diff --git a/client/client.go b/client/client.go
index ea9e57426..7faae66b8 100644
--- a/client/client.go
+++ b/client/client.go
@@ -949,7 +949,7 @@ func (c *Client) setupDrivers() error {
 
 	var avail []string
 	var skipped []string
-	driverCtx := driver.NewDriverContext("", "", c.config, c.config.Node, c.logger, nil, nil)
+	driverCtx := driver.NewDriverContext("", "", c.config, c.config.Node, c.logger, nil)
 	for name := range driver.BuiltinDrivers {
 		// Skip fingerprinting drivers that are not in the whitelist if it is
 		// enabled.
diff --git a/client/driver/docker.go b/client/driver/docker.go
index 90767e493..a9716758c 100644
--- a/client/driver/docker.go
+++ b/client/driver/docker.go
@@ -456,7 +456,7 @@ func (d *DockerDriver) getDockerCoordinator(client *docker.Client) (*dockerCoord
 }
 
 func (d *DockerDriver) Prestart(ctx *ExecContext, task *structs.Task) (*PrestartResponse, error) {
-	driverConfig, err := NewDockerDriverConfig(task, d.taskEnv)
+	driverConfig, err := NewDockerDriverConfig(task, ctx.TaskEnv)
 	if err != nil {
 		return nil, err
 	}
@@ -496,7 +496,7 @@ func (d *DockerDriver) Start(ctx *ExecContext, task *structs.Task) (DriverHandle
 		return nil, err
 	}
 	executorCtx := &executor.ExecutorContext{
-		TaskEnv:        d.taskEnv,
+		TaskEnv:        ctx.TaskEnv,
 		Task:           task,
 		Driver:         "docker",
 		AllocID:        d.DriverContext.allocID,
@@ -904,7 +904,7 @@ func (d *DockerDriver) createContainerConfig(ctx *ExecContext, task *structs.Tas
 		config.ExposedPorts = exposedPorts
 	}
 
-	parsedArgs := d.taskEnv.ParseAndReplace(driverConfig.Args)
+	parsedArgs := ctx.TaskEnv.ParseAndReplace(driverConfig.Args)
 
 	// If the user specified a custom command to run, we'll inject it here.
 	if driverConfig.Command != "" {
@@ -928,7 +928,7 @@ func (d *DockerDriver) createContainerConfig(ctx *ExecContext, task *structs.Tas
 		d.logger.Printf("[DEBUG] driver.docker: applied labels on the container: %+v", config.Labels)
 	}
 
-	config.Env = d.taskEnv.List()
+	config.Env = ctx.TaskEnv.List()
 
 	containerName := fmt.Sprintf("%s-%s", task.Name, d.DriverContext.allocID)
 	d.logger.Printf("[DEBUG] driver.docker: setting container name to: %s", containerName)
diff --git a/client/driver/docker_test.go b/client/driver/docker_test.go
index a9e5471ed..a0250c985 100644
--- a/client/driver/docker_test.go
+++ b/client/driver/docker_test.go
@@ -3,6 +3,7 @@ package driver
 import (
 	"fmt"
 	"io/ioutil"
+	"log"
 	"math/rand"
 	"os"
 	"path/filepath"
@@ -108,12 +109,16 @@ func dockerSetupWithClient(t *testing.T, task *structs.Task, client *docker.Clie
 	driver := NewDockerDriver(tctx.DriverCtx)
 	copyImage(t, tctx.ExecCtx.TaskDir, "busybox.tar")
 
-	res, err := driver.Prestart(tctx.ExecCtx, task)
+	resp, err := driver.Prestart(tctx.ExecCtx, task)
 	if err != nil {
 		tctx.AllocDir.Destroy()
 		t.Fatalf("error in prestart: %v", err)
 	}
 
+	// At runtime this is handled by TaskRunner
+	tctx.EnvBuilder.SetPortMap(resp.PortMap)
+	tctx.ExecCtx.TaskEnv = tctx.EnvBuilder.Build()
+
 	handle, err := driver.Start(tctx.ExecCtx, task)
 	if err != nil {
 		tctx.AllocDir.Destroy()
@@ -126,7 +131,7 @@ func dockerSetupWithClient(t *testing.T, task *structs.Task, client *docker.Clie
 	}
 
 	cleanup := func() {
-		driver.Cleanup(tctx.ExecCtx, res)
+		driver.Cleanup(tctx.ExecCtx, resp.CreatedResources)
 		handle.Kill()
 		tctx.AllocDir.Destroy()
 	}
@@ -913,10 +918,12 @@ func TestDockerDriver_PortsMapping(t *testing.T) {
 		"NOMAD_HOST_PORT_main": strconv.Itoa(docker_reserved),
 	}
 
+	log.Println(strings.Join(container.Config.Env, "\n"))
+
 	for key, val := range expectedEnvironment {
 		search := fmt.Sprintf("%s=%s", key, val)
 		if !inSlice(search, container.Config.Env) {
-			t.Errorf("Expected to find %s in container environment: %+v", search, container.Config.Env)
+			t.Errorf("Expected to find %s in container environment:\n%s\n\n", search, strings.Join(container.Config.Env, "\n"))
 		}
 	}
 }
@@ -1106,7 +1113,8 @@ func setupDockerVolumes(t *testing.T, cfg *config.Config, hostpath string) (*str
 	}
 
 	alloc := mock.Alloc()
-	execCtx := NewExecContext(taskDir)
+	envBuilder := env.NewBuilder(cfg.Node, alloc, task, cfg.Region)
+	execCtx := NewExecContext(taskDir, envBuilder.Build())
 	cleanup := func() {
 		allocDir.Destroy()
 		if filepath.IsAbs(hostpath) {
@@ -1114,17 +1122,11 @@ func setupDockerVolumes(t *testing.T, cfg *config.Config, hostpath string) (*str
 		}
 	}
 
-	taskEnv, err := GetTaskEnv(taskDir, cfg.Node, task, alloc, cfg, "")
-	if err != nil {
-		cleanup()
-		t.Fatalf("Failed to get task env: %v", err)
-	}
-
 	logger := testLogger()
 	emitter := func(m string, args ...interface{}) {
 		logger.Printf("[EVENT] "+m, args...)
 	}
-	driverCtx := NewDriverContext(task.Name, alloc.ID, cfg, cfg.Node, testLogger(), taskEnv, emitter)
+	driverCtx := NewDriverContext(task.Name, alloc.ID, cfg, cfg.Node, testLogger(), emitter)
 	driver := NewDockerDriver(driverCtx)
 	copyImage(t, taskDir, "busybox.tar")
 
@@ -1255,10 +1257,11 @@ func TestDockerDriver_Cleanup(t *testing.T) {
 
 	// Run Prestart
 	driver := NewDockerDriver(tctx.DriverCtx).(*DockerDriver)
-	res, err := driver.Prestart(tctx.ExecCtx, task)
+	resp, err := driver.Prestart(tctx.ExecCtx, task)
 	if err != nil {
 		t.Fatalf("error in prestart: %v", err)
 	}
+	res := resp.CreatedResources
 	if len(res.Resources) == 0 || len(res.Resources[dockerImageResKey]) == 0 {
 		t.Fatalf("no created resources: %#v", res)
 	}
diff --git a/client/driver/driver.go b/client/driver/driver.go
index afb6c7673..a04a798d2 100644
--- a/client/driver/driver.go
+++ b/client/driver/driver.go
@@ -243,7 +243,6 @@ type DriverContext struct {
 	config   *config.Config
 	logger   *log.Logger
 	node     *structs.Node
-	taskEnv  *env.TaskEnv
 
 	emitEvent LogEventFn
 }
@@ -259,14 +258,13 @@ func NewEmptyDriverContext() *DriverContext {
 // private to the driver. If we want to change this later we can gorename all of
 // the fields in DriverContext.
 func NewDriverContext(taskName, allocID string, config *config.Config, node *structs.Node,
-	logger *log.Logger, taskEnv *env.TaskEnv, eventEmitter LogEventFn) *DriverContext {
+	logger *log.Logger, eventEmitter LogEventFn) *DriverContext {
 	return &DriverContext{
 		taskName:  taskName,
 		allocID:   allocID,
 		config:    config,
 		node:      node,
 		logger:    logger,
-		taskEnv:   taskEnv,
 		emitEvent: eventEmitter,
 	}
 }
@@ -308,12 +306,16 @@ type ScriptExecutor interface {
 type ExecContext struct {
 	// TaskDir contains information about the task directory structure.
 	TaskDir *allocdir.TaskDir
+
+	// TaskEnv contains the task's environment variables.
+	TaskEnv *env.TaskEnv
 }
 
 // NewExecContext is used to create a new execution context
-func NewExecContext(td *allocdir.TaskDir) *ExecContext {
+func NewExecContext(td *allocdir.TaskDir, te *env.TaskEnv) *ExecContext {
 	return &ExecContext{
 		TaskDir: td,
+		TaskEnv: te,
 	}
 }
 
diff --git a/client/driver/driver_test.go b/client/driver/driver_test.go
index 21fcd1eb3..9bda35f0d 100644
--- a/client/driver/driver_test.go
+++ b/client/driver/driver_test.go
@@ -80,9 +80,10 @@ func testConfig() *config.Config {
 }
 
 type testContext struct {
-	AllocDir  *allocdir.AllocDir
-	DriverCtx *DriverContext
-	ExecCtx   *ExecContext
+	AllocDir   *allocdir.AllocDir
+	DriverCtx  *DriverContext
+	ExecCtx    *ExecContext
+	EnvBuilder *env.Builder
 }
 
 // testDriverContext sets up an alloc dir, task dir, DriverContext, and ExecContext.
@@ -112,23 +113,17 @@ func testDriverContexts(t *testing.T, task *structs.Task) *testContext {
 		t.Fatalf("TaskDir.Build(%#v, %q) failed: %v", config.DefaultChrootEnv, tmpdrv.FSIsolation(), err)
 		return nil
 	}
-
-	execCtx := NewExecContext(td)
-
-	taskEnv, err := GetTaskEnv(td, cfg.Node, task, alloc, cfg, "")
-	if err != nil {
-		allocDir.Destroy()
-		t.Fatalf("GetTaskEnv() failed: %v", err)
-		return nil
-	}
+	eb := env.NewBuilder(cfg.Node, alloc, task, cfg.Region)
+	SetEnvvars(eb, tmpdrv.FSIsolation(), td, cfg)
+	execCtx := NewExecContext(td, eb.Build())
 
 	logger := testLogger()
 	emitter := func(m string, args ...interface{}) {
 		logger.Printf("[EVENT] "+m, args...)
 	}
-	driverCtx := NewDriverContext(task.Name, alloc.ID, cfg, cfg.Node, logger, taskEnv, emitter)
+	driverCtx := NewDriverContext(task.Name, alloc.ID, cfg, cfg.Node, logger, emitter)
 
-	return &testContext{allocDir, driverCtx, execCtx}
+	return &testContext{allocDir, driverCtx, execCtx, eb}
 }
 
 // setupTaskEnv creates a test env for GetTaskEnv testing. Returns task dir,
@@ -165,10 +160,12 @@ func setupTaskEnv(t *testing.T, driver string) (*allocdir.TaskDir, map[string]st
 	conf := testConfig()
 	allocDir := allocdir.NewAllocDir(testLogger(), filepath.Join(conf.AllocDir, alloc.ID))
 	taskDir := allocDir.NewTaskDir(task.Name)
-	env, err := GetTaskEnv(taskDir, conf.Node, task, alloc, conf, "")
+	eb := env.NewBuilder(conf.Node, alloc, task, conf.Region)
+	tmpDriver, err := NewDriver(driver, NewEmptyDriverContext())
 	if err != nil {
-		t.Fatalf("GetTaskEnv() failed: %v", err)
+		t.Fatalf("unable to create driver %q: %v", driver, err)
 	}
+	SetEnvvars(eb, tmpDriver.FSIsolation(), taskDir, conf)
 	exp := map[string]string{
 		"NOMAD_CPU_LIMIT":               "1000",
 		"NOMAD_MEMORY_LIMIT":            "500",
@@ -216,7 +213,7 @@ func setupTaskEnv(t *testing.T, driver string) (*allocdir.TaskDir, map[string]st
 		"NOMAD_REGION":                  "global",
 	}
 
-	act := env.EnvMap()
+	act := eb.Build().Map()
 	return taskDir, exp, act
 }
 
@@ -275,9 +272,9 @@ func TestDriver_GetTaskEnv_Chroot(t *testing.T) {
 	}
 }
 
-// TestDriver_GetTaskEnv_Image ensures host environment variables are not set
+// TestDriver_TaskEnv_Image ensures host environment variables are not set
 // for image based drivers. See #2211
-func TestDriver_GetTaskEnv_Image(t *testing.T) {
+func TestDriver_TaskEnv_Image(t *testing.T) {
 	_, exp, act := setupTaskEnv(t, "docker")
 
 	exp[env.AllocDir] = allocdir.SharedAllocContainerPath
diff --git a/client/driver/env/env.go b/client/driver/env/env.go
index aee63d3a3..f8ffdc10c 100644
--- a/client/driver/env/env.go
+++ b/client/driver/env/env.go
@@ -309,6 +309,11 @@ func (b *Builder) Build() *TaskEnv {
 		envMap[VaultToken] = b.vaultToken
 	}
 
+	// Copy task meta
+	for k, v := range b.taskMeta {
+		envMap[k] = v
+	}
+
 	// Copy node attributes
 	for k, v := range b.nodeAttrs {
 		nodeAttrs[k] = v
@@ -394,9 +399,10 @@ func (b *Builder) setAlloc(alloc *structs.Allocation) *Builder {
 // setNode is called from NewBuilder to populate node attributes.
 func (b *Builder) setNode(n *structs.Node) *Builder {
 	b.nodeAttrs[nodeIdKey] = n.ID
-	b.nodeAttrs[nodeDcKey] = n.Datacenter
 	b.nodeAttrs[nodeNameKey] = n.Name
 	b.nodeAttrs[nodeClassKey] = n.NodeClass
+	b.nodeAttrs[nodeDcKey] = n.Datacenter
+	b.datacenter = n.Datacenter
 
 	// Set up the attributes.
 	for k, v := range n.Attributes {
diff --git a/client/driver/exec.go b/client/driver/exec.go
index 29d3ab50a..cf69a2228 100644
--- a/client/driver/exec.go
+++ b/client/driver/exec.go
@@ -124,7 +124,7 @@ func (d *ExecDriver) Start(ctx *ExecContext, task *structs.Task) (DriverHandle,
 		return nil, err
 	}
 	executorCtx := &executor.ExecutorContext{
-		TaskEnv: d.taskEnv,
+		TaskEnv: ctx.TaskEnv,
 		Driver:  "exec",
 		AllocID: d.DriverContext.allocID,
 		LogDir:  ctx.TaskDir.LogDir,
diff --git a/client/driver/java.go b/client/driver/java.go
index 4898375ca..86a798f4c 100644
--- a/client/driver/java.go
+++ b/client/driver/java.go
@@ -203,7 +203,7 @@ func NewJavaDriverConfig(task *structs.Task, env *env.TaskEnv) (*JavaDriverConfi
 }
 
 func (d *JavaDriver) Start(ctx *ExecContext, task *structs.Task) (DriverHandle, error) {
-	driverConfig, err := NewJavaDriverConfig(task, d.taskEnv)
+	driverConfig, err := NewJavaDriverConfig(task, ctx.TaskEnv)
 	if err != nil {
 		return nil, err
 	}
@@ -249,7 +249,7 @@ func (d *JavaDriver) Start(ctx *ExecContext, task *structs.Task) (DriverHandle,
 
 	// Set the context
 	executorCtx := &executor.ExecutorContext{
-		TaskEnv: d.taskEnv,
+		TaskEnv: ctx.TaskEnv,
 		Driver:  "java",
 		AllocID: d.DriverContext.allocID,
 		Task:    task,
diff --git a/client/driver/qemu.go b/client/driver/qemu.go
index 53018cb45..118a140df 100644
--- a/client/driver/qemu.go
+++ b/client/driver/qemu.go
@@ -238,7 +238,7 @@ func (d *QemuDriver) Start(ctx *ExecContext, task *structs.Task) (DriverHandle,
 		return nil, err
 	}
 	executorCtx := &executor.ExecutorContext{
-		TaskEnv: d.taskEnv,
+		TaskEnv: ctx.TaskEnv,
 		Driver:  "qemu",
 		AllocID: d.DriverContext.allocID,
 		Task:    task,
diff --git a/client/driver/raw_exec.go b/client/driver/raw_exec.go
index 7806cc760..3c002d7a1 100644
--- a/client/driver/raw_exec.go
+++ b/client/driver/raw_exec.go
@@ -133,7 +133,7 @@ func (d *RawExecDriver) Start(ctx *ExecContext, task *structs.Task) (DriverHandl
 		return nil, err
 	}
 	executorCtx := &executor.ExecutorContext{
-		TaskEnv: d.taskEnv,
+		TaskEnv: ctx.TaskEnv,
 		Driver:  "raw_exec",
 		AllocID: d.DriverContext.allocID,
 		Task:    task,
@@ -169,7 +169,7 @@ func (d *RawExecDriver) Start(ctx *ExecContext, task *structs.Task) (DriverHandl
 		logger:         d.logger,
 		doneCh:         make(chan struct{}),
 		waitCh:         make(chan *dstructs.WaitResult, 1),
-		taskEnv:        d.taskEnv,
+		taskEnv:        ctx.TaskEnv,
 		taskDir:        ctx.TaskDir,
 	}
 	go h.run()
@@ -218,7 +218,7 @@ func (d *RawExecDriver) Open(ctx *ExecContext, handleID string) (DriverHandle, e
 		version:        id.Version,
 		doneCh:         make(chan struct{}),
 		waitCh:         make(chan *dstructs.WaitResult, 1),
-		taskEnv:        d.taskEnv,
+		taskEnv:        ctx.TaskEnv,
 		taskDir:        ctx.TaskDir,
 	}
 	go h.run()
diff --git a/client/driver/rkt.go b/client/driver/rkt.go
index f2074fde1..4d7be142a 100644
--- a/client/driver/rkt.go
+++ b/client/driver/rkt.go
@@ -55,6 +55,9 @@ const (
 	// rktCmd is the command rkt is installed as.
 	rktCmd = "rkt"
 
+	// envCmd it the command for injecting environment variables.
+	envCmd = "env"
+
 	// rktUuidDeadline is how long to wait for the uuid file to be written
 	rktUuidDeadline = 5 * time.Second
 )
@@ -240,7 +243,20 @@ func (d *RktDriver) Start(ctx *ExecContext, task *structs.Task) (DriverHandle, e
 	img := driverConfig.ImageName
 
 	// Build the command.
-	cmdArgs := make([]string, 0, 32)
+	cmdArgs := make([]string, 0, 50)
+
+	// Run rkt with env command to inject PATH as rkt needs to be able to find iptables
+	envAbsPath, err := GetAbsolutePath(envCmd)
+	if err != nil {
+		return nil, fmt.Errorf("unable to locate env command which is required for rkt")
+	}
+	cmdArgs = append(cmdArgs, fmt.Sprintf("PATH=%q", os.Getenv("PATH")))
+
+	rktAbsPath, err := GetAbsolutePath(rktCmd)
+	if err != nil {
+		return nil, err
+	}
+	cmdArgs = append(cmdArgs, rktAbsPath)
 
 	// Add debug option to rkt command.
 	debug := driverConfig.Debug
@@ -310,7 +326,7 @@ func (d *RktDriver) Start(ctx *ExecContext, task *structs.Task) (DriverHandle, e
 	cmdArgs = append(cmdArgs, fmt.Sprintf("--debug=%t", debug))
 
 	// Inject environment variables
-	for k, v := range d.taskEnv.Map() {
+	for k, v := range ctx.TaskEnv.Map() {
 		cmdArgs = append(cmdArgs, fmt.Sprintf("--set-env=%v=%q", k, v))
 	}
 
@@ -400,7 +416,7 @@ func (d *RktDriver) Start(ctx *ExecContext, task *structs.Task) (DriverHandle, e
 
 	// Add user passed arguments.
 	if len(driverConfig.Args) != 0 {
-		parsed := d.taskEnv.ParseAndReplace(driverConfig.Args)
+		parsed := ctx.TaskEnv.ParseAndReplace(driverConfig.Args)
 
 		// Need to start arguments with "--"
 		if len(parsed) > 0 {
@@ -423,7 +439,7 @@ func (d *RktDriver) Start(ctx *ExecContext, task *structs.Task) (DriverHandle, e
 		return nil, err
 	}
 	executorCtx := &executor.ExecutorContext{
-		TaskEnv: d.taskEnv,
+		TaskEnv: ctx.TaskEnv,
 		Driver:  "rkt",
 		AllocID: d.DriverContext.allocID,
 		Task:    task,
@@ -435,13 +451,8 @@ func (d *RktDriver) Start(ctx *ExecContext, task *structs.Task) (DriverHandle, e
 		return nil, fmt.Errorf("failed to set executor context: %v", err)
 	}
 
-	absPath, err := GetAbsolutePath(rktCmd)
-	if err != nil {
-		return nil, err
-	}
-
 	execCmd := &executor.ExecCommand{
-		Cmd:  absPath,
+		Cmd:  envAbsPath,
 		Args: cmdArgs,
 		User: task.User,
 	}
@@ -473,7 +484,7 @@ func (d *RktDriver) Start(ctx *ExecContext, task *structs.Task) (DriverHandle, e
 	maxKill := d.DriverContext.config.MaxKillTimeout
 	h := &rktHandle{
 		uuid:           uuid,
-		env:            d.taskEnv,
+		env:            ctx.TaskEnv,
 		taskDir:        ctx.TaskDir,
 		pluginClient:   pluginClient,
 		executor:       execIntf,
@@ -515,7 +526,7 @@ func (d *RktDriver) Open(ctx *ExecContext, handleID string) (DriverHandle, error
 	// Return a driver handle
 	h := &rktHandle{
 		uuid:           id.UUID,
-		env:            d.taskEnv,
+		env:            ctx.TaskEnv,
 		taskDir:        ctx.TaskDir,
 		pluginClient:   pluginClient,
 		executorPid:    id.ExecutorPid,
diff --git a/client/driver/utils.go b/client/driver/utils.go
index df23f9c1e..2f456b3b2 100644
--- a/client/driver/utils.go
+++ b/client/driver/utils.go
@@ -12,9 +12,12 @@ import (
 
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/go-plugin"
+	"github.com/hashicorp/nomad/client/allocdir"
 	"github.com/hashicorp/nomad/client/config"
+	"github.com/hashicorp/nomad/client/driver/env"
 	"github.com/hashicorp/nomad/client/driver/executor"
-	cstructs "github.com/hashicorp/nomad/client/driver/structs"
+	dstructs "github.com/hashicorp/nomad/client/driver/structs"
+	cstructs "github.com/hashicorp/nomad/client/structs"
 	"github.com/hashicorp/nomad/helper/discover"
 	"github.com/hashicorp/nomad/nomad/structs"
 )
@@ -29,7 +32,7 @@ func cgroupsMounted(node *structs.Node) bool {
 // createExecutor launches an executor plugin and returns an instance of the
 // Executor interface
 func createExecutor(w io.Writer, clientConfig *config.Config,
-	executorConfig *cstructs.ExecutorConfig) (executor.Executor, *plugin.Client, error) {
+	executorConfig *dstructs.ExecutorConfig) (executor.Executor, *plugin.Client, error) {
 
 	c, err := json.Marshal(executorConfig)
 	if err != nil {
@@ -171,10 +174,33 @@ func GetAbsolutePath(bin string) (string, error) {
 }
 
 // getExecutorUser returns the user of the task, defaulting to
-// cstructs.DefaultUnprivilegedUser if none was given.
+// dstructs.DefaultUnprivilegedUser if none was given.
 func getExecutorUser(task *structs.Task) string {
 	if task.User == "" {
-		return cstructs.DefaultUnpriviledgedUser
+		return dstructs.DefaultUnpriviledgedUser
 	}
 	return task.User
 }
+
+// SetEnvvars sets path and host env vars depending on the FS isolation used.
+func SetEnvvars(envBuilder *env.Builder, fsi cstructs.FSIsolation, taskDir *allocdir.TaskDir, conf *config.Config) {
+	// Set driver-specific environment variables
+	switch fsi {
+	case cstructs.FSIsolationNone:
+		// Use host paths
+		envBuilder.SetAllocDir(taskDir.SharedAllocDir)
+		envBuilder.SetTaskLocalDir(taskDir.LocalDir)
+		envBuilder.SetSecretsDir(taskDir.SecretsDir)
+	default:
+		// filesystem isolation; use container paths
+		envBuilder.SetAllocDir(allocdir.SharedAllocContainerPath)
+		envBuilder.SetTaskLocalDir(allocdir.TaskLocalContainerPath)
+		envBuilder.SetSecretsDir(allocdir.TaskSecretsContainerPath)
+	}
+
+	// Set the host environment variables for non-image based drivers
+	if fsi != cstructs.FSIsolationImage {
+		filter := strings.Split(conf.ReadDefault("env.blacklist", config.DefaultEnvBlacklist), ",")
+		envBuilder.SetHostEnvvars(filter)
+	}
+}
diff --git a/client/task_runner.go b/client/task_runner.go
index bd17ab72d..1be4e0112 100644
--- a/client/task_runner.go
+++ b/client/task_runner.go
@@ -337,7 +337,7 @@ func (r *TaskRunner) RestoreState() (string, error) {
 			return "", err
 		}
 
-		ctx := driver.NewExecContext(r.taskDir)
+		ctx := driver.NewExecContext(r.taskDir, r.envBuilder.Build())
 		handle, err := d.Open(ctx, snap.HandleID)
 
 		// In the case it fails, we relaunch the task in the Run() method.
@@ -488,7 +488,7 @@ func (r *TaskRunner) createDriver() (driver.Driver, error) {
 		r.setState(structs.TaskStatePending, structs.NewTaskEvent(structs.TaskDriverMessage).SetDriverMessage(msg))
 	}
 
-	driverCtx := driver.NewDriverContext(r.task.Name, r.alloc.ID, r.config, r.config.Node, r.logger, r.envBuilder.Build(), eventEmitter)
+	driverCtx := driver.NewDriverContext(r.task.Name, r.alloc.ID, r.config, r.config.Node, r.logger, eventEmitter)
 	d, err := driver.NewDriver(r.task.Driver, driverCtx)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create driver '%s' for alloc %s: %v",
@@ -1174,7 +1174,7 @@ func (r *TaskRunner) cleanup() {
 
 	res := r.getCreatedResources()
 
-	ctx := driver.NewExecContext(r.taskDir)
+	ctx := driver.NewExecContext(r.taskDir, r.envBuilder.Build())
 	attempts := 1
 	var cleanupErr error
 	for retry := true; retry; attempts++ {
@@ -1302,7 +1302,7 @@ func (r *TaskRunner) startTask() error {
 	}
 
 	// Run prestart
-	ctx := driver.NewExecContext(r.taskDir)
+	ctx := driver.NewExecContext(r.taskDir, r.envBuilder.Build())
 	resp, err := drv.Prestart(ctx, r.task)
 
 	// Merge newly created resources into previously created resources
@@ -1322,6 +1322,9 @@ func (r *TaskRunner) startTask() error {
 		return structs.WrapRecoverable(wrapped, err)
 	}
 
+	// Create a new context for Start since the environment may have been updated.
+	ctx = driver.NewExecContext(r.taskDir, r.envBuilder.Build())
+
 	// Start the job
 	handle, err := drv.Start(ctx, r.task)
 	if err != nil {
@@ -1411,25 +1414,8 @@ func (r *TaskRunner) buildTaskDir(fsi cstructs.FSIsolation) error {
 	r.taskDirBuilt = true
 	r.persistLock.Unlock()
 
-	// Set driver-specific environment variables
-	switch fsi {
-	case cstructs.FSIsolationNone:
-		// Use host paths
-		r.envBuilder.SetAllocDir(r.taskDir.SharedAllocDir)
-		r.envBuilder.SetTaskLocalDir(r.taskDir.LocalDir)
-		r.envBuilder.SetSecretsDir(r.taskDir.SecretsDir)
-	default:
-		// filesystem isolation; use container paths
-		r.envBuilder.SetAllocDir(allocdir.SharedAllocContainerPath)
-		r.envBuilder.SetTaskLocalDir(allocdir.TaskLocalContainerPath)
-		r.envBuilder.SetSecretsDir(allocdir.TaskSecretsContainerPath)
-	}
-
-	// Set the host environment variables for non-image based drivers
-	if fsi != cstructs.FSIsolationImage {
-		filter := strings.Split(r.config.ReadDefault("env.blacklist", config.DefaultEnvBlacklist), ",")
-		r.envBuilder.SetHostEnvvars(filter)
-	}
+	// Set path and host related env vars
+	driver.SetEnvvars(r.envBuilder, fsi, r.taskDir, r.config)
 	return nil
 }
 
diff --git a/helper/testtask/testtask.go b/helper/testtask/testtask.go
index cfcf205f5..9aea5bb7a 100644
--- a/helper/testtask/testtask.go
+++ b/helper/testtask/testtask.go
@@ -9,7 +9,6 @@ import (
 	"os/exec"
 	"time"
 
-	"github.com/hashicorp/nomad/client/driver/env"
 	"github.com/hashicorp/nomad/nomad/structs"
 	"github.com/kardianos/osext"
 )
@@ -23,12 +22,6 @@ func Path() string {
 	return path
 }
 
-// SetEnv configures the environment of the task so that Run executes a testtask
-// script when called from within cmd.
-func SetEnv(env *env.TaskEnvironment) {
-	env.AppendEnvvars(map[string]string{"TEST_TASK": "execute"})
-}
-
 // SetCmdEnv configures the environment of cmd so that Run executes a testtask
 // script when called from within cmd.
 func SetCmdEnv(cmd *exec.Cmd) {