ping @AkihiroSuda @fuweid

I'm a bit confused; wouldn't the container still need a sandbox?

And when the container be removed, the sandbox will be stayed here

Do you know why it's not removed? Feels like that may be the actual bug?

I'm a bit confused; wouldn't the container still need a sandbox?

And when the container be removed, the sandbox will be stayed here

Do you know why it's not removed? Feels like that may be the actual bug?

Summary

When we set bridge to "none" and create a container, we'll get:

1. create container
2. allocate network <=== we'll set Container.Config.NetworkDisabled to true here
3. create sandbox however

When we delete the container, it will:

1. release network <=== if Container.Config.NetworkDisabled is true jump to step 3
2. delete sandbox
3. delete container

Detail

Create container

func (daemon *Daemon) allocateNetwork(container *container.Container) (retErr error) {

	if nConf, ok := container.NetworkSettings.Networks[defaultNetName]; ok {
		// set container.Config.NetworkDisabled here
		if err := daemon.connectToNetwork(container, defaultNetName, nConf.EndpointSettings, updateSettings); err != nil {
			return err
		}
	}

	// Create its network sandbox now if not present
	if len(networks) == 0 {
		if nil == daemon.getNetworkSandbox(container) {
			sb, err := daemon.netController.NewSandbox(container.ID, sbOptions...)
			if err != nil {
				return err
			}
			updateSandboxNetworkSettings(container, sb)
			defer func() {
				if retErr != nil {
					sb.Delete()
				}
			}()
		}
	}
}

func (daemon *Daemon) connectToNetwork(container *container.Container, idOrName string, ...) (err error) {
	// ...
	if containertypes.NetworkMode(idOrName).IsBridge() &&
		daemon.configStore.DisableBridge {
		container.Config.NetworkDisabled = true
		return nil
	}
	// ...
}

Delete container

When deleting the container, we'll check container.Config.NetworkDisabled. If the value is true, we won't delete the sandbox.

func (daemon *Daemon) releaseNetwork(container *container.Container) {
	if container.HostConfig.NetworkMode.IsContainer() || container.Config.NetworkDisabled {
		return
	}
	// ...
	sb, err := daemon.netController.SandboxByID(sid)
	// ...
	if err := sb.Delete(); err != nil {
		logrus.Errorf("Error deleting sandbox id %s for container %s: %v", sid, container.ID, err)
	}
	// ...
}

@thaJeztah Sorry for my late response.

release network <=== if Container.Config.NetworkDisabled is true jump to step 3

Is the sandbox ID set in that case? Because if that's the case, removing the || container.Config.NetworkDisabled would fix that; looking at the code;

If the sandbox-ID is not set (empty), it would already return early. and if it's set, it would clean it up. If the sandbox ID is set in this case, I think that's something that should be done (even with this fix applied)

Looking further; I wonder if there's other situations that are overlooked for which things should be skipped; thinking of host mode networking; I see there's some handling in daemon.initializeNetworking(), but it does not return before daemon.allocateNetwork() is called;

Ping @thaJeztah