diff --git a/pkg/archive/archive.go b/pkg/archive/archive.go
index f9c1289623..084a4fa077 100644
--- a/pkg/archive/archive.go
+++ b/pkg/archive/archive.go
@@ -942,7 +942,7 @@ loop:
 			parent := filepath.Dir(hdr.Name)
 			parentPath := filepath.Join(dest, parent)
 			if _, err := os.Lstat(parentPath); err != nil && os.IsNotExist(err) {
-				err = idtools.MkdirAllAndChownNew(parentPath, 0777, rootIDs)
+				err = idtools.MkdirAllAndChownNew(parentPath, 0755, rootIDs)
 				if err != nil {
 					return err
 				}
diff --git a/pkg/archive/archive_unix_test.go b/pkg/archive/archive_unix_test.go
index e308dd80c6..4eff66629c 100644
--- a/pkg/archive/archive_unix_test.go
+++ b/pkg/archive/archive_unix_test.go
@@ -3,6 +3,7 @@
 package archive // import "github.com/docker/docker/pkg/archive"
 
 import (
+	"archive/tar"
 	"bytes"
 	"fmt"
 	"io/ioutil"
@@ -156,6 +157,24 @@ func TestTarWithHardLinkAndRebase(t *testing.T) {
 	assert.Check(t, is.Equal(i1, i2))
 }
 
+// TestUntarParentPathPermissions is a regression test to check that missing
+// parent directories are created with the expected permissions
+func TestUntarParentPathPermissions(t *testing.T) {
+	buf := &bytes.Buffer{}
+	w := tar.NewWriter(buf)
+	err := w.WriteHeader(&tar.Header{Name: "foo/bar"})
+	assert.NilError(t, err)
+	tmpDir, err := ioutil.TempDir("", t.Name())
+	assert.NilError(t, err)
+	defer os.RemoveAll(tmpDir)
+	err = Untar(buf, tmpDir, nil)
+	assert.NilError(t, err)
+
+	fi, err := os.Lstat(filepath.Join(tmpDir, "foo"))
+	assert.NilError(t, err)
+	assert.Equal(t, fi.Mode(), 0755|os.ModeDir)
+}
+
 func getNlink(path string) (uint64, error) {
 	stat, err := os.Stat(path)
 	if err != nil {