diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 78e02ef5d..2b921dfa2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -269,6 +269,16 @@ jobs:
         with:
           go-version: '1.13.10'
 
+      - name: Setup gosu
+        shell: bash
+        run: |
+          GOSU=/usr/local/bin/gosu
+          arch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"
+          sudo wget -O ${GOSU} "https://github.com/tianon/gosu/releases/download/1.12/gosu-$arch"
+          sudo chmod +x ${GOSU}
+          sudo chown root ${GOSU}
+          sudo chmod +s ${GOSU}
+
       - name: Set env
         shell: bash
         run: |
@@ -285,7 +295,7 @@ jobs:
           RUNC_FLAVOR: ${{ matrix.runc }}
         run: |
           sudo PATH=$PATH script/setup/install-seccomp
-          script/setup/install-runc
+          gosu root script/setup/install-runc
           script/setup/install-cni
           script/setup/install-critools
         working-directory: src/github.com/containerd/containerd
diff --git a/script/setup/install-runc b/script/setup/install-runc
index 165e5817d..1ee85ffad 100755
--- a/script/setup/install-runc
+++ b/script/setup/install-runc
@@ -27,13 +27,13 @@ function install_runc() {
 	cd "$GOPATH"/src/github.com/opencontainers/runc
 	git checkout $RUNC_COMMIT
 	make BUILDTAGS='apparmor seccomp selinux' runc
-	sudo make install
+	make install
 }
 
 function install_crun() {
 	CRUN_VERSION=0.11
-	sudo curl -o /usr/local/sbin/runc -L https://github.com/containers/crun/releases/download/${CRUN_VERSION}/crun-${CRUN_VERSION}-static-$(uname -m)
-	sudo chmod +x /usr/local/sbin/runc
+	curl -o /usr/local/sbin/runc -L https://github.com/containers/crun/releases/download/${CRUN_VERSION}/crun-${CRUN_VERSION}-static-$(uname -m)
+	chmod +x /usr/local/sbin/runc
 }
 
 : ${RUNC_FLAVOR=runc}
@@ -44,4 +44,4 @@ crun) install_crun ;;
 	echo >&2 "unknown runc flavor: ${RUNC_FLAVOR}"
 	exit 1
 	;;
-esac
+esac
\ No newline at end of file