diff --git a/confluent_server/bin/osdeploy b/confluent_server/bin/osdeploy
index 4c587206..36b4a3eb 100644
--- a/confluent_server/bin/osdeploy
+++ b/confluent_server/bin/osdeploy
@@ -167,10 +167,15 @@ def init_confluent_myname():
         if pid:
             os.waitpid(pid, 0)
         else:
-            os.setgid(hasconfluentuser.pw_gid)
-            os.setuid(hasconfluentuser.pw_uid)
-            collective.get_myname()
-            os._exit(0)
+            exitcode = 0
+            try:
+                os.setgid(hasconfluentuser.pw_gid)
+                os.setuid(hasconfluentuser.pw_uid)
+                collective.get_myname()
+            except Exception:
+                exitcode = 1
+            finally:
+                os._exit(exitcode)
 
 
 async def local_node_trust_setup():
diff --git a/confluent_server/confluent/messages.py b/confluent_server/confluent/messages.py
index a65f0af1..b5919a38 100644
--- a/confluent_server/confluent/messages.py
+++ b/confluent_server/confluent/messages.py
@@ -606,12 +606,14 @@ def checkaccess(user, filename, pwent, mode=os.R_OK):
     """
     child = os.fork()
     if child == 0:
-        os.setgroups(os.getgrouplist(user, pwent.pw_gid))
-        os.setgid(pwent.pw_gid)
-        os.setuid(pwent.pw_uid)
-        if os.access(filename, mode):
-            os._exit(0)
-        os._exit(1)
+        try:
+            os.setgroups(os.getgrouplist(user, pwent.pw_gid))
+            os.setgid(pwent.pw_gid)
+            os.setuid(pwent.pw_uid)
+            if os.access(filename, mode):
+                os._exit(0)
+        finally:
+            os._exit(1)
     else:
         pid, status = os.waitpid(child, 0)
         if os.WIFEXITED(status) and os.WEXITSTATUS(status) == 0:
diff --git a/imgutil/imgutil b/imgutil/imgutil
index 3fc33bc0..cfa5492d 100644
--- a/imgutil/imgutil
+++ b/imgutil/imgutil
@@ -965,18 +965,23 @@ def run_constrainedx(function, args):
     if pid:
         _, status = os.waitpid(pid, 0)
         return _exitcode_from_status(status)
-    libc.unshare(CLONE_NEWNS|CLONE_NEWPID)
-    # must fork again due to CLONE_NEWPID, or else lose the ability to make
-    # subprocesses
-    pid = os.fork()
-    if pid:
-        _, status = os.waitpid(pid, 0)
-        os._exit(_exitcode_from_status(status))
-    # we are pid 1 now
-    _mount('none', '/', flags=MS_REC|MS_PRIVATE)
-    _mount('proc', '/proc', fstype='proc')
-    function(*args)
-    os._exit(0)
+    exitcode = 0
+    try:
+        libc.unshare(CLONE_NEWNS|CLONE_NEWPID)
+        # must fork again due to CLONE_NEWPID, or else lose the ability to make
+        # subprocesses
+        pid = os.fork()
+        if pid:
+            _, status = os.waitpid(pid, 0)
+            os._exit(_exitcode_from_status(status))
+        # we are pid 1 now
+        _mount('none', '/', flags=MS_REC|MS_PRIVATE)
+        _mount('proc', '/proc', fstype='proc')
+        function(*args)
+    except Exception:
+        exitcode = 1
+    finally:
+        os._exit(exitcode)
 
 def run_constrained(function, args):
     # first fork to avoid changing namespace of unconstrained environment
@@ -984,18 +989,23 @@ def run_constrained(function, args):
     if pid:
         _, status = os.waitpid(pid, 0)
         return _exitcode_from_status(status)
-    libc.unshare(CLONE_NEWNS|CLONE_NEWPID)
-    # must fork again due to CLONE_NEWPID, or else lose the ability to make
-    # subprocesses
-    pid = os.fork()
-    if pid:
-        _, status = os.waitpid(pid, 0)
-        os._exit(_exitcode_from_status(status))
-    # we are pid 1 now
-    _mount('none', '/', flags=MS_REC|MS_PRIVATE)
-    _mount('proc', '/proc', fstype='proc')
-    function(args)
-    os._exit(0)
+    exitcode = 0
+    try:
+        libc.unshare(CLONE_NEWNS|CLONE_NEWPID)
+        # must fork again due to CLONE_NEWPID, or else lose the ability to make
+        # subprocesses
+        pid = os.fork()
+        if pid:
+            _, status = os.waitpid(pid, 0)
+            os._exit(_exitcode_from_status(status))
+        # we are pid 1 now
+        _mount('none', '/', flags=MS_REC|MS_PRIVATE)
+        _mount('proc', '/proc', fstype='proc')
+        function(args)
+    except Exception:
+        exitcode = 1
+    finally:
+        os._exit(exitcode)
 
 
 def main():