diff --git a/pkg/archive/archive.go b/pkg/archive/archive.go
index 5fb3995e9b..daddebded4 100644
--- a/pkg/archive/archive.go
+++ b/pkg/archive/archive.go
@@ -127,6 +127,7 @@ func IsArchivePath(path string) bool {
 	if err != nil {
 		return false
 	}
+	defer rdr.Close()
 	r := tar.NewReader(rdr)
 	_, err = r.Next()
 	return err == nil
diff --git a/pkg/archive/diff.go b/pkg/archive/diff.go
index d0cff98ffc..fae4b9de02 100644
--- a/pkg/archive/diff.go
+++ b/pkg/archive/diff.go
@@ -247,10 +247,12 @@ func applyLayerHandler(dest string, layer io.Reader, options *TarOptions, decomp
 	defer system.Umask(oldmask) // ignore err, ErrNotSupportedPlatform
 
 	if decompress {
-		layer, err = DecompressStream(layer)
+		decompLayer, err := DecompressStream(layer)
 		if err != nil {
 			return 0, err
 		}
+		defer decompLayer.Close()
+		layer = decompLayer
 	}
 	return UnpackLayer(dest, layer, options)
 }
diff --git a/plugin/blobstore.go b/plugin/blobstore.go
index fd7f040efc..a24e7bdf4f 100644
--- a/plugin/blobstore.go
+++ b/plugin/blobstore.go
@@ -145,6 +145,7 @@ func (dm *downloadManager) Download(ctx context.Context, initialRootFS image.Roo
 		if err != nil {
 			return initialRootFS, nil, err
 		}
+		defer inflatedLayerData.Close()
 		digester := digest.Canonical.Digester()
 		if _, err := chrootarchive.ApplyLayer(dm.tmpDir, io.TeeReader(inflatedLayerData, digester.Hash())); err != nil {
 			return initialRootFS, nil, err