diff --git a/validate/validate.go b/validate/validate.go
index 2889895be..4fc19180e 100644
--- a/validate/validate.go
+++ b/validate/validate.go
@@ -115,11 +115,23 @@ func (v *Validator) CheckAll() (msgs []string) {
 func (v *Validator) CheckRootfsPath() (msgs []string) {
 	logrus.Debugf("check rootfs path")
 
+	absBundlePath, err := filepath.Abs(v.bundlePath)
+	if err != nil {
+		msgs = append(msgs, fmt.Sprintf("unable to convert %q to an absolute path", v.bundlePath))
+	}
+
 	var rootfsPath string
+	var absRootPath string
 	if filepath.IsAbs(v.spec.Root.Path) {
 		rootfsPath = v.spec.Root.Path
+		absRootPath = filepath.Clean(rootfsPath)
 	} else {
+		var err error
 		rootfsPath = filepath.Join(v.bundlePath, v.spec.Root.Path)
+		absRootPath, err = filepath.Abs(rootfsPath)
+		if err != nil {
+			msgs = append(msgs, fmt.Sprintf("unable to convert %q to an absolute path", rootfsPath))
+		}
 	}
 
 	if fi, err := os.Stat(rootfsPath); err != nil {
@@ -128,6 +140,11 @@ func (v *Validator) CheckRootfsPath() (msgs []string) {
 		msgs = append(msgs, fmt.Sprintf("The root path %q is not a directory.", rootfsPath))
 	}
 
+	rootParent := filepath.Dir(absRootPath)
+	if absRootPath == string(filepath.Separator) || rootParent != absBundlePath {
+		msgs = append(msgs, fmt.Sprintf("root.path is %q, but it MUST be a child of %q", v.spec.Root.Path, absBundlePath))
+	}
+
 	return
 
 }