@@ -5,7 +5,6 @@ package nsinit

 import (

 	"fmt"

 	"github.com/dotcloud/docker/pkg/libcontainer"

-	"github.com/dotcloud/docker/pkg/libcontainer/capabilities"

 	"github.com/dotcloud/docker/pkg/system"

 	"os"

 	"path/filepath"

@@ -73,8 +72,8 @@ func (ns *linuxNs) ExecIn(container *libcontainer.Container, nspid int, args []s

 		os.Exit(state.Sys().(syscall.WaitStatus).ExitStatus())

 	}

 dropAndExec:

-	if err := capabilities.DropCapabilities(container); err != nil {

-		return -1, fmt.Errorf("drop capabilities %s", err)

+	if err := finalizeNamespace(container); err != nil {

+		return -1, err

 	}

 	if err := system.Execv(args[0], args[0:], container.Env); err != nil {

 		return -1, err

@@ -64,16 +64,8 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol

 	if err := system.Sethostname(container.Hostname); err != nil {

 		return fmt.Errorf("sethostname %s", err)

 	}

-	if err := capabilities.DropCapabilities(container); err != nil {

-		return fmt.Errorf("drop capabilities %s", err)

-	}

-	if err := setupUser(container); err != nil {

-		return fmt.Errorf("setup user %s", err)

-	}

-	if container.WorkingDir != "" {

-		if err := system.Chdir(container.WorkingDir); err != nil {

-			return fmt.Errorf("chdir to %s %s", container.WorkingDir, err)

-		}

+	if err := finalizeNamespace(container); err != nil {

+		return fmt.Errorf("finalize namespace %s", err)

 	}

 	return system.Execv(args[0], args[0:], container.Env)

 }

@@ -142,3 +134,20 @@ func setupNetwork(container *libcontainer.Container, context libcontainer.Contex

 	}

 	return nil

 }

+

+// finalizeNamespace drops the caps and sets the correct user

+// and working dir before execing the command inside the namespace

+func finalizeNamespace(container *libcontainer.Container) error {

+	if err := capabilities.DropCapabilities(container); err != nil {

+		return fmt.Errorf("drop capabilities %s", err)

+	}

+	if err := setupUser(container); err != nil {

+		return fmt.Errorf("setup user %s", err)

+	}

+	if container.WorkingDir != "" {

+		if err := system.Chdir(container.WorkingDir); err != nil {

+			return fmt.Errorf("chdir to %s %s", container.WorkingDir, err)

+		}

+	}

+	return nil

+}