diff --git a/docs/Developer-Guide.md b/docs/Developer-Guide.md
index d6f71af065..7dd6fed24c 100644
--- a/docs/Developer-Guide.md
+++ b/docs/Developer-Guide.md
@@ -491,7 +491,7 @@ exit
 ```
 
 `kata-runtime exec` has a command-line option `runtime-namespace`, which is used to specify under which [runtime namespace](https://github.com/containerd/containerd/blob/master/docs/namespaces.md) the particular pod was created. By default, it is set to `k8s.io` and works for containerd when configured
- with Kubernetes. This should not be confused with [Kubernetes namespaces](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/).
+ with Kubernetes. For CRI-O, the namespace should set to `default` explicitly. This should not be confused with [Kubernetes namespaces](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/).
 For other CRI-runtimes and configurations, you may need to set the namespace utilizing the `runtime-namespace` option.
 
 If you want to access guest OS through a traditional way, see [Traditional debug console setup)](#traditional-debug-console-setup).
diff --git a/src/runtime/cli/kata-exec.go b/src/runtime/cli/kata-exec.go
index bbe8cd89e9..83a314aa72 100644
--- a/src/runtime/cli/kata-exec.go
+++ b/src/runtime/cli/kata-exec.go
@@ -14,6 +14,7 @@ import (
 	"net/http"
 	"net/url"
 	"os"
+	"path/filepath"
 	"strings"
 
 	"sync"
@@ -175,7 +176,7 @@ func (s *iostream) Read(data []byte) (n int, err error) {
 }
 
 func getConn(namespace, sandboxID string, port uint64) (net.Conn, error) {
-	socketAddr := fmt.Sprintf("/containerd-shim/%s/%s/shim-monitor.sock", namespace, sandboxID)
+	socketAddr := filepath.Join(string(filepath.Separator), "containerd-shim", namespace, sandboxID, "shim-monitor.sock")
 	client, err := kataMonitor.BuildUnixSocketClient(socketAddr, defaultTimeout)
 	if err != nil {
 		return nil, err