diff --git a/Makefile b/Makefile
index addfd5072..01c321277 100644
--- a/Makefile
+++ b/Makefile
@@ -327,7 +327,7 @@ fsstress-test: load-basic $(RUNTIME_BIN)
 # Specific containerd version tests.
 containerd-test-%: load-basic_alpine load-basic_python load-basic_busybox load-basic_symlink-resolv load-basic_httpd load-basic_ubuntu $(RUNTIME_BIN)
 	@$(call install_runtime,$(RUNTIME),) # Clear flags.
-	@sudo tools/install_containerd.sh $*
+	@sudo -H tools/install_containerd.sh $*
 ifeq (,$(STAGED_BINARIES))
 	@$(call sudocopy,//shim:containerd-shim-runsc-v1,"$$(dirname $$(which containerd))")
 else
diff --git a/tools/install_containerd.sh b/tools/install_containerd.sh
index 599647e45..b9742eedc 100755
--- a/tools/install_containerd.sh
+++ b/tools/install_containerd.sh
@@ -16,9 +16,21 @@
 
 set -xeo pipefail
 
+# This script should be run with 'sudo -H'. $HOME must be set correctly because
+# we invoke other scripts below that build Go binaries. In some operating
+# systems, sudo(8) does not change $HOME by default. In such cases, root user
+# ends up creating files in ~/.cache/go-build for the non-root user. This can
+# cause future invocations of go build to fail due to permission issues.
+if [[ "$EUID" -ne 0 ]]; then
+  echo "Run this script with sudo -H"
+  exit 1
+fi
+
 declare -r CONTAINERD_VERSION=${1:-1.3.0}
-declare -r CONTAINERD_MAJOR="$(echo ${CONTAINERD_VERSION} | awk -F '.' '{ print $1; }')"
-declare -r CONTAINERD_MINOR="$(echo ${CONTAINERD_VERSION} | awk -F '.' '{ print $2; }')"
+CONTAINERD_MAJOR="$(echo "${CONTAINERD_VERSION}" | awk -F '.' '{ print $1; }')"
+declare -r CONTAINERD_MAJOR
+CONTAINERD_MINOR="$(echo "${CONTAINERD_VERSION}" | awk -F '.' '{ print $2; }')"
+declare -r CONTAINERD_MINOR
 declare -r CRITOOLS_VERSION=${CRITOOLS_VERSION:-1.18.0}
 
 if [[ "${CONTAINERD_MAJOR}" -eq 1 ]] && [[ "${CONTAINERD_MINOR}" -le 4 ]]; then
@@ -39,7 +51,7 @@ install_helper() {
   declare -r TAG="${2}"
 
   # Clone the repository.
-  mkdir -p "${GOPATH}"/src/$(dirname "${PACKAGE}") && \
+  mkdir -p "${GOPATH}"/src/"$(dirname "${PACKAGE}")" && \
      git clone https://"${PACKAGE}" "${GOPATH}"/src/"${PACKAGE}"
 
   # Checkout and build the repository.
@@ -77,14 +89,15 @@ while true; do
 done
 
 # Install containerd & cri-tools.
-declare -rx GOPATH=$(mktemp -d --tmpdir gopathXXXXX)
+GOPATH=$(mktemp -d --tmpdir gopathXXXXX)
+declare -rx GOPATH
 install_helper github.com/containerd/containerd "v${CONTAINERD_VERSION}"
 install_helper github.com/kubernetes-sigs/cri-tools "v${CRITOOLS_VERSION}"
 
 # Configure containerd-shim.
 declare -r shim_config_path=/etc/containerd/runsc/config.toml
-mkdir -p $(dirname ${shim_config_path})
-cat > ${shim_config_path} <<-EOF
+mkdir -p "$(dirname "${shim_config_path}")"
+tee ${shim_config_path} <<-EOF
 log_path = "/tmp/shim-logs/"
 log_level = "debug"
 
@@ -97,7 +110,7 @@ EOF
 
 # Configure CNI.
 (cd "${GOPATH}" && src/github.com/containerd/containerd/script/setup/install-cni)
-cat <<EOF | sudo tee /etc/cni/net.d/10-bridge.conf
+tee /etc/cni/net.d/10-bridge.conf <<EOF
 {
   "cniVersion": "0.3.1",
   "name": "bridge",
@@ -114,7 +127,7 @@ cat <<EOF | sudo tee /etc/cni/net.d/10-bridge.conf
   }
 }
 EOF
-cat <<EOF | sudo tee /etc/cni/net.d/99-loopback.conf
+tee /etc/cni/net.d/99-loopback.conf <<EOF
 {
   "cniVersion": "0.3.1",
   "type": "loopback"
@@ -122,7 +135,7 @@ cat <<EOF | sudo tee /etc/cni/net.d/99-loopback.conf
 EOF
 
 # Configure crictl.
-cat <<EOF | sudo tee /etc/crictl.yaml
+tee /etc/crictl.yaml <<EOF
 runtime-endpoint: unix:///run/containerd/containerd.sock
 EOF