diff --git a/compose/compose.go b/compose/compose.go
index d9e22b9..6e508a8 100644
--- a/compose/compose.go
+++ b/compose/compose.go
@@ -83,6 +83,16 @@ func (c *Compose) Stop(args []string) ([]byte, error) {
 	return c.run(append([]string{"stop"}, args...)...)
 }
 func (c *Compose) Up(args []string) ([]byte, error) {
+	// On compose up, I've seen pulls, as well, so take the lock...?
+	if len(c.registries) > 0 {
+		c.pullLock.Lock()
+		defer c.pullLock.Unlock()
+	}
+	err := c.Login("login")
+	if err != nil {
+		return nil, err
+	}
+	defer c.Login("logout")
 	return c.run(append([]string{"up", "-d"}, args...)...)
 }
 func (c *Compose) Start(args []string) ([]byte, error) {
@@ -101,9 +111,8 @@ func (c *Compose) Pull(args []string) ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
-	out, err := c.run(append([]string{"pull"}, args...)...)
-	c.Login("logout")
-	return out, err
+	defer c.Login("logout")
+	return c.run(append([]string{"pull"}, args...)...)
 }
 func (c *Compose) Logs(args []string) ([]byte, error) {
 	return c.run(append([]string{"logs"}, args...)...)
@@ -117,7 +126,7 @@ func (c *Compose) Exec(args []string) ([]byte, error) {
 
 // Load loads the compose files and returns any errors.
 func (c *Compose) Load(args []string) ([]byte, error) {
-	// TOdO volums
+	// TODO: check and reject volumes?
 	if err := c.AllowedExternalNetworks(); err != nil {
 		return nil, err
 	}
diff --git a/compose/registry.go b/compose/registry.go
index 66089f5..edc025f 100644
--- a/compose/registry.go
+++ b/compose/registry.go
@@ -11,7 +11,7 @@ import (
 	"go.science.ru.nl/log"
 )
 
-func (c *Compose) Login(login string) error {
+func (c *Compose) Login(login string /*logout*/) error {
 	if len(c.registries) == 0 {
 		return nil
 	}
diff --git a/osutil/user.go b/osutil/user.go
index 9e4af8f..df5171b 100644
--- a/osutil/user.go
+++ b/osutil/user.go
@@ -1,8 +1,12 @@
 package osutil
 
 import (
+	"os"
 	"os/user"
+	"path/filepath"
 	"strconv"
+
+	"go.science.ru.nl/log"
 )
 
 // User looks up the username u and return the uid and gid. If the username can't be found 0, 0 is returned.
@@ -22,6 +26,21 @@ func Home(u string) string {
 	if err != nil {
 		return ""
 	}
+	switch u1.HomeDir {
+	case "/":
+		fallthrough
+	case "/bestaat-niet":
+		fallthrough
+	case "/non-existent":
+		// Create a home dir, to store docker login credentials.
+		dockerhome := filepath.Join(filepath.Join(os.TempDir(), u), ".docker")
+		if _, err := os.Stat(dockerhome); os.IsNotExist(err) {
+			if err := os.MkdirAll(dockerhome, 750); err != nil {
+				log.Errorf("Failed to create %q: %s", dockerhome, err)
+			}
+		}
+		return dockerhome
+	}
 	return u1.HomeDir
 }