diff --git a/runsc/test/root/crictl_test.go b/runsc/test/root/crictl_test.go
index 88e24782a..556d95fff 100644
--- a/runsc/test/root/crictl_test.go
+++ b/runsc/test/root/crictl_test.go
@@ -25,6 +25,7 @@ import (
 	"os/exec"
 	"path"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 
@@ -79,6 +80,43 @@ func TestMountPaths(t *testing.T) {
 		t.Fatal(err)
 	}
 }
+func TestMountOverSymlinks(t *testing.T) {
+	// Setup containerd and crictl.
+	crictl, cleanup, err := setup(t)
+	if err != nil {
+		t.Fatalf("failed to setup crictl: %v", err)
+	}
+	defer cleanup()
+	podID, contID, err := crictl.StartPodAndContainer("k8s.gcr.io/busybox", testdata.Sandbox, testdata.MountOverSymlink)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	out, err := crictl.Exec(contID, "readlink", "/etc/resolv.conf")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := "/tmp/resolv.conf"; !strings.Contains(string(out), want) {
+		t.Fatalf("/etc/resolv.conf is not pointing to %q: %q", want, string(out))
+	}
+
+	etc, err := crictl.Exec(contID, "cat", "/etc/resolv.conf")
+	if err != nil {
+		t.Fatal(err)
+	}
+	tmp, err := crictl.Exec(contID, "cat", "/tmp/resolv.conf")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if tmp != etc {
+		t.Fatalf("file content doesn't match:\n\t/etc/resolv.conf: %s\n\t/tmp/resolv.conf: %s", string(etc), string(tmp))
+	}
+
+	// Stop everything.
+	if err := crictl.StopPodAndContainer(podID, contID); err != nil {
+		t.Fatal(err)
+	}
+}
 
 // setup sets up before a test. Specifically it:
 // * Creates directories and a socket for containerd to utilize.
diff --git a/runsc/test/root/testdata/BUILD b/runsc/test/root/testdata/BUILD
index a22635129..6c9fe0aea 100644
--- a/runsc/test/root/testdata/BUILD
+++ b/runsc/test/root/testdata/BUILD
@@ -5,6 +5,7 @@ package(licenses = ["notice"])  # Apache 2.0
 go_library(
     name = "testdata",
     srcs = [
+        "busybox.go",
         "containerd_config.go",
         "httpd.go",
         "httpd_mount_paths.go",
diff --git a/runsc/test/root/testdata/busybox.go b/runsc/test/root/testdata/busybox.go
new file mode 100644
index 000000000..544571c63
--- /dev/null
+++ b/runsc/test/root/testdata/busybox.go
@@ -0,0 +1,32 @@
+// Copyright 2018 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package testdata
+
+// MountOverSymlink is a JSON config for a container that /etc/resolv.conf is a
+// symlink to /tmp/resolv.conf.
+var MountOverSymlink = `
+{
+        "metadata": {
+                "name": "busybox"
+        },
+        "image": {
+                "image": "k8s.gcr.io/busybox"
+        },
+        "command": [
+                "sleep",
+                "1000"
+        ]
+}
+`
diff --git a/runsc/test/testutil/crictl.go b/runsc/test/testutil/crictl.go
index 4f82e8234..84bb4475a 100644
--- a/runsc/test/testutil/crictl.go
+++ b/runsc/test/testutil/crictl.go
@@ -92,6 +92,17 @@ func (cc *Crictl) Stop(contID string) error {
 	return err
 }
 
+// Exec execs a program inside a container. It corresponds to `crictl exec`.
+func (cc *Crictl) Exec(contID string, args ...string) (string, error) {
+	a := []string{"exec", contID}
+	a = append(a, args...)
+	output, err := cc.run(a...)
+	if err != nil {
+		return "", fmt.Errorf("exec failed: %v", err)
+	}
+	return output, nil
+}
+
 // Rm removes a container. It corresponds to `crictl rm`.
 func (cc *Crictl) Rm(contID string) error {
 	_, err := cc.run("rm", contID)