--- a/taskcluster/scripts/run-task
+++ b/taskcluster/scripts/run-task
@@ -323,16 +323,42 @@ def configure_cache_posix(cache, user, g
           '.cacherequires file; the cache names for this task are '
           'likely mis-configured or TASKCLUSTER_CACHES is not set '
           'properly' % cache)
 
     write_audit_entry(audit_path, 'missing .cacherequires')
     return True
 
 
+def configure_volume_posix(volume, user, group, running_as_root):
+    # The only time we should see files in the volume is if the Docker
+    # image build put files there.
+    #
+    # For the sake of simplicity, our policy is that volumes should be
+    # empty. This also has the advantage that an empty volume looks
+    # a lot like an empty cache. Tasks can rely on caches being
+    # swapped in and out on any volume without any noticeable change
+    # of behavior.
+    volume_files = os.listdir(volume)
+    if volume_files:
+        print(NON_EMPTY_VOLUME % volume)
+        print('entries in root directory: %s' %
+              ' '.join(sorted(volume_files)))
+        sys.exit(1)
+
+    # The volume is almost certainly owned by root:root. Chown it so it
+    # is writable.
+
+    if running_as_root:
+        print_line(b'volume', b'changing ownership of volume %s '
+                              b'to %d:%d\n' % (volume, user.pw_uid,
+                                               group.gr_gid))
+        set_dir_permissions(volume, user.pw_uid, group.gr_gid)
+
+
 def vcs_checkout(source_repo, dest, store_path,
                  base_repo=None, revision=None, branch=None,
                  fetch_hgfingerprint=False, sparse_profile=None):
     # Specify method to checkout a revision. This defaults to revisions as
     # SHA-1 strings, but also supports symbolic revisions like `tip` via the
     # branch flag.
     if revision:
         revision_flag = b'--revision'
@@ -509,38 +535,17 @@ def main(args):
 
     # Sanitize volumes.
     for volume in volumes:
         # If a volume is a cache, it was dealt with above.
         if volume in caches:
             print_line(b'volume', b'volume %s is a cache\n' % volume)
             continue
 
-        # The only time we should see files in the volume is if the Docker
-        # image build put files there.
-        #
-        # For the sake of simplicity, our policy is that volumes should be
-        # empty. This also has the advantage that an empty volume looks
-        # a lot like an empty cache. Tasks can rely on caches being
-        # swapped in and out on any volume without any noticeable change
-        # of behavior.
-        volume_files = os.listdir(volume)
-        if volume_files:
-            print(NON_EMPTY_VOLUME % volume)
-            print('entries in root directory: %s' %
-                  ' '.join(sorted(volume_files)))
-            return 1
-
-        # The volume is almost certainly owned by root:root. Chown it so it
-        # is writable.
-
-        if running_as_root:
-            print_line(b'volume', b'changing ownership of volume %s '
-                                  b'to %d:%d\n' % (volume, uid, gid))
-            set_dir_permissions(volume, uid, gid)
+        configure_volume_posix(volume, user, group, running_as_root)
 
     all_caches_and_volumes = set(map(os.path.normpath, caches))
     all_caches_and_volumes |= set(map(os.path.normpath, volumes))
 
     def path_in_cache_or_volume(path):
         path = os.path.normpath(path)
 
         while path: