diff --git a/pkg/libcontainer/namespaces/execin.go b/pkg/libcontainer/namespaces/execin.go
index 699c67dbc7..4d5671e778 100644
--- a/pkg/libcontainer/namespaces/execin.go
+++ b/pkg/libcontainer/namespaces/execin.go
@@ -14,12 +14,6 @@ import (
 
 // ExecIn uses an existing pid and joins the pid's namespaces with the new command.
 func ExecIn(container *libcontainer.Container, nspid int, args []string) error {
-	// clear the current processes env and replace it with the environment
-	// defined on the container
-	if err := LoadContainerEnvironment(container); err != nil {
-		return err
-	}
-
 	// TODO(vmarmol): If this gets too long, send it over a pipe to the child.
 	// Marshall the container into JSON since it won't be available in the namespace.
 	containerJson, err := json.Marshal(container)
@@ -36,7 +30,7 @@ func ExecIn(container *libcontainer.Container, nspid int, args []string) error {
 	// Enter the namespace and then finish setup
 	finalArgs := []string{os.Args[0], "nsenter", strconv.Itoa(nspid), processLabel, string(containerJson)}
 	finalArgs = append(finalArgs, args...)
-	if err := system.Execv(finalArgs[0], finalArgs[0:], container.Env); err != nil {
+	if err := system.Execv(finalArgs[0], finalArgs[0:], os.Environ()); err != nil {
 		return err
 	}
 	panic("unreachable")
@@ -44,13 +38,18 @@ func ExecIn(container *libcontainer.Container, nspid int, args []string) error {
 
 // NsEnter is run after entering the namespace.
 func NsEnter(container *libcontainer.Container, processLabel string, nspid int, args []string) error {
+	// clear the current processes env and replace it with the environment
+	// defined on the container
+	if err := LoadContainerEnvironment(container); err != nil {
+		return err
+	}
 	if err := FinalizeNamespace(container); err != nil {
 		return err
 	}
 	if err := label.SetProcessLabel(processLabel); err != nil {
 		return err
 	}
-	if err := system.Execv(args[0], args[0:], os.Environ()); err != nil {
+	if err := system.Execv(args[0], args[0:], container.Env); err != nil {
 		return err
 	}
 	panic("unreachable")
diff --git a/pkg/libcontainer/namespaces/nsenter.go b/pkg/libcontainer/namespaces/nsenter.go
index c5dd2e7953..d5c2e761b7 100644
--- a/pkg/libcontainer/namespaces/nsenter.go
+++ b/pkg/libcontainer/namespaces/nsenter.go
@@ -85,8 +85,9 @@ void nsenter() {
 		fprintf(stderr, "nsenter: Failed to open directory \"%s\" with error: \"%s\"\n", ns_dir, strerror(errno));
 		exit(1);
 	}
+
 	while((dent = readdir(dir)) != NULL) {
-		if(strcmp(dent->d_name, ".") == 0 || strcmp(dent->d_name, "..") == 0) {
+		if(strcmp(dent->d_name, ".") == 0 || strcmp(dent->d_name, "..") == 0 || strcmp(dent->d_name, "user") == 0) {
 			continue;
 		}