{"record":{"id":"a806b46023557097","repo":"containerd/containerd","slug":"sandbox-q-not-found-w","errorCode":null,"errorMessage":"sandbox %q not found: %w","messagePattern":"sandbox %q not found: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cri/server/container_start.go","lineNumber":86,"sourceCode":"\t\t\t\tstatus.Pid = 0\n\t\t\t\tstatus.FinishedAt = time.Now().UnixNano()\n\t\t\t\tstatus.ExitCode = errorStartExitCode\n\t\t\t\tstatus.Reason = errorStartReason\n\t\t\t\tstatus.Message = retErr.Error()\n\t\t\t\treturn status, nil\n\t\t\t}); err != nil {\n\t\t\t\tlog.G(ctx).WithError(err).Errorf(\"failed to set start failure state for container %q\", id)\n\t\t\t}\n\t\t}\n\t\tif err := resetContainerStarting(cntr); err != nil {\n\t\t\tlog.G(ctx).WithError(err).Errorf(\"failed to reset starting state for container %q\", id)\n\t\t}\n\t}()\n\n\t// Get sandbox config from sandbox store.\n\tsandbox, err := c.sandboxStore.Get(meta.SandboxID)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"sandbox %q not found: %w\", meta.SandboxID, err)\n\t}\n\tsandboxID := meta.SandboxID\n\tif sandbox.Status.Get().State != sandboxstore.StateReady {\n\t\treturn nil, fmt.Errorf(\"sandbox container %q is not running\", sandboxID)\n\t}\n\tspan.SetAttributes(tracing.Attribute(\"sandbox.id\", sandboxID))\n\n\tioCreation := func(id string) (_ containerdio.IO, err error) {\n\t\tstdoutWC, stderrWC, err := c.createContainerLoggers(meta.LogPath, config.GetTty())\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create container loggers: %w\", err)\n\t\t}\n\t\tcntr.IO.AddOutput(\"log\", stdoutWC, stderrWC)\n\t\tcntr.IO.Pipe()\n\t\treturn cntr.IO, nil\n\t}\n\n\t// Recheck target container validity in Linux namespace options.","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/containerd/containerd/blob/4246446a2bf7d03837b0244118d858799393bd80/internal/cri/server/container_start.go#L68-L104","documentation":"StartContainer looks up the container's parent pod sandbox (meta.SandboxID) in the internal sandbox store before starting the container. If the sandbox record is gone, this wrapped error is returned with the underlying store error. containerd requires a live, known sandbox to attach the container to (network namespace, runtime handler, endpoint, etc.).","triggerScenarios":"StartContainer is called with a container whose SandboxID no longer exists in the sandbox store — typically the pod sandbox was removed (StopSandbox/RemoveSandbox) or the store entry was evicted/cleaned while the container record still exists.","commonSituations":"Kubelet starting a container of a pod that is concurrently being torn down; sandbox garbage collection after a failed pod; stale container entries after containerd restart where sandboxes were not recovered; misconfigured pod pointing at a deleted sandbox.","solutions":["Check that the pod sandbox still exists (crictl pods / PodSandboxStatus) before starting containers in it.","If the sandbox is gone, stop and remove the orphan container and let the higher-level runtime (kubelet) recreate the pod.","Investigate why the sandbox was removed: look for StopPodSandbox/RemovePodSandbox events around the failure time in containerd logs.","After a containerd restart, verify sandbox recovery; if sandboxes were not recovered, restart the node agent so pods are rescheduled.","Ensure CRI clients don't race sandbox removal against container start; serialize pod teardown before container operations."],"exampleFix":"// before: start container unconditionally\nruntimeService.StartContainer(containerID)\n// after: verify sandbox is present and ready first\nsb, err := runtimeService.PodSandboxStatus(sandboxID)\nif err != nil {\n    return fmt.Errorf(\"sandbox %s gone, recreate pod: %w\", sandboxID, err)\n}\nruntimeService.StartContainer(containerID)","handlingStrategy":"validation","validationCode":"if _, err := runtimeService.PodSandboxStatus(ctx, sandboxID); err != nil {\n    return fmt.Errorf(\"sandbox %s missing, recreate pod before starting containers: %w\", sandboxID, err)\n}","typeGuard":"func sandboxExists(ctx context.Context, rs runtime.RuntimeService, id string) bool {\n    _, err := rs.PodSandboxStatus(ctx, id)\n    return err == nil\n}","tryCatchPattern":"_, err := runtimeService.StartContainer(ctx, containerID)\nif err != nil && strings.Contains(err.Error(), \"sandbox\") && strings.Contains(err.Error(), \"not found\") {\n    return recreatePod(sandboxID) // sandbox is gone; let kubelet recreate\n}","preventionTips":["Check sandbox presence before starting its containers","Never start containers of a pod that has been stopped/removed","Handle node restarts by relying on kubelet resync rather than raw CRI calls","Watch for StopPodSandbox events and cancel pending container starts","Keep container store and sandbox store lifecycles aligned (remove orphan containers)"],"tags":["containerd","cri","sandbox","store-lookup"],"backgroundTag":"sandbox-not-found","analyzedSha":"4246446a2bf7d03837b0244118d858799393bd80","analyzedAt":"2026-09-02T00:14:43.053Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}