diff --git a/src/shadowbox/docker/cmd.sh b/src/shadowbox/docker/cmd.sh
index 52bb8ecd..080abb48 100755
--- a/src/shadowbox/docker/cmd.sh
+++ b/src/shadowbox/docker/cmd.sh
@@ -17,6 +17,9 @@
 export SB_PUBLIC_IP=${SB_PUBLIC_IP:-$(curl https://ipinfo.io/ip)}
 export SB_METRICS_URL=${SB_METRICS_URL:-https://metrics-prod.uproxy.org}
 
+# Make sure we don't leave readable files behind.
+umask 0077
+
 # The maximum number of files that can be opened by ss-server greatly
 # influence on performance, as described here:
 #   https://shadowsocks.org/en/config/advanced.html