diff --git a/libcontainer/criu_linux.go b/libcontainer/criu_linux.go
index 53a0202..28825d6 100644
--- a/libcontainer/criu_linux.go
+++ b/libcontainer/criu_linux.go
@@ -222,6 +222,9 @@ func (c *Container) handleRestoringNamespaces(rpcOpts *criurpc.CriuOpts, extraFi
 				return err
 			}
 		default:
+			if ns.Type == configs.NEWUTS {
+				continue
+			}
 			// For all other namespaces except NET and PID CRIU has
 			// a simpler way of joining the existing namespace if set
 			nsPath := c.config.Namespaces.PathOf(ns.Type)
@@ -843,9 +846,14 @@ func (c *Container) criuApplyCgroups(pid int, req *criurpc.CriuReq) error {
 		return nil
 	}
 
-	// XXX: Do we need to deal with this case? AFAIK criu still requires root.
+	// Rootless outer runtimes may provide no delegated cgroup. Match runc's
+	// ordinary init-process handling by ignoring ErrRootless when there is no
+	// configured cgroup path or resource limit.
 	if err := c.cgroupManager.Apply(pid); err != nil {
-		return err
+		if !errors.Is(err, cgroups.ErrRootless) {
+			return err
+		}
+		return nil
 	}
 
 	if err := c.cgroupManager.Set(c.config.Cgroups.Resources); err != nil {