diff --git a/runsc/config/config.go b/runsc/config/config.go
index 91142888f..a07eab92a 100644
--- a/runsc/config/config.go
+++ b/runsc/config/config.go
@@ -208,6 +208,9 @@ type Config struct {
 	// Mounts the cgroup filesystem backed by the sentry's cgroupfs.
 	Cgroupfs bool `flag:"cgroupfs"`
 
+	// Don't configure cgroups.
+	IgnoreCgroups bool `flag:"ignore-cgroups"`
+
 	// TestOnlyAllowRunAsCurrentUserWithoutChroot should only be used in
 	// tests. It allows runsc to start the sandbox process as the current
 	// user, and without chrooting the sandbox process. This can be
diff --git a/runsc/config/flags.go b/runsc/config/flags.go
index f63bd11c1..5678cd6b6 100644
--- a/runsc/config/flags.go
+++ b/runsc/config/flags.go
@@ -84,6 +84,7 @@ func RegisterFlags() {
 		flag.Bool("fuse", false, "TEST ONLY; use while FUSE in VFSv2 is landing. This allows the use of the new experimental FUSE filesystem.")
 		flag.Bool("lisafs", false, "Enables lisafs protocol instead of 9P. This is only effective with VFS2.")
 		flag.Bool("cgroupfs", false, "Automatically mount cgroupfs.")
+		flag.Bool("ignore-cgroups", false, "don't configure cgroups.")
 
 		// Flags that control sandbox runtime behavior: network related.
 		flag.Var(networkTypePtr(NetworkSandbox), "network", "specifies which network to use: sandbox (default), host, none. Using network inside the sandbox is more secure because it's isolated from the host network.")
diff --git a/runsc/container/container.go b/runsc/container/container.go
index 58e95c53b..1977a16e7 100644
--- a/runsc/container/container.go
+++ b/runsc/container/container.go
@@ -243,11 +243,16 @@ func New(conf *config.Config, args Args) (*Container, error) {
 		if args.Spec.Linux.CgroupsPath == "" && !conf.TestOnlyAllowRunAsCurrentUserWithoutChroot {
 			args.Spec.Linux.CgroupsPath = "/" + args.ID
 		}
-		// Create and join cgroup before processes are created to ensure they are
-		// part of the cgroup from the start (and all their children processes).
-		parentCgroup, subCgroup, err := c.setupCgroupForRoot(conf, args.Spec)
-		if err != nil {
-			return nil, err
+		var subCgroup, parentCgroup cgroup.Cgroup
+		if !conf.IgnoreCgroups {
+			var err error
+
+			// Create and join cgroup before processes are created to ensure they are
+			// part of the cgroup from the start (and all their children processes).
+			parentCgroup, subCgroup, err = c.setupCgroupForRoot(conf, args.Spec)
+			if err != nil {
+				return nil, err
+			}
 		}
 		c.CompatCgroup = cgroup.CgroupJSON{Cgroup: subCgroup}
 		if err := runInCgroup(parentCgroup, func() error {