diff --git a/integration/container/create_test.go b/integration/container/create_test.go
index dc53de864e..18ee24731a 100644
--- a/integration/container/create_test.go
+++ b/integration/container/create_test.go
@@ -279,6 +279,7 @@ func TestCreateWithCustomMaskedPaths(t *testing.T) {
 
 	for i, tc := range testCases {
 		t.Run(tc.doc, func(t *testing.T) {
+			skip.If(t, tc.privileged && testEnv.IsUserNamespace(), "privileged mode is incompatible with user namespaces")
 			t.Parallel()
 
 			// Create the container.
@@ -352,6 +353,7 @@ func TestCreateWithCustomReadonlyPaths(t *testing.T) {
 
 	for i, tc := range testCases {
 		t.Run(tc.doc, func(t *testing.T) {
+			skip.If(t, tc.privileged && testEnv.IsUserNamespace(), "privileged mode is incompatible with user namespaces")
 			t.Parallel()
 			ctr, err := apiClient.ContainerCreate(ctx, client.ContainerCreateOptions{
 				Config: &container.Config{
diff --git a/integration/container/inspect_test.go b/integration/container/inspect_test.go
index 22760634ed..0f13f05e79 100644
--- a/integration/container/inspect_test.go
+++ b/integration/container/inspect_test.go
@@ -52,6 +52,7 @@ func TestNetworkAliasesAreEmpty(t *testing.T) {
 
 	for _, nwMode := range netModes {
 		t.Run(nwMode, func(t *testing.T) {
+			skip.If(t, nwMode == "host" && testEnv.IsUserNamespace(), "host network mode is incompatible with user namespaces")
 			ctr := container.Create(ctx, t, apiClient,
 				container.WithName("ctr-"+nwMode),
 				container.WithImage("busybox:latest"),
diff --git a/integration/container/pidmode_linux_test.go b/integration/container/pidmode_linux_test.go
index 9d1a8a54cb..5cc8e6c58a 100644
--- a/integration/container/pidmode_linux_test.go
+++ b/integration/container/pidmode_linux_test.go
@@ -15,6 +15,7 @@ import (
 func TestPIDModeHost(t *testing.T) {
 	skip.If(t, testEnv.DaemonInfo.OSType != "linux")
 	skip.If(t, testEnv.IsRemoteDaemon())
+	skip.If(t, testEnv.IsUserNamespace, "host PID mode is incompatible with user namespaces")
 
 	hostPid, err := os.Readlink("/proc/1/ns/pid")
 	assert.NilError(t, err)
diff --git a/integration/container/run_linux_test.go b/integration/container/run_linux_test.go
index d8252e75c2..9c349e120a 100644
--- a/integration/container/run_linux_test.go
+++ b/integration/container/run_linux_test.go
@@ -114,15 +114,17 @@ func TestUnprivilegedPortsAndPing(t *testing.T) {
 		c.Config.User = "1000:1000"
 	})
 
-	// Check net.ipv4.ping_group_range.
-	res, err := container.Exec(ctx, apiClient, cID, []string{"cat", "/proc/sys/net/ipv4/ping_group_range"})
-	assert.NilError(t, err)
-	assert.Assert(t, is.Len(res.Stderr(), 0))
-	assert.Equal(t, 0, res.ExitCode)
-	assert.Equal(t, `0	2147483647`, strings.TrimSpace(res.Stdout()))
+	if !testEnv.IsUserNamespace() {
+		// Check net.ipv4.ping_group_range.
+		res, err := container.Exec(ctx, apiClient, cID, []string{"cat", "/proc/sys/net/ipv4/ping_group_range"})
+		assert.NilError(t, err)
+		assert.Assert(t, is.Len(res.Stderr(), 0))
+		assert.Equal(t, 0, res.ExitCode)
+		assert.Equal(t, `0	2147483647`, strings.TrimSpace(res.Stdout()))
+	}
 
 	// Check net.ipv4.ip_unprivileged_port_start.
-	res, err = container.Exec(ctx, apiClient, cID, []string{"cat", "/proc/sys/net/ipv4/ip_unprivileged_port_start"})
+	res, err := container.Exec(ctx, apiClient, cID, []string{"cat", "/proc/sys/net/ipv4/ip_unprivileged_port_start"})
 	assert.NilError(t, err)
 	assert.Assert(t, is.Len(res.Stderr(), 0))
 	assert.Equal(t, 0, res.ExitCode)
diff --git a/integration/daemon/default_storage_test.go b/integration/daemon/default_storage_test.go
index 180b6a45e1..6ed2a27ecf 100644
--- a/integration/daemon/default_storage_test.go
+++ b/integration/daemon/default_storage_test.go
@@ -15,6 +15,7 @@ import (
 
 func TestDefaultStorageDriver(t *testing.T) {
 	skip.If(t, testEnv.DaemonInfo.OSType == "windows", "Windows does not support running sub-daemons")
+	skip.If(t, testEnv.IsUserNamespace(), "containerd snapshotters are disabled with user namespace remapping")
 	t.Setenv("DOCKER_DRIVER", "")
 	t.Setenv("DOCKER_GRAPHDRIVER", "")
 	t.Setenv("TEST_INTEGRATION_USE_GRAPHDRIVER", "")
@@ -127,6 +128,8 @@ func TestInspectGraphDriverAPIBC(t *testing.T) {
 
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
+			skip.If(t, tc.expContainerdSnapshotter && testEnv.IsUserNamespace(), "containerd snapshotters are disabled with user namespace remapping")
+
 			d := daemon.New(t)
 			defer d.Stop(t)
 			d.StartWithBusybox(ctx, t, "--iptables=false", "--ip6tables=false", "--storage-driver="+tc.storageDriver)
diff --git a/integration/daemon/migration_test.go b/integration/daemon/migration_test.go
index 6f4989e0de..78ea4daf77 100644
--- a/integration/daemon/migration_test.go
+++ b/integration/daemon/migration_test.go
@@ -25,6 +25,7 @@ func TestMigrateNativeSnapshotter(t *testing.T) {
 
 func testMigrateSnapshotter(t *testing.T, graphdriver, snapshotter string) {
 	skip.If(t, runtime.GOOS != "linux")
+	skip.If(t, testEnv.IsUserNamespace(), "containerd snapshotters are disabled with user namespace remapping")
 
 	t.Setenv("DOCKER_MIGRATE_SNAPSHOTTER_THRESHOLD", "200M")
 	t.Setenv("DOCKER_DRIVER", "")
diff --git a/integration/daemon/nri/nri_test.go b/integration/daemon/nri/nri_test.go
index 49040677bd..d5fb988ca1 100644
--- a/integration/daemon/nri/nri_test.go
+++ b/integration/daemon/nri/nri_test.go
@@ -158,7 +158,12 @@ func TestNRIContainerCreateAddMount(t *testing.T) {
 
 	// Create and populate a directory for containers to mount.
 	dirToMount := t.TempDir()
-	if err := os.WriteFile(filepath.Join(dirToMount, "testfile.txt"), []byte("hello\n"), 0o644); err != nil {
+	testFile := filepath.Join(dirToMount, "testfile.txt")
+	if err := os.WriteFile(testFile, []byte("hello\n"), 0o666); err != nil {
+		assert.NilError(t, err)
+	}
+	// The process umask may remove write bits needed by remapped container root.
+	if err := os.Chmod(testFile, 0o666); err != nil {
 		assert.NilError(t, err)
 	}
 	const (