diff --git a/cmd/ctr/commands/tasks/exec.go b/cmd/ctr/commands/tasks/exec.go
index fc18da4ac..3f31e2796 100644
--- a/cmd/ctr/commands/tasks/exec.go
+++ b/cmd/ctr/commands/tasks/exec.go
@@ -26,6 +26,7 @@ import (
 	"github.com/containerd/containerd"
 	"github.com/containerd/containerd/cio"
 	"github.com/containerd/containerd/cmd/ctr/commands"
+	"github.com/containerd/containerd/oci"
 	"github.com/sirupsen/logrus"
 	"github.com/urfave/cli"
 )
@@ -61,6 +62,10 @@ var execCommand = cli.Command{
 			Name:  "log-uri",
 			Usage: "log uri for custom shim logging",
 		},
+		cli.StringFlag{
+			Name:  "user",
+			Usage: "user id or name",
+		},
 	},
 	Action: func(context *cli.Context) error {
 		var (
@@ -85,15 +90,25 @@ var execCommand = cli.Command{
 		if err != nil {
 			return err
 		}
-		task, err := container.Task(ctx, nil)
-		if err != nil {
-			return err
+		if user := context.String("user"); user != "" {
+			c, err := container.Info(ctx)
+			if err != nil {
+				return err
+			}
+			if err := oci.WithUser(user)(ctx, client, &c, spec); err != nil {
+				return err
+			}
 		}
 
 		pspec := spec.Process
 		pspec.Terminal = tty
 		pspec.Args = args
 
+		task, err := container.Task(ctx, nil)
+		if err != nil {
+			return err
+		}
+
 		var (
 			ioCreator cio.Creator
 			stdinC    = &stdinCloser{