diff --git a/libcontainer/nsinit/mount.go b/libcontainer/nsinit/mount.go
index ee48032..81229ef 100644
--- a/libcontainer/nsinit/mount.go
+++ b/libcontainer/nsinit/mount.go
@@ -47,14 +47,14 @@ func setupNewMountNamespace(rootfs, console string, container *libcontainer.Cont
 	if err := setupBindmounts(rootfs, container.Mounts); err != nil {
 		return fmt.Errorf("bind mounts %s", err)
 	}
+	if err := copyDevNodes(rootfs); err != nil {
+		return fmt.Errorf("copy dev nodes %s", err)
+	}
 	if restrictionPath := container.Context["restriction_path"]; restrictionPath != "" {
 		if err := restrict.Restrict(rootfs, restrictionPath); err != nil {
 			return fmt.Errorf("restrict %s", err)
 		}
 	}
-	if err := copyDevNodes(rootfs); err != nil {
-		return fmt.Errorf("copy dev nodes %s", err)
-	}
 	if err := setupPtmx(rootfs, console, container.Context["mount_label"]); err != nil {
 		return err
 	}
@@ -273,12 +273,20 @@ func setupBindmounts(rootfs string, bindMounts libcontainer.Mounts) error {
 }
 
 func newSystemMounts(rootfs, mountLabel string, mounts libcontainer.Mounts) []mount {
-	systemMounts := []mount{
-		{source: "proc", path: filepath.Join(rootfs, "proc"), device: "proc", flags: defaultMountFlags},
+	devMounts := []mount{
 		{source: "shm", path: filepath.Join(rootfs, "dev", "shm"), device: "tmpfs", flags: defaultMountFlags, data: label.FormatMountLabel("mode=1777,size=65536k", mountLabel)},
 		{source: "devpts", path: filepath.Join(rootfs, "dev", "pts"), device: "devpts", flags: syscall.MS_NOSUID | syscall.MS_NOEXEC, data: label.FormatMountLabel("newinstance,ptmxmode=0666,mode=620,gid=5", mountLabel)},
 	}
 
+	systemMounts := []mount{
+		{source: "proc", path: filepath.Join(rootfs, "proc"), device: "proc", flags: defaultMountFlags},
+	}
+
+	if len(mounts.OfType("devtmpfs")) == 1 {
+		systemMounts = append(systemMounts, mount{source: "tmpfs", path: filepath.Join(rootfs, "dev"), device: "tmpfs", flags: syscall.MS_NOSUID | syscall.MS_STRICTATIME, data: "mode=755"})
+	}
+	systemMounts = append(systemMounts, devMounts...)
+
 	if len(mounts.OfType("sysfs")) == 1 {
 		systemMounts = append(systemMounts, mount{source: "sysfs", path: filepath.Join(rootfs, "sys"), device: "sysfs", flags: defaultMountFlags})
 	}