{"record":{"id":"adcb70cec4aec144","repo":"containerd/containerd","slug":"sandbox-can-not-be-nil","errorCode":null,"errorMessage":"sandbox can not be nil","messagePattern":"sandbox can not be nil","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"plugins/services/sandbox/controller_service.go","lineNumber":277,"sourceCode":"\tmetrics, err := ctrl.Metrics(ctx, req.GetSandboxID())\n\tif err != nil {\n\t\treturn &api.ControllerMetricsResponse{}, errgrpc.ToGRPC(err)\n\t}\n\treturn &api.ControllerMetricsResponse{\n\t\tMetrics: metrics,\n\t}, nil\n}\n\nfunc (s *controllerService) Update(\n\tctx context.Context,\n\treq *api.ControllerUpdateRequest) (*api.ControllerUpdateResponse, error) {\n\tlog.G(ctx).WithField(\"req\", req).Debug(\"sandbox update resource\")\n\tctrl, err := s.getController(req.Sandboxer)\n\tif err != nil {\n\t\treturn nil, errgrpc.ToGRPC(err)\n\t}\n\tif req.Sandbox == nil {\n\t\treturn nil, fmt.Errorf(\"sandbox can not be nil\")\n\t}\n\terr = ctrl.Update(ctx, req.SandboxID, sandbox.FromProto(req.Sandbox), req.Fields...)\n\tif err != nil {\n\t\treturn &api.ControllerUpdateResponse{}, errgrpc.ToGRPC(err)\n\t}\n\treturn &api.ControllerUpdateResponse{}, nil\n}\n","sourceCodeStart":259,"sourceCodeEnd":285,"githubUrl":"https://github.com/containerd/containerd/blob/4246446a2bf7d03837b0244118d858799393bd80/plugins/services/sandbox/controller_service.go#L259-L285","documentation":"Update validates that the request carries a sandbox message; if req.Sandbox is nil the service rejects the call with a plain fmt.Errorf (not an errdefs kind). It guards ctrl.Update from a nil dereference via sandbox.FromProto(req.Sandbox).","triggerScenarios":"Calling the sandbox Controller Update RPC with Sandboxer set and a controller found, but the Sandbox field of ControllerUpdateRequest left nil.","commonSituations":"Client code builds the update request but forgets to populate the Sandbox field; deserialization yields nil; API migrations where the update payload moved but the field was not set.","solutions":["Populate req.Sandbox with the full updated sandbox proto before calling Update.","Check on the client that Sandbox != nil and return a client-side validation error instead.","Use the correct helper (sandbox.ToProto) on an existing Sandbox object to build the payload."],"exampleFix":"// before\nresp, _ := client.Update(ctx, &api.ControllerUpdateRequest{Sandboxer: sb, SandboxID: id})\n// after\nresp, _ := client.Update(ctx, &api.ControllerUpdateRequest{Sandboxer: sb, SandboxID: id, Sandbox: sandbox.ToProto(newSandbox)})","handlingStrategy":"validation","validationCode":"if req.GetSandbox() == nil { return errors.New(\"ControllerUpdateRequest.Sandbox must be set\") }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always construct update requests through a helper that requires a Sandbox value","Validate protobuf requests before sending (check required fields)"],"tags":["grpc","sandbox","validation"],"backgroundTag":"nil-request-field","analyzedSha":"4246446a2bf7d03837b0244118d858799393bd80","analyzedAt":"2026-09-02T00:14:43.053Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}