diff --git a/rune/libcontainer/configs/validate/validator.go b/rune/libcontainer/configs/validate/validator.go
index c7794b1970e267d4bc3ee78cbb15a625143d2823..fc660538e0c9ba668cb54bec1fb690f8fded50e1 100644
--- a/rune/libcontainer/configs/validate/validator.go
+++ b/rune/libcontainer/configs/validate/validator.go
@@ -224,7 +224,7 @@ func (v *ConfigValidator) enclave(config *configs.Config) error {
 	path := config.Enclave.Path
 	if config.Enclave.Signer != "server" {
 		var err error
-		path, err = securejoin.SecureJoin(config.Rootfs, config.Enclave.Path)
+		path, err = securejoin.SecureJoin(config.Rootfs, path)
 		if err != nil {
 			return err
 		}
diff --git a/rune/libcontainer/container_linux.go b/rune/libcontainer/container_linux.go
index 66dd1c4c1c3652c652fa15818df8d3940122563e..0e7c8504183283fb65d5effa7616b1d5f48ce75c 100644
--- a/rune/libcontainer/container_linux.go
+++ b/rune/libcontainer/container_linux.go
@@ -532,11 +532,11 @@ func (c *linuxContainer) commandTemplate(p *Process, childInitPipe *os.File, chi
 		}
 
 		if c.config.Enclave.Path != "" {
-			cmd.Env = append(cmd.Env, "_LIBCONTAINER_PAL_PATH="+string(c.config.Enclave.Path))
+			cmd.Env = append(cmd.Env, "_LIBCONTAINER_PAL_PATH="+c.config.Enclave.Path)
 		}
 
 		if c.config.Enclave.Signer != "server" {
-			cmd.Env = append(cmd.Env, "_LIBCONTAINER_PAL_ROOTFS="+string(c.config.Rootfs))
+			cmd.Env = append(cmd.Env, "_LIBCONTAINER_PAL_ROOTFS="+c.config.Rootfs)
 		}
 
 		if detached {