diff --git a/0028-use-ocihooks-env-after-getenv.patch b/0028-use-ocihooks-env-after-getenv.patch
new file mode 100644
index 0000000000000000000000000000000000000000..9f7a775acc5d47b6f14c4a14e030035fcf1c3dde
--- /dev/null
+++ b/0028-use-ocihooks-env-after-getenv.patch
@@ -0,0 +1,51 @@
+From 9c82e7c0d345eba3cc0514a536eb8438f328164e Mon Sep 17 00:00:00 2001
+From: zhangxiaoyu <zhangxiaoyu58@huawei.com>
+Date: Thu, 30 Mar 2023 11:38:45 +0800
+Subject: [PATCH] use ocihooks env after getenv
+
+Signed-off-by: zhangxiaoyu <zhangxiaoyu58@huawei.com>
+---
+ src/lxc/conf.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/src/lxc/conf.c b/src/lxc/conf.c
+index c478bf2..3335b0d 100644
+--- a/src/lxc/conf.c
++++ b/src/lxc/conf.c
+@@ -6224,7 +6224,8 @@ static char **merge_ocihook_env(char **oldenvs, size_t env_len, size_t *merge_en
+ {
+ 	char **result  = NULL;
+ 	size_t result_len = env_len;
+-	size_t i, j;
++	size_t i = 0;
++	size_t j, k;
+ 	char *tmpenv = NULL;
+ 	char *lxc_envs[] = {"LD_LIBRARY_PATH", "PATH", "LXC_CGNS_AWARE", "LXC_PID", "LXC_ROOTFS_MOUNT",
+ 	                    "LXC_CONFIG_FILE", "LXC_CGROUP_PATH", "LXC_ROOTFS_PATH", "LXC_NAME"
+@@ -6239,11 +6240,6 @@ static char **merge_ocihook_env(char **oldenvs, size_t env_len, size_t *merge_en
+ 		return NULL;
+ 	memset(result, 0, sizeof(char *) * result_len);
+ 
+-	for(i = 0; i < env_len; i++) {
+-		if (oldenvs[i])
+-			result[i] = safe_strdup(oldenvs[i]);
+-	}
+-
+ 	for(j = 0; j < (sizeof(lxc_envs) / sizeof(char *)); j++) {
+ 		size_t env_buf_len = 0;
+ 		tmpenv = getenv(lxc_envs[j]);
+@@ -6267,6 +6263,11 @@ static char **merge_ocihook_env(char **oldenvs, size_t env_len, size_t *merge_en
+ 		}
+ 	}
+ 
++	for(k = 0; k < env_len; k++) {
++		if (oldenvs[k] && i < (result_len - 1))
++			result[i++] = safe_strdup(oldenvs[k]);
++	}
++
+ 	*merge_env_len = i;
+ 	return result;
+ }
+-- 
+2.25.1
+
diff --git a/lxc.spec b/lxc.spec
index 508061e96a7c0b9618abe28a860bc587ce00275f..7b739f49b3e926d58f0968c62493ba424585f6bb 100644
--- a/lxc.spec
+++ b/lxc.spec
@@ -1,4 +1,4 @@
-%global _release 2022102414
+%global _release 2022102415
 
 Name:           lxc
 Version:        4.0.3
@@ -35,6 +35,7 @@ Patch0024:	0024-remove-process-inheritable-capability.patch
 Patch0025:	0025-fix-ops-hierarchies-cause-coredump.patch
 Patch0026:	0026-meminfo-cri-1.25.patch
 Patch0027:	0027-add-loongarch64-support-for-lxc.patch
+Patch0028:	0028-use-ocihooks-env-after-getenv.patch
 
 BuildRequires:  systemd-units git libtool graphviz docbook2X doxygen chrpath
 BuildRequires:  pkgconfig(libseccomp)
@@ -221,6 +222,12 @@ rm -rf %{buildroot}%{_sysconfdir}/default/%{name}
 %endif
 
 %changelog
+* Tue Apr 18 2023 wangrunze<wangrunze13@huawei.com> - 4.0.3-2022102415
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC: use ocihooks env after getenv
+
 * Tue Apr 18 2023 wangrunze<wangrunze13@huawei.com> - 4.0.3-2022102414
 - Type:bugfix
 - ID:NA