diff --git a/daemon/create.go b/daemon/create.go
index 484952108a..b5522567e0 100644
--- a/daemon/create.go
+++ b/daemon/create.go
@@ -31,7 +31,13 @@ func (daemon *Daemon) ContainerCreate(params *ContainerCreateConfig) (types.Cont
 		return types.ContainerCreateResponse{ID: "", Warnings: warnings}, err
 	}
 
-	daemon.adaptContainerSettings(params.HostConfig, params.AdjustCPUShares)
+	if params.HostConfig == nil {
+		params.HostConfig = &runconfig.HostConfig{}
+	}
+	err = daemon.adaptContainerSettings(params.HostConfig, params.AdjustCPUShares)
+	if err != nil {
+		return types.ContainerCreateResponse{ID: "", Warnings: warnings}, err
+	}
 
 	container, err := daemon.create(params)
 	if err != nil {
@@ -62,15 +68,6 @@ func (daemon *Daemon) create(params *ContainerCreateConfig) (retC *Container, re
 		return nil, err
 	}
 
-	if params.HostConfig == nil {
-		params.HostConfig = &runconfig.HostConfig{}
-	}
-	if params.HostConfig.SecurityOpt == nil {
-		params.HostConfig.SecurityOpt, err = daemon.generateSecurityOpt(params.HostConfig.IpcMode, params.HostConfig.PidMode)
-		if err != nil {
-			return nil, err
-		}
-	}
 	if container, err = daemon.newContainer(params.Name, params.Config, imgID); err != nil {
 		return nil, err
 	}
diff --git a/daemon/daemon_unix.go b/daemon/daemon_unix.go
index daddd098f3..2a4e7dcae6 100644
--- a/daemon/daemon_unix.go
+++ b/daemon/daemon_unix.go
@@ -112,11 +112,7 @@ func checkKernel() error {
 
 // adaptContainerSettings is called during container creation to modify any
 // settings necessary in the HostConfig structure.
-func (daemon *Daemon) adaptContainerSettings(hostConfig *runconfig.HostConfig, adjustCPUShares bool) {
-	if hostConfig == nil {
-		return
-	}
-
+func (daemon *Daemon) adaptContainerSettings(hostConfig *runconfig.HostConfig, adjustCPUShares bool) error {
 	if adjustCPUShares && hostConfig.CPUShares > 0 {
 		// Handle unsupported CPUShares
 		if hostConfig.CPUShares < linuxMinCPUShares {
@@ -135,6 +131,15 @@ func (daemon *Daemon) adaptContainerSettings(hostConfig *runconfig.HostConfig, a
 		shmSize := runconfig.DefaultSHMSize
 		hostConfig.ShmSize = &shmSize
 	}
+	var err error
+	if hostConfig.SecurityOpt == nil {
+		hostConfig.SecurityOpt, err = daemon.generateSecurityOpt(hostConfig.IpcMode, hostConfig.PidMode)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
 }
 
 // verifyPlatformContainerSettings performs platform-specific validation of the