diff --git a/Makefile b/Makefile
index 63ae4eb564..05cd90c4a8 100644
--- a/Makefile
+++ b/Makefile
@@ -132,7 +132,7 @@ test-unit-all: \
 
 # This target is used by our Github Actions CI to run unit tests for all non-plugin modules in multiple GOOS environments.
 .PHONY: test-unit-non-plugin
-test-unit-non-plugin: kustomize
+test-unit-non-plugin:
 	./hack/for-each-module.sh "make test" "./plugin/*" 15
 
 .PHONY: build-non-plugin-all
diff --git a/api/krusty/fnplugin_test.go b/api/krusty/fnplugin_test.go
index c762aad725..173d9e4b1e 100644
--- a/api/krusty/fnplugin_test.go
+++ b/api/krusty/fnplugin_test.go
@@ -4,7 +4,6 @@
 package krusty_test
 
 import (
-	"bytes"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -644,118 +643,70 @@ metadata:
 `, string(actual))
 }
 
-func TestFnContainerMounts(t *testing.T) {
+func TestFnContainerFnMounts(t *testing.T) {
 	skipIfNoDocker(t)
-
-	path, err := os.Getwd()
+	th := kusttest_test.MakeHarness(t)
+	o := th.MakeOptionsPluginsEnabled()
+	fSys := filesys.MakeFsOnDisk()
+	b := MakeKustomizer(&o)
+	tmpDir, err := filesys.NewTmpConfirmedDir()
 	assert.NoError(t, err)
-
-	testDir := filepath.Join(path, "testdata", "fnmounts")
-	command := exec.Command("kustomize", "build", testDir, "--enable-alpha-plugins")
-	var stdout bytes.Buffer
-	var stderr bytes.Buffer
-	command.Stdout = &stdout
-	command.Stderr = &stderr
-	t.Log(stderr.String())
-
-	assert.NoError(t, command.Run())
-	assert.Equal(t, `apiVersion: v1
-kind: ServiceAccount
-metadata:
-  labels:
-    app.kubernetes.io/instance: test
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: helloworld-chart
-    app.kubernetes.io/version: 1.16.0
-    helm.sh/chart: helloworld-chart-0.1.0
-  name: test-helloworld-chart
----
-apiVersion: v1
-kind: Service
+	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(`
+generators:
+- gener.yaml
+`)))
+	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "gener.yaml"), []byte(`
+apiVersion: v1alpha1
+kind: RenderHelmChart
 metadata:
-  labels:
-    app.kubernetes.io/instance: test
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: helloworld-chart
-    app.kubernetes.io/version: 1.16.0
-    helm.sh/chart: helloworld-chart-0.1.0
-  name: test-helloworld-chart
-spec:
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
-    targetPort: http
-  selector:
-    app.kubernetes.io/instance: test
-    app.kubernetes.io/name: helloworld-chart
-  type: ClusterIP
----
+  name: demo
+  annotations:
+    config.kubernetes.io/function: |
+      container:
+        image: gcr.io/kpt-fn/render-helm-chart:v0.1.0
+        mounts:
+        - type: "bind"
+          src: "./charts"
+          dst: "/tmp/charts"
+helmCharts:
+- name: helloworld-chart
+  releaseName: test
+  valuesFile: /tmp/charts/helloworld-values/values.yaml
+`)))
+	assert.NoError(t, fSys.MkdirAll(filepath.Join(tmpDir.String(), "charts", "helloworld-chart", "templates")))
+	assert.NoError(t, fSys.MkdirAll(filepath.Join(tmpDir.String(), "charts", "helloworld-values")))
+	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "charts", "helloworld-chart", "Chart.yaml"), []byte(`
+apiVersion: v2
+name: helloworld-chart
+description: A Helm chart for Kubernetes
+type: application
+version: 0.1.0
+appVersion: 1.16.0
+`)))
+	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "charts", "helloworld-chart", "templates", "deployment.yaml"), []byte(`
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  labels:
-    app.kubernetes.io/instance: test
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: helloworld-chart
-    app.kubernetes.io/version: 1.16.0
-    helm.sh/chart: helloworld-chart-0.1.0
-  name: test-helloworld-chart
+  name: name
 spec:
-  replicas: 5
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: test
-      app.kubernetes.io/name: helloworld-chart
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: test
-        app.kubernetes.io/name: helloworld-chart
-    spec:
-      containers:
-      - image: nginx:1.16.0
-        imagePullPolicy: Always
-        livenessProbe:
-          httpGet:
-            path: /
-            port: http
-        name: helloworld-chart
-        ports:
-        - containerPort: 80
-          name: http
-          protocol: TCP
-        readinessProbe:
-          httpGet:
-            path: /
-            port: http
-        resources: {}
-        securityContext: {}
-      securityContext: {}
-      serviceAccountName: test-helloworld-chart
----
-apiVersion: v1
-kind: Pod
+  replicas: {{ .Values.replicaCount }}
+`)))
+	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "charts", "helloworld-values", "values.yaml"), []byte(`
+replicaCount: 5
+`)))
+	m, err := b.Run(
+		fSys,
+		tmpDir.String())
+	assert.NoError(t, err)
+	actual, err := m.AsYaml()
+	assert.NoError(t, err)
+	assert.Equal(t, `apiVersion: apps/v1
+kind: Deployment
 metadata:
-  annotations:
-    helm.sh/hook: test-success
-  labels:
-    app.kubernetes.io/instance: test
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: helloworld-chart
-    app.kubernetes.io/version: 1.16.0
-    helm.sh/chart: helloworld-chart-0.1.0
-  name: test-helloworld-chart-test-connection
+  name: name
 spec:
-  containers:
-  - args:
-    - test-helloworld-chart:80
-    command:
-    - wget
-    image: busybox
-    name: wget
-  restartPolicy: Never
-`, stdout.String())
+  replicas: 5
+`, string(actual))
 }
 
 func TestFnContainerMountsLoadRestrictions_absolute(t *testing.T) {
@@ -823,3 +774,29 @@ generators:
 		"v1alpha1.[noGrp]/demo.[noNs] with mount path './tmp/../../dir' is not permitted; mount paths must "+
 		"be under the current kustomization directory")
 }
+
+func TestFnContainerMountsLoadRestrictions_root(t *testing.T) {
+	skipIfNoDocker(t)
+	th := kusttest_test.MakeHarness(t)
+
+	th.WriteK(".", `
+generators:
+- gener.yaml
+`)
+	// Create generator config
+	th.WriteF("gener.yaml", `
+apiVersion: examples.config.kubernetes.io/v1beta1
+kind: CockroachDB
+metadata:
+  name: demo
+  annotations:
+    config.kubernetes.io/function: |
+      container:
+        image: gcr.io/kustomize-functions/example-cockroachdb:v0.1.0
+spec:
+  replicas: 3
+`)
+	err := th.RunWithErr(".", th.MakeOptionsPluginsEnabled())
+	assert.Error(t, err)
+	assert.EqualError(t, err, "couldn't execute function: root working directory '/' not allowed")
+}
diff --git a/api/krusty/testdata/fnmounts/charts/helloworld-chart/Chart.yaml b/api/krusty/testdata/fnmounts/charts/helloworld-chart/Chart.yaml
deleted file mode 100644
index de4012af9d..0000000000
--- a/api/krusty/testdata/fnmounts/charts/helloworld-chart/Chart.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-apiVersion: v2
-name: helloworld-chart
-description: A Helm chart for Kubernetes
-type: application
-version: 0.1.0
-appVersion: 1.16.0
diff --git a/api/krusty/testdata/fnmounts/charts/helloworld-chart/templates/NOTES.txt b/api/krusty/testdata/fnmounts/charts/helloworld-chart/templates/NOTES.txt
deleted file mode 100644
index af17e53fbc..0000000000
--- a/api/krusty/testdata/fnmounts/charts/helloworld-chart/templates/NOTES.txt
+++ /dev/null
@@ -1,21 +0,0 @@
-1. Get the application URL by running these commands:
-{{- if .Values.ingress.enabled }}
-{{- range $host := .Values.ingress.hosts }}
-  {{- range .paths }}
-  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ . }}
-  {{- end }}
-{{- end }}
-{{- else if contains "NodePort" .Values.service.type }}
-  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "helloworld-chart.fullname" . }})
-  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
-  echo http://$NODE_IP:$NODE_PORT
-{{- else if contains "LoadBalancer" .Values.service.type }}
-     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
-           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "helloworld-chart.fullname" . }}'
-  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "helloworld-chart.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
-  echo http://$SERVICE_IP:{{ .Values.service.port }}
-{{- else if contains "ClusterIP" .Values.service.type }}
-  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "helloworld-chart.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
-  echo "Visit http://127.0.0.1:8080 to use your application"
-  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:80
-{{- end }}
diff --git a/api/krusty/testdata/fnmounts/charts/helloworld-chart/templates/_helpers.tpl b/api/krusty/testdata/fnmounts/charts/helloworld-chart/templates/_helpers.tpl
deleted file mode 100644
index 3a62dfa0f2..0000000000
--- a/api/krusty/testdata/fnmounts/charts/helloworld-chart/templates/_helpers.tpl
+++ /dev/null
@@ -1,63 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Expand the name of the chart.
-*/}}
-{{- define "helloworld-chart.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-
-{{/*
-Create a default fully qualified app name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-If release name contains chart name it will be used as a full name.
-*/}}
-{{- define "helloworld-chart.fullname" -}}
-{{- if .Values.fullnameOverride -}}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- $name := default .Chart.Name .Values.nameOverride -}}
-{{- if contains $name .Release.Name -}}
-{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Create chart name and version as used by the chart label.
-*/}}
-{{- define "helloworld-chart.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-
-{{/*
-Common labels
-*/}}
-{{- define "helloworld-chart.labels" -}}
-helm.sh/chart: {{ include "helloworld-chart.chart" . }}
-{{ include "helloworld-chart.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- end -}}
-
-{{/*
-Selector labels
-*/}}
-{{- define "helloworld-chart.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "helloworld-chart.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end -}}
-
-{{/*
-Create the name of the service account to use
-*/}}
-{{- define "helloworld-chart.serviceAccountName" -}}
-{{- if .Values.serviceAccount.create -}}
-    {{ default (include "helloworld-chart.fullname" .) .Values.serviceAccount.name }}
-{{- else -}}
-    {{ default "default" .Values.serviceAccount.name }}
-{{- end -}}
-{{- end -}}
diff --git a/api/krusty/testdata/fnmounts/charts/helloworld-chart/templates/deployment.yaml b/api/krusty/testdata/fnmounts/charts/helloworld-chart/templates/deployment.yaml
deleted file mode 100644
index ca686e89ec..0000000000
--- a/api/krusty/testdata/fnmounts/charts/helloworld-chart/templates/deployment.yaml
+++ /dev/null
@@ -1,55 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ include "helloworld-chart.fullname" . }}
-  labels:
-    {{- include "helloworld-chart.labels" . | nindent 4 }}
-spec:
-  replicas: {{ .Values.replicaCount }}
-  selector:
-    matchLabels:
-      {{- include "helloworld-chart.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      labels:
-        {{- include "helloworld-chart.selectorLabels" . | nindent 8 }}
-    spec:
-    {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-    {{- end }}
-      serviceAccountName: {{ include "helloworld-chart.serviceAccountName" . }}
-      securityContext:
-        {{- toYaml .Values.podSecurityContext | nindent 8 }}
-      containers:
-        - name: {{ .Chart.Name }}
-          securityContext:
-            {{- toYaml .Values.securityContext | nindent 12 }}
-          image: "{{ .Values.image.repository }}:{{ .Chart.AppVersion }}"
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http
-          resources:
-            {{- toYaml .Values.resources | nindent 12 }}
-      {{- with .Values.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-    {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-    {{- end }}
-    {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-    {{- end }}
diff --git a/api/krusty/testdata/fnmounts/charts/helloworld-chart/templates/ingress.yaml b/api/krusty/testdata/fnmounts/charts/helloworld-chart/templates/ingress.yaml
deleted file mode 100644
index 76e1dd91d7..0000000000
--- a/api/krusty/testdata/fnmounts/charts/helloworld-chart/templates/ingress.yaml
+++ /dev/null
@@ -1,41 +0,0 @@
-{{- if .Values.ingress.enabled -}}
-{{- $fullName := include "helloworld-chart.fullname" . -}}
-{{- $svcPort := .Values.service.port -}}
-{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
-apiVersion: networking.k8s.io/v1beta1
-{{- else -}}
-apiVersion: extensions/v1beta1
-{{- end }}
-kind: Ingress
-metadata:
-  name: {{ $fullName }}
-  labels:
-    {{- include "helloworld-chart.labels" . | nindent 4 }}
-  {{- with .Values.ingress.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-{{- if .Values.ingress.tls }}
-  tls:
-  {{- range .Values.ingress.tls }}
-    - hosts:
-      {{- range .hosts }}
-        - {{ . | quote }}
-      {{- end }}
-      secretName: {{ .secretName }}
-  {{- end }}
-{{- end }}
-  rules:
-  {{- range .Values.ingress.hosts }}
-    - host: {{ .host | quote }}
-      http:
-        paths:
-        {{- range .paths }}
-          - path: {{ . }}
-            backend:
-              serviceName: {{ $fullName }}
-              servicePort: {{ $svcPort }}
-        {{- end }}
-  {{- end }}
-{{- end }}
diff --git a/api/krusty/testdata/fnmounts/charts/helloworld-chart/templates/service.yaml b/api/krusty/testdata/fnmounts/charts/helloworld-chart/templates/service.yaml
deleted file mode 100644
index a80cf8cd64..0000000000
--- a/api/krusty/testdata/fnmounts/charts/helloworld-chart/templates/service.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "helloworld-chart.fullname" . }}
-  labels:
-    {{- include "helloworld-chart.labels" . | nindent 4 }}
-spec:
-  type: {{ .Values.service.type }}
-  ports:
-    - port: {{ .Values.service.port }}
-      targetPort: http
-      protocol: TCP
-      name: http
-  selector:
-    {{- include "helloworld-chart.selectorLabels" . | nindent 4 }}
diff --git a/api/krusty/testdata/fnmounts/charts/helloworld-chart/templates/serviceaccount.yaml b/api/krusty/testdata/fnmounts/charts/helloworld-chart/templates/serviceaccount.yaml
deleted file mode 100644
index bf9a8e1544..0000000000
--- a/api/krusty/testdata/fnmounts/charts/helloworld-chart/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-{{- if .Values.serviceAccount.create -}}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "helloworld-chart.serviceAccountName" . }}
-  labels:
-    {{- include "helloworld-chart.labels" . | nindent 4 }}
-  {{- with .Values.serviceAccount.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-{{- end -}}
diff --git a/api/krusty/testdata/fnmounts/charts/helloworld-chart/templates/tests/test-connection.yaml b/api/krusty/testdata/fnmounts/charts/helloworld-chart/templates/tests/test-connection.yaml
deleted file mode 100644
index a71342a0d0..0000000000
--- a/api/krusty/testdata/fnmounts/charts/helloworld-chart/templates/tests/test-connection.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: "{{ include "helloworld-chart.fullname" . }}-test-connection"
-  labels:
-    {{- include "helloworld-chart.labels" . | nindent 4 }}
-  annotations:
-    "helm.sh/hook": test-success
-spec:
-  containers:
-    - name: wget
-      image: busybox
-      command: ['wget']
-      args: ['{{ include "helloworld-chart.fullname" . }}:{{ .Values.service.port }}']
-  restartPolicy: Never
diff --git a/api/krusty/testdata/fnmounts/charts/helloworld-chart/values.yaml b/api/krusty/testdata/fnmounts/charts/helloworld-chart/values.yaml
deleted file mode 100644
index e81d4bf57d..0000000000
--- a/api/krusty/testdata/fnmounts/charts/helloworld-chart/values.yaml
+++ /dev/null
@@ -1,27 +0,0 @@
-replicaCount: 1
-image:
-  repository: nginx
-  pullPolicy: IfNotPresent
-imagePullSecrets: []
-nameOverride: ""
-fullnameOverride: ""
-serviceAccount:
-  create: true
-  annotations: {}
-  name:
-podSecurityContext: {}
-securityContext: {}
-service:
-  type: ClusterIP
-  port: 80
-ingress:
-  enabled: false
-  annotations: {}
-  hosts:
-    - host: chart-example.local
-      paths: []
-  tls: []
-resources: {}
-nodeSelector: {}
-tolerations: []
-affinity: {}
diff --git a/api/krusty/testdata/fnmounts/charts/helloworld-values/values.yaml b/api/krusty/testdata/fnmounts/charts/helloworld-values/values.yaml
deleted file mode 100644
index d178c72a8a..0000000000
--- a/api/krusty/testdata/fnmounts/charts/helloworld-values/values.yaml
+++ /dev/null
@@ -1,68 +0,0 @@
-# Default values for helloworld-chart.
-# This is a YAML-formatted file.
-# Declare variables to be passed into your templates.
-
-replicaCount: 5
-
-image:
-  repository: nginx
-  pullPolicy: Always
-
-imagePullSecrets: []
-nameOverride: ""
-fullnameOverride: ""
-
-serviceAccount:
-  # Specifies whether a service account should be created
-  create: true
-  # Annotations to add to the service account
-  annotations: {}
-  # The name of the service account to use.
-  # If not set and create is true, a name is generated using the fullname template
-  name:
-
-podSecurityContext: {}
-# fsGroup: 2000
-
-securityContext: {}
-  # capabilities:
-  #   drop:
-  #   - ALL
-  # readOnlyRootFilesystem: true
-  # runAsNonRoot: true
-# runAsUser: 1000
-
-service:
-  type: ClusterIP
-  port: 80
-
-ingress:
-  enabled: false
-  annotations: {}
-    # kubernetes.io/ingress.class: nginx
-  # kubernetes.io/tls-acme: "true"
-  hosts:
-    - host: chart-example.local
-      paths: []
-  tls: []
-  #  - secretName: chart-example-tls
-  #    hosts:
-  #      - chart-example.local
-
-resources: {}
-  # We usually recommend not to specify default resources and to leave this as a conscious
-  # choice for the user. This also increases chances charts run on environments with little
-  # resources, such as Minikube. If you do want to specify resources, uncomment the following
-  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-  # limits:
-  #   cpu: 100m
-  #   memory: 128Mi
-  # requests:
-  #   cpu: 100m
-#   memory: 128Mi
-
-nodeSelector: {}
-
-tolerations: []
-
-affinity: {}
diff --git a/api/krusty/testdata/fnmounts/kustomization.yaml b/api/krusty/testdata/fnmounts/kustomization.yaml
deleted file mode 100644
index 1a24bc7c75..0000000000
--- a/api/krusty/testdata/fnmounts/kustomization.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-# Test file for TestFnContainerMounts
-
-generators:
-  - |-
-    apiVersion: v1alpha1
-    kind: RenderHelmChart
-    metadata:
-      name: demo
-      annotations:
-        config.kubernetes.io/function: |
-          container:
-            image: gcr.io/kpt-fn/render-helm-chart:v0.1.0
-            mounts:
-            - type: "bind"
-              src: "./charts"
-              dst: "/tmp/charts"
-    helmCharts:
-    - name: helloworld-chart
-      releaseName: test
-      valuesFile: /tmp/charts/helloworld-values/values.yaml
\ No newline at end of file
diff --git a/kyaml/fn/runtime/container/container_test.go b/kyaml/fn/runtime/container/container_test.go
index bf9e2483a8..f5ff0259b2 100644
--- a/kyaml/fn/runtime/container/container_test.go
+++ b/kyaml/fn/runtime/container/container_test.go
@@ -7,7 +7,7 @@ import (
 	"bytes"
 	"fmt"
 	"os"
-	"runtime"
+	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -24,7 +24,6 @@ func TestFilter_setupExec(t *testing.T) {
 		expectedArgs   []string
 		containerSpec  runtimeutil.ContainerSpec
 		UIDGID         string
-		skipOnWindows  bool
 	}{
 		{
 			name: "command",
@@ -70,8 +69,7 @@ metadata:
 		},
 
 		{
-			name:          "storage_mounts",
-			skipOnWindows: true, // the fieldpaths are different on Windows
+			name: "storage_mounts",
 			functionConfig: `apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -84,18 +82,19 @@ metadata:
 				"--network", "none",
 				"--user", "nobody",
 				"--security-opt=no-new-privileges",
-				"--mount", fmt.Sprintf("type=%s,source=%s,target=%s,readonly", "bind", "/mount/path", "/local/"),
-				"--mount", fmt.Sprintf("type=%s,source=%s,target=%s", "bind", "/mount/pathrw", "/localrw/"),
-				"--mount", fmt.Sprintf("type=%s,source=%s,target=%s,readonly", "volume", "/myvol", "/local/"),
-				"--mount", fmt.Sprintf("type=%s,source=%s,target=%s,readonly", "tmpfs", "/", "/local/"),
+				// use filepath.Join for Windows filepath handling
+				"--mount", fmt.Sprintf("type=%s,source=%s,target=%s,readonly", "bind", getAbsFilePath(string(filepath.Separator), "mount", "path"), "/local/"),
+				"--mount", fmt.Sprintf("type=%s,source=%s,target=%s", "bind", getAbsFilePath(string(filepath.Separator), "mount", "pathrw"), "/localrw/"),
+				"--mount", fmt.Sprintf("type=%s,source=%s,target=%s,readonly", "volume", getAbsFilePath(string(filepath.Separator), "myvol"), "/local/"),
+				"--mount", fmt.Sprintf("type=%s,source=%s,target=%s,readonly", "tmpfs", getAbsFilePath(string(filepath.Separator)), "/local/"),
 			},
 			containerSpec: runtimeutil.ContainerSpec{
 				Image: "example.com:version",
 				StorageMounts: []runtimeutil.StorageMount{
-					{MountType: "bind", Src: "/mount/path", DstPath: "/local/"},
-					{MountType: "bind", Src: "/mount/pathrw", DstPath: "/localrw/", ReadWriteMode: true},
-					{MountType: "volume", Src: "/myvol", DstPath: "/local/"},
-					{MountType: "tmpfs", Src: "/", DstPath: "/local/"},
+					{MountType: "bind", Src: getAbsFilePath(string(filepath.Separator), "mount", "path"), DstPath: "/local/"},
+					{MountType: "bind", Src: getAbsFilePath(string(filepath.Separator), "mount", "pathrw"), DstPath: "/localrw/", ReadWriteMode: true},
+					{MountType: "volume", Src: getAbsFilePath(string(filepath.Separator), "myvol"), DstPath: "/local/"},
+					{MountType: "tmpfs", Src: getAbsFilePath(string(filepath.Separator)), DstPath: "/local/"},
 				},
 			},
 			UIDGID: "nobody",
@@ -125,9 +124,6 @@ metadata:
 	for i := range tests {
 		tt := tests[i]
 		t.Run(tt.name, func(t *testing.T) {
-			if tt.skipOnWindows && runtime.GOOS == "windows" {
-				t.SkipNow()
-			}
 			cfg, err := yaml.Parse(tt.functionConfig)
 			if !assert.NoError(t, err) {
 				t.FailNow()
@@ -253,3 +249,8 @@ func getWorkingDir(t *testing.T) string {
 	require.NoError(t, err)
 	return wd
 }
+
+func getAbsFilePath(args ...string) string {
+	path, _ := filepath.Abs(filepath.Join(args...))
+	return path
+}
diff --git a/kyaml/runfn/runfn.go b/kyaml/runfn/runfn.go
index c2cf073061..c855144d73 100644
--- a/kyaml/runfn/runfn.go
+++ b/kyaml/runfn/runfn.go
@@ -329,9 +329,11 @@ func (r RunFns) getFunctionFilters(global bool, fns ...*yaml.RNode) (
 			continue
 		}
 		cf, ok := c.(*container.Filter)
-		if global && ok {
+		if ok {
+			if global {
+				cf.Exec.GlobalScope = true
+			}
 			cf.Exec.WorkingDir = r.WorkingDir
-			cf.Exec.GlobalScope = true
 		}
 		fltrs = append(fltrs, c)
 	}