diff --git a/.run-travis-tests.sh b/.run-travis-tests.sh
index 0cf036fa..ee95c456 100755
--- a/.run-travis-tests.sh
+++ b/.run-travis-tests.sh
@@ -5,13 +5,13 @@ export OPAMYES=true
 sudo wget https://github.com/opencontainers/runc/releases/download/v1.0.0-rc92/runc.amd64 -O /usr/local/bin/runc
 sudo chmod a+x /usr/local/bin/runc
 
-ZFS_LOOP=$(sudo losetup -f)
 dd if=/dev/zero of=/tmp/zfs.img bs=100M count=50
+ZFS_LOOP=$(sudo losetup -f)
 sudo losetup -P $ZFS_LOOP /tmp/zfs.img
 sudo zpool create zfs $ZFS_LOOP
 
-BTRFS_LOOP=$(sudo losetup -f)
 dd if=/dev/zero of=/tmp/btrfs.img bs=100M count=50
+BTRFS_LOOP=$(sudo losetup -f)
 sudo losetup -P $BTRFS_LOOP /tmp/btrfs.img
 sudo mkfs.btrfs -f $BTRFS_LOOP
 sudo mkdir /btrfs
diff --git a/lib/runc_sandbox.ml b/lib/runc_sandbox.ml
index 7c95c3ab..5e429eb5 100644
--- a/lib/runc_sandbox.ml
+++ b/lib/runc_sandbox.ml
@@ -280,7 +280,7 @@ let copy_to_log ~src ~dst =
   aux ()
 
 let run ~cancelled ?stdin:stdin ~log t config results_dir =
-  Lwt_io.with_temp_dir ~prefix:"obuilder-runc-" @@ fun tmp ->
+  Lwt_io.with_temp_dir ~perm:0o700 ~prefix:"obuilder-runc-" @@ fun tmp ->
   let json_config = Json_config.make config ~config_dir:tmp ~results_dir t in
   Os.write_file ~path:(tmp / "config.json") (Yojson.Safe.pretty_to_string json_config ^ "\n") >>= fun () ->
   Os.write_file ~path:(tmp / "hosts") "127.0.0.1 localhost builder" >>= fun () ->