diff --git a/cmd/dmverity-vhd/main.go b/cmd/dmverity-vhd/main.go
index 439a750352..0add4a2189 100644
--- a/cmd/dmverity-vhd/main.go
+++ b/cmd/dmverity-vhd/main.go
@@ -103,7 +103,13 @@ func fetchImageLayers(ctx *cli.Context) (layers []v1.Layer, err error) {
 		// if only an image name is provided and not a tag, the default is "latest"
 		img, err = tarball.ImageFromPath(tarballPath, &imageNameAndTag)
 	} else if dockerDaemon {
-		img, err = daemon.Image(ref)
+		// use the unbuffered opener, the tradeoff being the image will stream as needed
+		// so it is slower but much more memory efficient
+		var opts []daemon.Option
+		opt := daemon.WithUnbufferedOpener()
+		opts = append(opts, opt)
+
+		img, err = daemon.Image(ref, opts...)
 	} else {
 		var remoteOpts []remote.Option
 		if ctx.IsSet(usernameFlag) && ctx.IsSet(passwordFlag) {
diff --git a/internal/hcs/process.go b/internal/hcs/process.go
index e437e297c0..65025f3f9b 100644
--- a/internal/hcs/process.go
+++ b/internal/hcs/process.go
@@ -421,12 +421,6 @@ func (process *Process) CloseStdin(ctx context.Context) (err error) {
 		return makeProcessError(process, operation, ErrAlreadyClosed, nil)
 	}
 
-	process.stdioLock.Lock()
-	defer process.stdioLock.Unlock()
-	if process.stdin == nil {
-		return nil
-	}
-
 	//HcsModifyProcess request to close stdin will fail if the process has already exited
 	if !process.stopped() {
 		modifyRequest := processModifyRequest{
@@ -448,8 +442,12 @@ func (process *Process) CloseStdin(ctx context.Context) (err error) {
 		}
 	}
 
-	process.stdin.Close()
-	process.stdin = nil
+	process.stdioLock.Lock()
+	defer process.stdioLock.Unlock()
+	if process.stdin != nil {
+		process.stdin.Close()
+		process.stdin = nil
+	}
 
 	return nil
 }