containerd/containerd · warning

sandbox can not be nil

Error message

sandbox can not be nil

What it means

Update validates that the request carries a sandbox message; if req.Sandbox is nil the service rejects the call with a plain fmt.Errorf (not an errdefs kind). It guards ctrl.Update from a nil dereference via sandbox.FromProto(req.Sandbox).

Source

Thrown at plugins/services/sandbox/controller_service.go:277

	metrics, err := ctrl.Metrics(ctx, req.GetSandboxID())
	if err != nil {
		return &api.ControllerMetricsResponse{}, errgrpc.ToGRPC(err)
	}
	return &api.ControllerMetricsResponse{
		Metrics: metrics,
	}, nil
}

func (s *controllerService) Update(
	ctx context.Context,
	req *api.ControllerUpdateRequest) (*api.ControllerUpdateResponse, error) {
	log.G(ctx).WithField("req", req).Debug("sandbox update resource")
	ctrl, err := s.getController(req.Sandboxer)
	if err != nil {
		return nil, errgrpc.ToGRPC(err)
	}
	if req.Sandbox == nil {
		return nil, fmt.Errorf("sandbox can not be nil")
	}
	err = ctrl.Update(ctx, req.SandboxID, sandbox.FromProto(req.Sandbox), req.Fields...)
	if err != nil {
		return &api.ControllerUpdateResponse{}, errgrpc.ToGRPC(err)
	}
	return &api.ControllerUpdateResponse{}, nil
}

View on GitHub (pinned to 4246446a2b)

Solutions

1. Populate req.Sandbox with the full updated sandbox proto before calling Update.
2. Check on the client that Sandbox != nil and return a client-side validation error instead.
3. Use the correct helper (sandbox.ToProto) on an existing Sandbox object to build the payload.

Example fix

// before
resp, _ := client.Update(ctx, &api.ControllerUpdateRequest{Sandboxer: sb, SandboxID: id})
// after
resp, _ := client.Update(ctx, &api.ControllerUpdateRequest{Sandboxer: sb, SandboxID: id, Sandbox: sandbox.ToProto(newSandbox)})

if req.GetSandbox() == nil { return errors.New("ControllerUpdateRequest.Sandbox must be set") }

When it happens

Trigger: Calling the sandbox Controller Update RPC with Sandboxer set and a controller found, but the Sandbox field of ControllerUpdateRequest left nil.

Common situations: Client code builds the update request but forgets to populate the Sandbox field; deserialization yields nil; API migrations where the update payload moved but the field was not set.

Related errors

• ErrInvalidArgument
• sandbox config must include metadata
• unsupported client type %T
• failed to query controller status: %w
• ErrNotFound

AI-assisted analysis of containerd/containerd@4246446a2b (2026-09-02). Data as JSON: /api/errors/adcb70cec4aec144. Report an issue: GitHub.