diff --git a/lxcconfig/lxcconfig.go b/lxcconfig/lxcconfig.go
index 4d55de6..6b62b2a 100644
--- a/lxcconfig/lxcconfig.go
+++ b/lxcconfig/lxcconfig.go
@@ -73,9 +73,10 @@ func LXCConfig(rd io.ReadSeeker, wr io.Writer) error {
 }
 
 func docker2lxc(d dockerConfig) lxcConfig {
-	// cmd/entrypoint logic is copied from lxc-oci template
-	ep := strings.Join(d.Config.Entrypoint, " ")
-	cmd := strings.Join(d.Config.Cmd, " ")
+	// cmd/entrypoint logic is copied from lxc-oci template and adopted
+	// for simple double-argument quoting.
+	ep := quoted(d.Config.Entrypoint)
+	cmd := quoted(d.Config.Cmd)
 	if len(ep) == 0 {
 		ep = cmd
 		if len(ep) == 0 {
@@ -154,3 +155,15 @@ func parseJSON(rd io.ReadSeeker, offsets map[string]offsetSize, fname string, c
 	}
 	return nil
 }
+
+func quoted(cmds []string) string {
+	ret := make([]string, len(cmds))
+	for i, cmd := range cmds {
+		if cmd == "" || strings.ContainsRune(cmd, ' ') {
+			ret[i] = `"` + cmd + `"`
+		} else {
+			ret[i] = cmd
+		}
+	}
+	return strings.Join(ret, " ")
+}
diff --git a/lxcconfig/lxcconfig_test.go b/lxcconfig/lxcconfig_test.go
index 54fc197..798ba35 100644
--- a/lxcconfig/lxcconfig_test.go
+++ b/lxcconfig/lxcconfig_test.go
@@ -48,7 +48,7 @@ func TestLXCConfig(t *testing.T) {
 			want: strings.Join([]string{
 				`lxc.include = LXC_TEMPLATE_CONFIG/common.conf`,
 				`lxc.architecture = amd64`,
-				`lxc.execute.cmd = '/entrypoint.sh /bin/sh -c echo foo'`,
+				`lxc.execute.cmd = '/entrypoint.sh /bin/sh -c "echo foo"'`,
 				`lxc.init.cwd = /x`,
 				`lxc.environment = LONGNAME="Foo Bar"`,
 				`lxc.environment = SHELL=/bin/tcsh`,