@@ -18,10 +18,10 @@ import (

 	"github.com/docker/docker/daemon/network"

 	"github.com/docker/docker/image"

 	"github.com/docker/docker/layer"

+	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/docker/pkg/promise"

 	"github.com/docker/docker/pkg/signal"

 	"github.com/docker/docker/pkg/symlink"

-	"github.com/docker/docker/pkg/system"

 	"github.com/docker/docker/runconfig"

 	"github.com/docker/docker/volume"

 	containertypes "github.com/docker/engine-api/types/container"

@@ -184,7 +184,7 @@ func (container *Container) WriteHostConfig() error {

 }

 // SetupWorkingDirectory sets up the container's working directory as set in container.Config.WorkingDir

-func (container *Container) SetupWorkingDirectory() error {

+func (container *Container) SetupWorkingDirectory(rootUID, rootGID int) error {

 	if container.Config.WorkingDir == "" {

 		return nil

 	}

@@ -202,7 +202,7 @@ func (container *Container) SetupWorkingDirectory() error {

 		return err

 	}

-	if err := system.MkdirAll(pth, 0755); err != nil {

+	if err := idtools.MkdirAllNewAs(pth, 0755, rootUID, rootGID); err != nil {

 		pthInfo, err2 := os.Stat(pth)

 		if err2 == nil && pthInfo != nil && !pthInfo.IsDir() {

 			return fmt.Errorf("Cannot mkdir: %s is not a directory", container.Config.WorkingDir)

@@ -21,7 +21,8 @@ func (daemon *Daemon) createContainerPlatformSpecificSettings(container *contain

 	}

 	defer daemon.Unmount(container)

-	if err := container.SetupWorkingDirectory(); err != nil {

+	rootUID, rootGID := daemon.GetRemappedUIDGID()

+	if err := container.SetupWorkingDirectory(rootUID, rootGID); err != nil {

 		return err

 	}

@@ -126,7 +126,8 @@ func (daemon *Daemon) containerStart(container *container.Container) (err error)

 	if err != nil {

 		return err

 	}

-	if err := container.SetupWorkingDirectory(); err != nil {

+	rootUID, rootGID := daemon.GetRemappedUIDGID()

+	if err := container.SetupWorkingDirectory(rootUID, rootGID); err != nil {

 		return err

 	}

 	env := container.CreateDaemonEnvironment(linkedEnv)

@@ -844,6 +844,17 @@ RUN ls -l /new_dir`,

 	}

 }

+func (s *DockerSuite) TestBuildWorkdirIsContainerRoot(c *check.C) {

+	testRequires(c, DaemonIsLinux) // Linux specific test

+	name := "testworkdirownership"

+	if _, err := buildImage(name, `FROM busybox

+WORKDIR /new_dir

+RUN ls -l /

+RUN [ $(ls -l / | grep new_dir | awk '{print $3":"$4}') = 'root:root' ]`, true); err != nil {

+		c.Fatal(err)

+	}

+}

+

 func (s *DockerSuite) TestBuildAddMultipleFilesToFile(c *check.C) {

 	name := "testaddmultiplefilestofile"

@@ -1742,7 +1742,7 @@ func (s *DockerSuite) TestRunCleanupCmdOnEntrypoint(c *check.C) {

 // TestRunWorkdirExistsAndIsFile checks that if 'docker run -w' with existing file can be detected

 func (s *DockerSuite) TestRunWorkdirExistsAndIsFile(c *check.C) {

 	existingFile := "/bin/cat"

-	expected := "Cannot mkdir: /bin/cat is not a directory"

+	expected := "not a directory"

 	if daemonPlatform == "windows" {

 		existingFile = `\windows\system32\ntdll.dll`

 		expected = `Cannot mkdir: \windows\system32\ntdll.dll is not a directory.`

@@ -1750,7 +1750,7 @@ func (s *DockerSuite) TestRunWorkdirExistsAndIsFile(c *check.C) {

 	out, exitCode, err := dockerCmdWithError("run", "-w", existingFile, "busybox")

 	if !(err != nil && exitCode == 125 && strings.Contains(out, expected)) {

-		c.Fatalf("Docker must complains about making dir with exitCode 125 but we got out: %s, exitCode: %d", out, exitCode)

+		c.Fatalf("Existing binary as a directory should error out with exitCode 125; we got: %s, exitCode: %d", out, exitCode)

 	}

 }