diff --git a/pkg/provision/buildroot.go b/pkg/provision/buildroot.go
index f0a2e9ca7f3a..be32b4bf9d77 100644
--- a/pkg/provision/buildroot.go
+++ b/pkg/provision/buildroot.go
@@ -110,6 +110,7 @@ Type=notify
 
 `
 	if noPivot {
+		log.Warn("Using fundamentally insecure --no-pivot option")
 		engineConfigTmpl += `
 # DOCKER_RAMDISK disables pivot_root in Docker, using MS_MOVE instead.
 Environment=DOCKER_RAMDISK=yes