@@ -466,5 +466,5 @@ func (daemon *Daemon) setupContainerMountsRoot(c *container.Container) error {

 	if err != nil {

 		return err

 	}

-	return idtools.MkdirAllAndChown(p, 0700, daemon.idMapping.RootPair())

+	return idtools.MkdirAllAndChown(p, 0701, idtools.CurrentIdentity())

 }

@@ -211,12 +211,10 @@ func (daemon *Daemon) create(opts createOpts) (retC *container.Container, retErr

 	}

 	ctr.RWLayer = rwLayer

-	rootIDs := daemon.idMapping.RootPair()

-

-	if err := idtools.MkdirAndChown(ctr.Root, 0700, rootIDs); err != nil {

+	if err := idtools.MkdirAndChown(ctr.Root, 0701, idtools.CurrentIdentity()); err != nil {

 		return nil, err

 	}

-	if err := idtools.MkdirAndChown(ctr.CheckpointDir(), 0700, rootIDs); err != nil {

+	if err := idtools.MkdirAndChown(ctr.CheckpointDir(), 0700, idtools.CurrentIdentity()); err != nil {

 		return nil, err

 	}

@@ -861,7 +861,7 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 	}

 	daemonRepo := filepath.Join(config.Root, "containers")

-	if err := idtools.MkdirAllAndChown(daemonRepo, 0700, rootIDs); err != nil {

+	if err := idtools.MkdirAllAndChown(daemonRepo, 0701, idtools.CurrentIdentity()); err != nil {

 		return nil, err

 	}

@@ -1196,7 +1196,7 @@ func setupRemappedRoot(config *config.Config) (*idtools.IdentityMapping, error)

 	return &idtools.IdentityMapping{}, nil

 }

-func setupDaemonRoot(config *config.Config, rootDir string, rootIdentity idtools.Identity) error {

+func setupDaemonRoot(config *config.Config, rootDir string, remappedRoot idtools.Identity) error {

 	config.Root = rootDir

 	// the docker root metadata directory needs to have execute permissions for all users (g+x,o+x)

 	// so that syscalls executing as non-root, operating on subdirectories of the graph root

@@ -1221,10 +1221,16 @@ func setupDaemonRoot(config *config.Config, rootDir string, rootIdentity idtools

 	// a new subdirectory with ownership set to the remapped uid/gid (so as to allow

 	// `chdir()` to work for containers namespaced to that uid/gid)

 	if config.RemappedRoot != "" {

-		config.Root = filepath.Join(rootDir, fmt.Sprintf("%d.%d", rootIdentity.UID, rootIdentity.GID))

+		id := idtools.CurrentIdentity()

+		// First make sure the current root dir has the correct perms.

+		if err := idtools.MkdirAllAndChown(config.Root, 0701, id); err != nil {

+			return errors.Wrapf(err, "could not create or set daemon root permissions: %s", config.Root)

+		}

+

+		config.Root = filepath.Join(rootDir, fmt.Sprintf("%d.%d", remappedRoot.UID, remappedRoot.GID))

 		logrus.Debugf("Creating user namespaced daemon root: %s", config.Root)

 		// Create the root directory if it doesn't exist

-		if err := idtools.MkdirAllAndChown(config.Root, 0700, rootIdentity); err != nil {

+		if err := idtools.MkdirAllAndChown(config.Root, 0701, id); err != nil {

 			return fmt.Errorf("Cannot create daemon root: %s: %v", config.Root, err)

 		}

 		// we also need to verify that any pre-existing directories in the path to

@@ -1237,7 +1243,7 @@ func setupDaemonRoot(config *config.Config, rootDir string, rootIdentity idtools

 			if dirPath == "/" {

 				break

 			}

-			if !idtools.CanAccess(dirPath, rootIdentity) {

+			if !idtools.CanAccess(dirPath, remappedRoot) {

 				return fmt.Errorf("a subdirectory in your graphroot path (%s) restricts access to the remapped root uid/gid; please fix by allowing 'o+x' permissions on existing directories", config.Root)

 			}

 		}

@@ -129,18 +129,15 @@ func Init(root string, options []string, uidMaps, gidMaps []idtools.IDMap) (grap

 		locker:    locker.New(),

 	}

-	rootUID, rootGID, err := idtools.GetRootUIDGID(uidMaps, gidMaps)

-	if err != nil {

-		return nil, err

-	}

+	currentID := idtools.CurrentIdentity()

 	// Create the root aufs driver dir

-	if err := idtools.MkdirAllAndChown(root, 0700, idtools.Identity{UID: rootUID, GID: rootGID}); err != nil {

+	if err := idtools.MkdirAllAndChown(root, 0701, currentID); err != nil {

 		return nil, err

 	}

 	// Populate the dir structure

 	for _, p := range paths {

-		if err := idtools.MkdirAllAndChown(path.Join(root, p), 0700, idtools.Identity{UID: rootUID, GID: rootGID}); err != nil {

+		if err := idtools.MkdirAllAndChown(path.Join(root, p), 0701, currentID); err != nil {

 			return nil, err

 		}

 	}

@@ -70,11 +70,7 @@ func Init(home string, options []string, uidMaps, gidMaps []idtools.IDMap) (grap

 		return nil, graphdriver.ErrPrerequisites

 	}

-	rootUID, rootGID, err := idtools.GetRootUIDGID(uidMaps, gidMaps)

-	if err != nil {

-		return nil, err

-	}

-	if err := idtools.MkdirAllAndChown(home, 0700, idtools.Identity{UID: rootUID, GID: rootGID}); err != nil {

+	if err := idtools.MkdirAllAndChown(home, 0701, idtools.CurrentIdentity()); err != nil {

 		return nil, err

 	}

@@ -525,7 +521,7 @@ func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) error {

 	if err != nil {

 		return err

 	}

-	if err := idtools.MkdirAllAndChown(subvolumes, 0700, idtools.Identity{UID: rootUID, GID: rootGID}); err != nil {

+	if err := idtools.MkdirAllAndChown(subvolumes, 0701, idtools.CurrentIdentity()); err != nil {

 		return err

 	}

 	if parent == "" {

@@ -560,7 +556,7 @@ func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) error {

 		if err := d.setStorageSize(path.Join(subvolumes, id), driver); err != nil {

 			return err

 		}

-		if err := idtools.MkdirAllAndChown(quotas, 0700, idtools.Identity{UID: rootUID, GID: rootGID}); err != nil {

+		if err := idtools.MkdirAllAndChown(quotas, 0700, idtools.CurrentIdentity()); err != nil {

 			return err

 		}

 		if err := ioutil.WriteFile(path.Join(quotas, id), []byte(fmt.Sprint(driver.options.size)), 0644); err != nil {

@@ -88,12 +88,7 @@ func Init(home string, options []string, uidMaps, gidMaps []idtools.IDMap) (grap

 		return nil, graphdriver.ErrNotSupported

 	}

-	rootUID, rootGID, err := idtools.GetRootUIDGID(uidMaps, gidMaps)

-	if err != nil {

-		return nil, err

-	}

-	// Create the driver home dir

-	if err := idtools.MkdirAllAndChown(path.Join(home, linkDir), 0700, idtools.Identity{UID: rootUID, GID: rootGID}); err != nil {

+	if err := idtools.MkdirAllAndChown(path.Join(home, linkDir), 0701, idtools.CurrentIdentity()); err != nil {

 		return nil, err

 	}

@@ -178,10 +173,11 @@ func (d *Driver) create(id, parent string, opts *graphdriver.CreateOpts) (retErr

 	}

 	root := idtools.Identity{UID: rootUID, GID: rootGID}

-	if err := idtools.MkdirAllAndChown(path.Dir(dir), 0700, root); err != nil {

+	currentID := idtools.CurrentIdentity()

+	if err := idtools.MkdirAllAndChown(path.Dir(dir), 0701, currentID); err != nil {

 		return err

 	}

-	if err := idtools.MkdirAndChown(dir, 0700, root); err != nil {

+	if err := idtools.MkdirAndChown(dir, 0701, currentID); err != nil {

 		return err

 	}

@@ -215,7 +211,7 @@ func (d *Driver) create(id, parent string, opts *graphdriver.CreateOpts) (retErr

 		return nil

 	}

-	if err := idtools.MkdirAndChown(path.Join(dir, workDirName), 0700, root); err != nil {

+	if err := idtools.MkdirAndChown(path.Join(dir, workDirName), 0701, currentID); err != nil {

 		return err

 	}

@@ -156,12 +156,8 @@ func Init(home string, options []string, uidMaps, gidMaps []idtools.IDMap) (grap

 		logrus.WithField("storage-driver", "overlay").Warn(overlayutils.ErrDTypeNotSupported("overlay", backingFs))

 	}

-	rootUID, rootGID, err := idtools.GetRootUIDGID(uidMaps, gidMaps)

-	if err != nil {

-		return nil, err

-	}

 	// Create the driver home dir

-	if err := idtools.MkdirAllAndChown(home, 0700, idtools.Identity{UID: rootUID, GID: rootGID}); err != nil {

+	if err := idtools.MkdirAllAndChown(home, 0701, idtools.CurrentIdentity()); err != nil {

 		return nil, err

 	}

@@ -265,10 +261,11 @@ func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) (retErr

 	}

 	root := idtools.Identity{UID: rootUID, GID: rootGID}

-	if err := idtools.MkdirAllAndChown(path.Dir(dir), 0700, root); err != nil {

+	currentID := idtools.CurrentIdentity()

+	if err := idtools.MkdirAllAndChown(path.Dir(dir), 0701, currentID); err != nil {

 		return err

 	}

-	if err := idtools.MkdirAndChown(dir, 0700, root); err != nil {

+	if err := idtools.MkdirAndChown(dir, 0701, currentID); err != nil {

 		return err

 	}

@@ -281,6 +278,7 @@ func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) (retErr

 	// Toplevel images are just a "root" dir

 	if parent == "" {

+		// This must be 0755 otherwise unprivileged users will in the container will not be able to read / in the container

 		return idtools.MkdirAndChown(path.Join(dir, "root"), 0755, root)

 	}

@@ -301,7 +299,7 @@ func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) (retErr

 		if err := idtools.MkdirAndChown(path.Join(dir, "work"), 0700, root); err != nil {

 			return err

 		}

-		return ioutil.WriteFile(path.Join(dir, "lower-id"), []byte(parent), 0666)

+		return ioutil.WriteFile(path.Join(dir, "lower-id"), []byte(parent), 0600)

 	}

 	// Otherwise, copy the upper and the lower-id from the parent

@@ -311,7 +309,7 @@ func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) (retErr

 		return err

 	}

-	if err := ioutil.WriteFile(path.Join(dir, "lower-id"), lowerID, 0666); err != nil {

+	if err := ioutil.WriteFile(path.Join(dir, "lower-id"), lowerID, 0600); err != nil {

 		return err

 	}

@@ -165,12 +165,7 @@ func Init(home string, options []string, uidMaps, gidMaps []idtools.IDMap) (grap

 		logger.Warn(overlayutils.ErrDTypeNotSupported("overlay2", backingFs))

 	}

-	rootUID, rootGID, err := idtools.GetRootUIDGID(uidMaps, gidMaps)

-	if err != nil {

-		return nil, err

-	}

-	// Create the driver home dir

-	if err := idtools.MkdirAllAndChown(path.Join(home, linkDir), 0700, idtools.Identity{UID: rootUID, GID: rootGID}); err != nil {

+	if err := idtools.MkdirAllAndChown(path.Join(home, linkDir), 0701, idtools.CurrentIdentity()); err != nil {

 		return nil, err

 	}

@@ -339,11 +334,12 @@ func (d *Driver) create(id, parent string, opts *graphdriver.CreateOpts) (retErr

 		return err

 	}

 	root := idtools.Identity{UID: rootUID, GID: rootGID}

+	current := idtools.CurrentIdentity()

-	if err := idtools.MkdirAllAndChown(path.Dir(dir), 0700, root); err != nil {

+	if err := idtools.MkdirAllAndChown(path.Dir(dir), 0701, current); err != nil {

 		return err

 	}

-	if err := idtools.MkdirAndChown(dir, 0700, root); err != nil {

+	if err := idtools.MkdirAndChown(dir, 0701, current); err != nil {

 		return err

 	}

@@ -38,8 +38,7 @@ func Init(home string, options []string, uidMaps, gidMaps []idtools.IDMap) (grap

 		return nil, err

 	}

-	rootIDs := d.idMapping.RootPair()

-	if err := idtools.MkdirAllAndChown(home, 0700, rootIDs); err != nil {

+	if err := idtools.MkdirAllAndChown(home, 0701, idtools.CurrentIdentity()); err != nil {

 		return nil, err

 	}

@@ -141,7 +140,7 @@ func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) error {

 func (d *Driver) create(id, parent string, size uint64) error {

 	dir := d.dir(id)

 	rootIDs := d.idMapping.RootPair()

-	if err := idtools.MkdirAllAndChown(filepath.Dir(dir), 0700, rootIDs); err != nil {

+	if err := idtools.MkdirAllAndChown(filepath.Dir(dir), 0701, idtools.CurrentIdentity()); err != nil {

 		return err

 	}

 	if err := idtools.MkdirAndChown(dir, 0755, rootIDs); err != nil {

@@ -104,11 +104,7 @@ func Init(base string, opt []string, uidMaps, gidMaps []idtools.IDMap) (graphdri

 		return nil, fmt.Errorf("BUG: zfs get all -t filesystem -rHp '%s' should contain '%s'", options.fsName, options.fsName)

 	}

-	rootUID, rootGID, err := idtools.GetRootUIDGID(uidMaps, gidMaps)

-	if err != nil {

-		return nil, fmt.Errorf("Failed to get root uid/guid: %v", err)

-	}

-	if err := idtools.MkdirAllAndChown(base, 0700, idtools.Identity{UID: rootUID, GID: rootGID}); err != nil {

+	if err := idtools.MkdirAllAndChown(base, 0701, idtools.CurrentIdentity()); err != nil {

 		return nil, fmt.Errorf("Failed to create '%s': %v", base, err)

 	}

@@ -50,7 +50,7 @@ type activeMount struct {

 func New(scope string, rootIdentity idtools.Identity) (*Root, error) {

 	rootDirectory := filepath.Join(scope, volumesPathName)

-	if err := idtools.MkdirAllAndChown(rootDirectory, 0700, rootIdentity); err != nil {

+	if err := idtools.MkdirAllAndChown(rootDirectory, 0701, idtools.CurrentIdentity()); err != nil {

 		return nil, err

 	}

@@ -153,8 +153,15 @@ func (r *Root) Create(name string, opts map[string]string) (volume.Volume, error

 	}

 	path := r.DataPath(name)

+	volRoot := filepath.Dir(path)

+	// Root dir does not need to be accessed by the remapped root

+	if err := idtools.MkdirAllAndChown(volRoot, 0701, idtools.CurrentIdentity()); err != nil {

+		return nil, errors.Wrapf(errdefs.System(err), "error while creating volume root path '%s'", volRoot)

+	}

+

+	// Remapped root does need access to the data path

 	if err := idtools.MkdirAllAndChown(path, 0755, r.rootIdentity); err != nil {

-		return nil, errors.Wrapf(errdefs.System(err), "error while creating volume path '%s'", path)

+		return nil, errors.Wrapf(errdefs.System(err), "error while creating volume data path '%s'", path)

 	}

 	var err error