diff --git a/rock/rocklet/local_files/docker_run.sh b/rock/rocklet/local_files/docker_run.sh
index 2eddc4e73a..cc7e1a1977 100755
--- a/rock/rocklet/local_files/docker_run.sh
+++ b/rock/rocklet/local_files/docker_run.sh
@@ -38,13 +38,27 @@ setup_kata_dind() {
             docker_root="$custom_root"
         fi
     fi
-    mkdir -p "$docker_root"
-    for i in $(seq 0 7); do
-        mknod -m 660 /dev/loop$i b 7 $i 2>/dev/null || true
-    done
-    mount -o loop /docker-disk.img "$docker_root"
-    mount -o remount,rw /sys/fs/cgroup
-    mount -o remount,rw /proc/sys
+    # Directory creation requires write and execute permissions on the nearest existing parent.
+    if [ ! -d "$docker_root" ]; then
+        local nearest_existing_path="$docker_root"
+        while [ ! -e "$nearest_existing_path" ]; do
+            nearest_existing_path=$(dirname "$nearest_existing_path")
+        done
+        if [ ! -d "$nearest_existing_path" ] || [ ! -w "$nearest_existing_path" ] || [ ! -x "$nearest_existing_path" ]; then
+            echo "Warning: no permission to create Docker data root '$docker_root'; skipping Kata DinD setup." >&2
+        else
+            mkdir -p "$docker_root"
+        fi
+    fi
+
+    if [ -d "$docker_root" ]; then
+        for i in $(seq 0 7); do
+            mknod -m 660 /dev/loop$i b 7 $i 2>/dev/null || true
+        done
+        mount -o loop /docker-disk.img "$docker_root"
+        mount -o remount,rw /sys/fs/cgroup
+        mount -o remount,rw /proc/sys
+    fi
 }
 
 # Run rocklet
@@ -88,4 +102,4 @@ else
     # glibc-based distributions
     mkdir -p "${LOG_DIR}"
     /tmp/miniforge/bin/rocklet --port ${port} >> "${LOG_DIR}/rocklet_uvicorn.log" 2>&1
-fi
\ No newline at end of file
+fi