{"record":{"id":"f34ac19e298b33c9","repo":"containerd/containerd","slug":"failed-to-get-sandbox-controllers-from-plugins-v","errorCode":null,"errorMessage":"failed to get sandbox controllers from plugins %v","messagePattern":"failed to get sandbox controllers from plugins (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/cri/cri.go","lineNumber":129,"sourceCode":"\t\tfor _, w := range warnings {\n\t\t\twarn.Emit(ic.Context, w)\n\t\t}\n\t}\n\n\tlog.G(ctx).Info(\"Connect containerd service\")\n\tclient, err := containerd.New(\n\t\t\"\",\n\t\tcontainerd.WithDefaultNamespace(constants.K8sContainerdNamespace),\n\t\tcontainerd.WithDefaultPlatform(platforms.Default()),\n\t\tcontainerd.WithInMemoryServices(ic),\n\t)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create containerd client: %w\", err)\n\t}\n\n\tsbControllers, err := getSandboxControllers(ic)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get sandbox controllers from plugins %v\", err)\n\t}\n\n\tstreamingConfig, err := config.StreamingConfig()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get streaming config: %w\", err)\n\t}\n\n\tvar shimPath string\n\tshimPlugin, err := ic.GetSingle(plugins.ShimPlugin)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get shim plugin: %w\", err)\n\t}\n\tif hasEnv, ok := shimPlugin.(interface{ Env() []string }); ok {\n\t\tenv := hasEnv.Env()\n\t\tfor i := len(env) - 1; i >= 0; i-- {\n\t\t\t// iterate backwards to grab the last PATH=\n\t\t\tif path, ok := strings.CutPrefix(env[i], \"PATH=\"); ok {\n\t\t\t\tshimPath = path","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/containerd/containerd/blob/4246446a2bf7d03837b0244118d858799393bd80/plugins/cri/cri.go#L111-L147","documentation":"The CRI server needs pod-sandbox controllers to manage pods. initCRIService calls getSandboxControllers(ic), which resolves SandboxControllerPlugin instances from the plugin context; on failure (missing controllers or lookup error) this message wraps the cause and the CRI plugin fails to load. Without sandbox controllers the CRI runtime cannot create or stop pod sandboxes.","triggerScenarios":"containerd startup where no io.containerd.runtime.sandbox.controllers.* plugins resolve — the sandbox controller plugins are absent, disabled, or failed their own initialization (wrapped cause contains the details).","commonSituations":"Builds compiled without the default sandbox controllers (e.g. \"podsandbox\" controller); config disabling the controllers section; failure of underlying store services the controllers depend on; version mismatch where the controller plugin type/IDs changed.","solutions":["Read the wrapped error from getSandboxControllers to see which controller lookup failed.","Ensure the built-in sandbox controller plugins (e.g. io.containerd.sandbox.controller.podsandbox) are compiled in and not disabled in config.toml.","Verify shim-based controllers (e.g. for kata) have their corresponding shim binaries installed and configured.","Update to a containerd release matching your config schema (sandbox controller APIs changed across 1.7/2.x)."],"exampleFix":"# before (controllers disabled)\n[plugins.\"io.containerd.internal.cri\".controllers]\n  podsandbox = \"\"\n\n# after (use built-in controller)\n[plugins.\"io.containerd.internal.cri\"]\n  # default podsandbox controller enabled implicitly","handlingStrategy":"validation","validationCode":"// Pre-flight: ensure sandbox controllers are registered\n// containerd --version and grep startup log for 'sandbox.controller'\n// or: for _, c := range ic.GetByType(plugins.SandboxControllerPlugin) { _ = c } // must be non-empty","typeGuard":null,"tryCatchPattern":"controllers, err := getSandboxControllers(ic)\nif err != nil {\n\tif errors.Is(err, plugin.ErrPluginNotFound) {\n\t\tlog.Errorf(\"no sandbox controller plugins registered; check build/config: %v\", err)\n\t}\n\treturn err\n}","preventionTips":["Do not disable the internal sandbox controller plugins in config.toml.","Install required shim binaries for non-default sandbox runtimes (e.g. kata).","Pin containerd version and config schema together (1.7 vs 2.x sandbox APIs differ).","After custom builds, run a smoke test that starts a pod sandbox before production."],"tags":["containerd","cri","sandbox","plugin-init"],"backgroundTag":"missing-plugin-dependency","analyzedSha":"4246446a2bf7d03837b0244118d858799393bd80","analyzedAt":"2026-09-02T00:14:43.053Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}