diff --git a/validate/validate.go b/validate/validate.go
index 82e7b49b..1706fc5f 100644
--- a/validate/validate.go
+++ b/validate/validate.go
@@ -375,7 +375,7 @@ func (v *Validator) CheckProcess() (errs error) {
 			errs = multierror.Append(errs, v.CheckCapabilities())
 		}
 
-		if len(process.ApparmorProfile) > 0 {
+		if len(process.ApparmorProfile) > 0 && v.spec.Root != nil {
 			profilePath := filepath.Join(v.bundlePath, v.spec.Root.Path, "/etc/apparmor.d", process.ApparmorProfile)
 			_, err := os.Stat(profilePath)
 			if err != nil {
diff --git a/validate/validate_test.go b/validate/validate_test.go
index ac24845e..a8a80f63 100644
--- a/validate/validate_test.go
+++ b/validate/validate_test.go
@@ -490,6 +490,20 @@ func TestCheckProcess(t *testing.T) {
 			platform: "solaris",
 			expected: specerror.PosixProcRlimitsTypeValueError,
 		},
+		{
+			// Root is optional in the runtime spec; an apparmorProfile
+			// with no root must not panic the validator.
+			val: rspec.Spec{
+				Version: "1.0.0",
+				Process: &rspec.Process{
+					Args:            []string{"sh"},
+					Cwd:             "/",
+					ApparmorProfile: "docker-default",
+				},
+			},
+			platform: "linux",
+			expected: specerror.NonError,
+		},
 	}
 	for _, c := range cases {
 		v, err := NewValidator(&c.val, ".", false, c.platform)