diff --git a/cmd/buildkitd/config/config.go b/cmd/buildkitd/config/config.go
index 1418132b..7ee7b577 100644
--- a/cmd/buildkitd/config/config.go
+++ b/cmd/buildkitd/config/config.go
@@ -70,6 +70,7 @@ type OCIConfig struct {
 	// For use in storing the OCI worker binary name that will replace buildkit-runc
 	Binary               string `toml:"binary"`
 	ProxySnapshotterPath string `toml:"proxySnapshotterPath"`
+	DefaultCgroupParent  string `toml:"defaultCgroupParent"`
 
 	// StargzSnapshotterConfig is configuration for stargz snapshotter.
 	// We use a generic map[string]interface{} in order to remove the dependency
diff --git a/cmd/buildkitd/main_oci_worker.go b/cmd/buildkitd/main_oci_worker.go
index 2fb211ea..a2cdaa81 100644
--- a/cmd/buildkitd/main_oci_worker.go
+++ b/cmd/buildkitd/main_oci_worker.go
@@ -289,7 +289,7 @@ func ociWorkerInitializer(c *cli.Context, common workerInitializerOpt) ([]worker
 		parallelismSem = semaphore.NewWeighted(int64(cfg.MaxParallelism))
 	}
 
-	opt, err := runc.NewWorkerOpt(common.config.Root, snFactory, cfg.Rootless, processMode, cfg.Labels, idmapping, nc, dns, cfg.Binary, cfg.ApparmorProfile, parallelismSem, common.traceSocket)
+	opt, err := runc.NewWorkerOpt(common.config.Root, snFactory, cfg.Rootless, processMode, cfg.Labels, idmapping, nc, dns, cfg.Binary, cfg.ApparmorProfile, parallelismSem, common.traceSocket, cfg.DefaultCgroupParent)
 	if err != nil {
 		return nil, err
 	}
diff --git a/worker/runc/runc.go b/worker/runc/runc.go
index 389d304c..9ee6339b 100644
--- a/worker/runc/runc.go
+++ b/worker/runc/runc.go
@@ -33,7 +33,7 @@ type SnapshotterFactory struct {
 }
 
 // NewWorkerOpt creates a WorkerOpt.
-func NewWorkerOpt(root string, snFactory SnapshotterFactory, rootless bool, processMode oci.ProcessMode, labels map[string]string, idmap *idtools.IdentityMapping, nopt netproviders.Opt, dns *oci.DNSConfig, binary, apparmorProfile string, parallelismSem *semaphore.Weighted, traceSocket string) (base.WorkerOpt, error) {
+func NewWorkerOpt(root string, snFactory SnapshotterFactory, rootless bool, processMode oci.ProcessMode, labels map[string]string, idmap *idtools.IdentityMapping, nopt netproviders.Opt, dns *oci.DNSConfig, binary, apparmorProfile string, parallelismSem *semaphore.Weighted, traceSocket, defaultCgroupParent string) (base.WorkerOpt, error) {
 	var opt base.WorkerOpt
 	name := "runc-" + snFactory.Name
 	root = filepath.Join(root, name)
@@ -59,12 +59,13 @@ func NewWorkerOpt(root string, snFactory SnapshotterFactory, rootless bool, proc
 		// Otherwise, a nil array will be sent and the default OCI worker binary will be used
 		CommandCandidates: cmds,
 		// without root privileges
-		Rootless:        rootless,
-		ProcessMode:     processMode,
-		IdentityMapping: idmap,
-		DNS:             dns,
-		ApparmorProfile: apparmorProfile,
-		TracingSocket:   traceSocket,
+		Rootless:            rootless,
+		ProcessMode:         processMode,
+		IdentityMapping:     idmap,
+		DNS:                 dns,
+		ApparmorProfile:     apparmorProfile,
+		TracingSocket:       traceSocket,
+		DefaultCgroupParent: defaultCgroupParent,
 	}, np)
 	if err != nil {
 		return opt, err
diff --git a/worker/runc/runc_test.go b/worker/runc/runc_test.go
index 06a0b83d..bcaaf812 100644
--- a/worker/runc/runc_test.go
+++ b/worker/runc/runc_test.go
@@ -41,7 +41,7 @@ func newWorkerOpt(t *testing.T, processMode oci.ProcessMode) (base.WorkerOpt, fu
 		},
 	}
 	rootless := false
-	workerOpt, err := NewWorkerOpt(tmpdir, snFactory, rootless, processMode, nil, nil, netproviders.Opt{Mode: "host"}, nil, "", "", nil, "")
+	workerOpt, err := NewWorkerOpt(tmpdir, snFactory, rootless, processMode, nil, nil, netproviders.Opt{Mode: "host"}, nil, "", "", nil, "", "")
 	require.NoError(t, err)
 
 	return workerOpt, cleanup