diff --git a/runsc/boot/loader.go b/runsc/boot/loader.go
index c9d06500a..1c04de808 100644
--- a/runsc/boot/loader.go
+++ b/runsc/boot/loader.go
@@ -231,9 +231,15 @@ type Loader struct {
 	// naming when user didn't provide one.
 	//
 	// Mapping: name -> cid.
-	// processes is guarded by mu.
+	// containerIDs is guarded by mu.
 	containerIDs map[string]string
 
+	// containerSpecs stores container specs for each container in sandbox.
+	//
+	// Mapping: cid -> spec.
+	// containerSpecs is guarded by mu.
+	containerSpecs map[string]*specs.Spec
+
 	// portForwardProxies is a list of active port forwarding connections.
 	//
 	// portForwardProxies is guarded by mu.
@@ -412,14 +418,15 @@ func New(args Args) (*Loader, error) {
 
 	eid := execID{cid: args.ID}
 	l := &Loader{
-		sandboxID:     args.ID,
-		processes:     map[execID]*execProcess{eid: {}},
-		sharedMounts:  make(map[string]*vfs.Mount),
-		stopProfiling: stopProfiling,
-		productName:   args.ProductName,
-		hostShmemHuge: args.HostShmemHuge,
-		containerIDs:  map[string]string{},
-		saveFDs:       args.SaveFDs,
+		sandboxID:      args.ID,
+		processes:      map[execID]*execProcess{eid: {}},
+		sharedMounts:   make(map[string]*vfs.Mount),
+		stopProfiling:  stopProfiling,
+		productName:    args.ProductName,
+		hostShmemHuge:  args.HostShmemHuge,
+		containerIDs:   make(map[string]string),
+		containerSpecs: make(map[string]*specs.Spec),
+		saveFDs:        args.SaveFDs,
 	}
 
 	containerName := l.registerContainerLocked(args.Spec, args.ID)
@@ -1885,9 +1892,16 @@ func (l *Loader) registerContainerLocked(spec *specs.Spec, cid string) string {
 	}
 
 	l.containerIDs[containerName] = cid
+	l.containerSpecs[cid] = spec
 	return containerName
 }
 
+func (l *Loader) getContainerSpec(cid string) *specs.Spec {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	return l.containerSpecs[cid]
+}
+
 func (l *Loader) containerRuntimeState(cid string) ContainerRuntimeState {
 	l.mu.Lock()
 	defer l.mu.Unlock()