diff --git a/daemon/container_unix.go b/daemon/container_unix.go
index c005347f14..7bbd160546 100644
--- a/daemon/container_unix.go
+++ b/daemon/container_unix.go
@@ -910,6 +910,13 @@ func createNetwork(controller libnetwork.NetworkController, dnet string, driver
 }
 
 func (container *Container) allocateNetwork() error {
+	sb := container.getNetworkSandbox()
+	if sb != nil {
+		// Cleanup any stale sandbox left over due to ungraceful daemon shutdown
+		if err := sb.Delete(); err != nil {
+			logrus.Errorf("failed to cleanup up stale network sandbox for container %s", container.ID)
+		}
+	}
 	updateSettings := false
 	if len(container.NetworkSettings.Networks) == 0 {
 		mode := container.hostConfig.NetworkMode
@@ -936,6 +943,18 @@ func (container *Container) allocateNetwork() error {
 	return container.writeHostConfig()
 }
 
+func (container *Container) getNetworkSandbox() libnetwork.Sandbox {
+	var sb libnetwork.Sandbox
+	container.daemon.netController.WalkSandboxes(func(s libnetwork.Sandbox) bool {
+		if s.ContainerID() == container.ID {
+			sb = s
+			return true
+		}
+		return false
+	})
+	return sb
+}
+
 // ConnectToNetwork connects a container to a netork
 func (container *Container) ConnectToNetwork(idOrName string) error {
 	if !container.Running {
@@ -1001,14 +1020,7 @@ func (container *Container) connectToNetwork(idOrName string, updateSettings boo
 		return err
 	}
 
-	var sb libnetwork.Sandbox
-	controller.WalkSandboxes(func(s libnetwork.Sandbox) bool {
-		if s.ContainerID() == container.ID {
-			sb = s
-			return true
-		}
-		return false
-	})
+	sb := container.getNetworkSandbox()
 	if sb == nil {
 		options, err := container.buildSandboxOptions(n)
 		if err != nil {