diff --git a/pkg/shim/runsc/utils.go b/pkg/shim/runsc/utils.go
index 55f17d29e..8af17de29 100644
--- a/pkg/shim/runsc/utils.go
+++ b/pkg/shim/runsc/utils.go
@@ -36,20 +36,52 @@ func putBuf(b *bytes.Buffer) {
 	bytesBufferPool.Put(b)
 }
 
-// FormatRunscLogPath parses runsc config, and fill in %ID% in the log path.
-func FormatRunscLogPath(id string, config map[string]string) {
-	if path, ok := config["debug-log"]; ok {
-		config["debug-log"] = strings.Replace(path, "%ID%", id, -1)
+// pathLikeFlags are runsc flags which refer to paths to files.
+var pathLikeFlags = []string{
+	"log",
+	"panic-log",
+	"debug-log",
+	"coverage-report",
+	"profile-block",
+	"profile-cpu",
+	"profile-heap",
+	"profile-mutex",
+	"trace",
+}
+
+// replaceID replaces %ID% in `path` with the given sandbox ID.
+func replaceID(id string, path string) string {
+	return strings.Replace(path, "%ID%", id, -1)
+}
+
+// EmittedPaths returns a list of file paths that the sandbox may need to
+// create using the given configuration. Useful to create parent directories.
+func EmittedPaths(id string, config map[string]string) []string {
+	var paths []string
+	for _, cfgFlag := range pathLikeFlags {
+		if path, ok := config[cfgFlag]; ok {
+			paths = append(paths, replaceID(id, path))
+		}
+	}
+	return paths
+}
+
+// FormatRunscPaths fills in %ID% in path-like flags.
+func FormatRunscPaths(id string, config map[string]string) {
+	for _, cfgFlag := range pathLikeFlags {
+		if path, ok := config[cfgFlag]; ok {
+			config[cfgFlag] = replaceID(id, path)
+		}
 	}
 }
 
 // FormatShimLogPath creates the file path to the log file. It replaces %ID%
 // in the path with the provided "id". It also uses a default log name if the
-// path end with '/'.
+// path ends with '/'.
 func FormatShimLogPath(path string, id string) string {
 	if strings.HasSuffix(path, "/") {
 		// Default format: <path>/runsc-shim-<ID>.log
 		path += "runsc-shim-%ID%.log"
 	}
-	return strings.Replace(path, "%ID%", id, -1)
+	return replaceID(id, path)
 }
diff --git a/pkg/shim/service.go b/pkg/shim/service.go
index 3ae2816eb..1ac6c5fa4 100644
--- a/pkg/shim/service.go
+++ b/pkg/shim/service.go
@@ -401,6 +401,11 @@ func (s *service) create(ctx context.Context, r *taskAPI.CreateTaskRequest) (*ta
 		}
 		logrus.SetLevel(lvl)
 	}
+	for _, emittedPath := range runsc.EmittedPaths(s.id, s.opts.RunscConfig) {
+		if err := os.MkdirAll(filepath.Dir(emittedPath), 0777); err != nil {
+			return nil, fmt.Errorf("failed to create parent directories for file %v: %w", emittedPath, err)
+		}
+	}
 	if len(s.opts.LogPath) != 0 {
 		logPath := runsc.FormatShimLogPath(s.opts.LogPath, s.id)
 		if err := os.MkdirAll(filepath.Dir(logPath), 0777); err != nil {
@@ -1076,7 +1081,7 @@ func newInit(path, workDir, namespace string, platform stdio.Platform, r *proc.C
 		}
 	}
 
-	runsc.FormatRunscLogPath(r.ID, options.RunscConfig)
+	runsc.FormatRunscPaths(r.ID, options.RunscConfig)
 	runtime := proc.NewRunsc(options.Root, path, namespace, options.BinaryName, options.RunscConfig)
 	p := proc.New(r.ID, runtime, stdio.Stdio{
 		Stdin:    r.Stdin,
diff --git a/runsc/config/config.go b/runsc/config/config.go
index 7c1a53c56..eda7e9117 100644
--- a/runsc/config/config.go
+++ b/runsc/config/config.go
@@ -178,7 +178,7 @@ type Config struct {
 	// Controls defines the controls that may be enabled.
 	Controls controlConfig `flag:"controls"`
 
-	// RestoreFile is the path to the saved container image
+	// RestoreFile is the path to the saved container image.
 	RestoreFile string
 
 	// NumNetworkChannels controls the number of AF_PACKET sockets that map