diff --git a/libpod/container_internal_freebsd.go b/libpod/container_internal_freebsd.go
index 32e1f1a8d7..286ad67912 100644
--- a/libpod/container_internal_freebsd.go
+++ b/libpod/container_internal_freebsd.go
@@ -186,7 +186,7 @@ func (c *Container) getOCICgroupPath() (string, error) {
 
 func openDirectory(path string) (fd int, err error) {
 	const O_PATH = 0x00400000
-	return unix.Open(path, unix.O_RDONLY|O_PATH, 0)
+	return unix.Open(path, unix.O_RDONLY|O_PATH|unix.O_CLOEXEC, 0)
 }
 
 func (c *Container) addNetworkNamespace(g *generate.Generator) error {