diff --git a/components/engine/container/container.go b/components/engine/container/container.go
index 72744cbcba..d1f547f3f9 100644
--- a/components/engine/container/container.go
+++ b/components/engine/container/container.go
@@ -545,6 +545,8 @@ func (container *Container) StopSignal() int {
 // See https://github.com/docker/docker/pull/17779
 // for a more detailed explanation on why we don't want that.
 func (container *Container) InitDNSHostConfig() {
+	container.Lock()
+	defer container.Unlock()
 	if container.HostConfig.DNS == nil {
 		container.HostConfig.DNS = make([]string, 0)
 	}
diff --git a/components/engine/daemon/start.go b/components/engine/daemon/start.go
index d9b7b8280a..0f30d487b1 100644
--- a/components/engine/daemon/start.go
+++ b/components/engine/daemon/start.go
@@ -30,12 +30,6 @@ func (daemon *Daemon) ContainerStart(name string, hostConfig *runconfig.HostConf
 		// creating a container, not during start.
 		if hostConfig != nil {
 			logrus.Warn("DEPRECATED: Setting host configuration options when the container starts is deprecated and will be removed in Docker 1.12")
-			container.Lock()
-			if err := parseSecurityOpt(container, hostConfig); err != nil {
-				container.Unlock()
-				return err
-			}
-			container.Unlock()
 			if err := daemon.adaptContainerSettings(hostConfig, false); err != nil {
 				return err
 			}