if err != nil {
+				return err
+			}
 			binds = append(binds, &configs.Mount{
 				Device:      "bind",
-				Source:      filepath.Join(mm.Mountpoint, dir),
+				Source:      filepath.Join(mm.Mountpoint, relDir),
 				Destination: filepath.Join(m.Destination, strings.Join(mm.Subsystems, ",")),
 				Flags:       syscall.MS_BIND | syscall.MS_REC | m.Flags,
 			})
 		}
 		tmpfs := &configs.Mount{
-			Device:      "tmpfs",
 			Source:      "tmpfs",
+			Device:      "tmpfs",
 			Destination: m.Destination,
-			Flags:       syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NODEV,
+			Flags:       defaultMountFlags,
 		}
 		if err := mountToRootfs(tmpfs, rootfs, mountLabel); err != nil {
 			return err