diff --git a/server/container_create_linux.go b/server/container_create_linux.go
index <HASH>..<HASH> 100644
--- a/server/container_create_linux.go
+++ b/server/container_create_linux.go
@@ -470,13 +470,13 @@ func (s *Server) createSandboxContainer(ctx context.Context, ctr ctrIface.Contai
 			Destination: "/sys",
 			Type:        "sysfs",
 			Source:      "sysfs",
-			Options:     []string{"nosuid", "noexec", "nodev", "rw"},
+			Options:     []string{"nosuid", "noexec", "nodev", "rw", "rslave"},
 		})
 		ctr.SpecAddMount(rspec.Mount{
 			Destination: "/sys/fs/cgroup",
 			Type:        "cgroup",
 			Source:      "cgroup",
-			Options:     []string{"nosuid", "noexec", "nodev", "rw", "relatime"},
+			Options:     []string{"nosuid", "noexec", "nodev", "rw", "relatime", "rslave"},
 		})
 	}
server: mount cgroup with rslave

even when running as privileged container, prevent cgroup mounts to be
propagated to the host as it could cause errors when running with
rshared and systemd inside of the container.

Closes: <URL>