diff --git a/src/agent/Cargo.toml b/src/agent/Cargo.toml
index a13d9a94e1..6f97b80428 100644
--- a/src/agent/Cargo.toml
+++ b/src/agent/Cargo.toml
@@ -20,6 +20,7 @@ prctl = "1.0.0"
 serde_json = "1.0.39"
 signal-hook = "0.1.9"
 scan_fmt = "0.2.3"
+scopeguard = "1.0.0"
 regex = "1"
 # slog:
 # - Dynamic keys required to allow HashMap keys to be slog::Serialized.
diff --git a/src/agent/src/grpc.rs b/src/agent/src/grpc.rs
index 441b7120c3..6c0ff713a6 100644
--- a/src/agent/src/grpc.rs
+++ b/src/agent/src/grpc.rs
@@ -113,7 +113,9 @@ impl agentService {
 
         // write spec to bundle path, hooks might
         // read ocispec
-        setup_bundle(oci)?;
+        let olddir = setup_bundle(oci)?;
+        // restore the cwd for kata-agent process.
+        defer!(unistd::chdir(&olddir).unwrap());
 
         let opts = CreateOpts {
             cgroup_name: "".to_string(),
@@ -1738,7 +1740,7 @@ fn do_copy_file(req: &CopyFileRequest) -> Result<()> {
     Ok(())
 }
 
-fn setup_bundle(gspec: &Spec) -> Result<()> {
+fn setup_bundle(gspec: &Spec) -> Result<PathBuf> {
     if gspec.Root.is_none() {
         return Err(nix::Error::Sys(Errno::EINVAL).into());
     }
@@ -1757,7 +1759,8 @@ fn setup_bundle(gspec: &Spec) -> Result<()> {
     );
     let _ = oci.save(config.as_str());
 
+    let olddir = unistd::getcwd().chain_err(|| "cannot getcwd")?;
     unistd::chdir(bundle_path)?;
 
-    Ok(())
+    Ok(olddir)
 }
diff --git a/src/agent/src/main.rs b/src/agent/src/main.rs
index a408922493..b8a54698f3 100644
--- a/src/agent/src/main.rs
+++ b/src/agent/src/main.rs
@@ -20,6 +20,9 @@ extern crate signal_hook;
 extern crate scan_fmt;
 extern crate oci;
 
+#[macro_use]
+extern crate scopeguard;
+
 #[macro_use]
 extern crate slog;
 extern crate slog_async;