diff --git a/pkg/runner/job_executor.go b/pkg/runner/job_executor.go
index 8bbed6c..8cf87a4 100644
--- a/pkg/runner/job_executor.go
+++ b/pkg/runner/job_executor.go
@@ -38,8 +38,6 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo
 		return common.NewDebugExecutor("No steps found")
 	}
 
-	preSteps = append(preSteps, info.startContainer())
-
 	for i, stepModel := range infoSteps {
 		stepModel := stepModel
 		if stepModel == nil {
@@ -104,7 +102,7 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo
 	pipeline = append(pipeline, preSteps...)
 	pipeline = append(pipeline, steps...)
 
-	return common.NewPipelineExecutor(pipeline...).
+	return common.NewPipelineExecutor(info.startContainer(), common.NewPipelineExecutor(pipeline...).
 		Finally(func(ctx context.Context) error {
 			var cancel context.CancelFunc
 			if ctx.Err() == context.Canceled {
@@ -116,7 +114,7 @@ func newJobExecutor(info jobInfo, sf stepFactory, rc *RunContext) common.Executo
 			return postExecutor(ctx)
 		}).
 		Finally(info.interpolateOutputs()).
-		Finally(info.closeContainer())
+		Finally(info.closeContainer()))
 }
 
 func useStepLogger(rc *RunContext, stepModel *model.Step, stage stepStage, executor common.Executor) common.Executor {
diff --git a/pkg/runner/runner_test.go b/pkg/runner/runner_test.go
index c307d52..86bd5c3 100644
--- a/pkg/runner/runner_test.go
+++ b/pkg/runner/runner_test.go
@@ -156,6 +156,7 @@ func TestRunEvent(t *testing.T) {
 		{workdir, "checkout", "push", "", platforms},
 		{workdir, "job-container", "push", "", platforms},
 		{workdir, "job-container-non-root", "push", "", platforms},
+		{workdir, "job-container-invalid-credentials", "push", "failed to handle credentials: failed to interpolate container.credentials.password", platforms},
 		{workdir, "container-hostname", "push", "", platforms},
 		{workdir, "remote-action-docker", "push", "", platforms},
 		{workdir, "remote-action-js", "push", "", platforms},
diff --git a/pkg/runner/testdata/job-container-invalid-credentials/push.yml b/pkg/runner/testdata/job-container-invalid-credentials/push.yml
new file mode 100644
index 0000000..79c397e
--- /dev/null
+++ b/pkg/runner/testdata/job-container-invalid-credentials/push.yml
@@ -0,0 +1,13 @@
+name: job-container-invalid-credentials
+on: push
+
+jobs:
+  fail-on-invalid-credentials:
+    runs-on: ubuntu-latest
+    container:
+      image: node:16-buster-slim
+      credentials:
+        username: "user"
+        password: "" # Empty password caused a crash in jobexecutor
+    steps:
+      - run: exit 0