3 files changed, 13 insertions, 15 deletions
diff --git a/pkg/specgen/generate/container.go b/pkg/specgen/generate/container.go
index 65f8197bc..53d160442 100644
--- a/pkg/specgen/generate/container.go
+++ b/pkg/specgen/generate/container.go
@@ -135,15 +135,18 @@ func CompleteSpec(ctx context.Context, r *libpod.Runtime, s *specgen.SpecGenerat
 	s.Annotations = annotations
 
 	// workdir
-	if newImage != nil {
-		workingDir, err := newImage.WorkingDir(ctx)
-		if err != nil {
-			return nil, err
-		}
-		if len(s.WorkDir) < 1 && len(workingDir) > 1 {
+	if s.WorkDir == "" {
+		if newImage != nil {
+			workingDir, err := newImage.WorkingDir(ctx)
+			if err != nil {
+				return nil, err
+			}
 			s.WorkDir = workingDir
 		}
 	}
+	if s.WorkDir == "" {
+		s.WorkDir = "/"
+	}
 
 	if len(s.SeccompProfilePath) < 1 {
 		p, err := libpod.DefaultSeccompPath()
diff --git a/pkg/specgen/generate/container_create.go b/pkg/specgen/generate/container_create.go
index ec32ab47d..fda4c098c 100644
--- a/pkg/specgen/generate/container_create.go
+++ b/pkg/specgen/generate/container_create.go
@@ -247,13 +247,7 @@ func createContainerOptions(ctx context.Context, rt *libpod.Runtime, s *specgen.
 	// If the user did not set an workdir but the image did, ensure it is
 	// created.
 	if s.WorkDir == "" && img != nil {
-		newWD, err := img.WorkingDir(ctx)
-		if err != nil {
-			return nil, err
-		}
-		if newWD != "" {
-			options = append(options, libpod.WithCreateWorkingDir())
-		}
+		options = append(options, libpod.WithCreateWorkingDir())
 	}
 	if s.StopSignal != nil {
 		options = append(options, libpod.WithStopSignal(*s.StopSignal))
diff --git a/pkg/specgen/generate/security.go b/pkg/specgen/generate/security.go
index 4352ef718..5e4cc3399 100644
--- a/pkg/specgen/generate/security.go
+++ b/pkg/specgen/generate/security.go
@@ -158,8 +158,9 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator,
 		configSpec.Linux.Seccomp = seccompConfig
 	}
 
-	// Clear default Seccomp profile from Generator for privileged containers
-	if s.SeccompProfilePath == "unconfined" || s.Privileged {
+	// Clear default Seccomp profile from Generator for unconfined containers
+	// and privileged containers which do not specify a seccomp profile.
+	if s.SeccompProfilePath == "unconfined" || (s.Privileged && (s.SeccompProfilePath == config.SeccompOverridePath || s.SeccompProfilePath == config.SeccompDefaultPath)) {
 		configSpec.Linux.Seccomp = nil
 	}