diff --git a/libnetwork/controller.go b/libnetwork/controller.go
index 849bb4c4cc..ce9c684e27 100644
--- a/libnetwork/controller.go
+++ b/libnetwork/controller.go
@@ -887,13 +887,13 @@ func (c *Controller) NewSandbox(containerID string, options ...SandboxOption) (_
 	}
 	c.mu.Unlock()
 
-	sandboxID := stringid.GenerateRandomID()
-	if runtime.GOOS == "windows" {
-		sandboxID = containerID
-	}
-
 	// Create sandbox and process options first. Key generation depends on an option
 	if sb == nil {
+		// TODO(thaJeztah): given that a "containerID" must be unique in the list of sandboxes, is there any reason we're not using containerID as sandbox ID on non-Windows?
+		sandboxID := containerID
+		if runtime.GOOS != "windows" {
+			sandboxID = stringid.GenerateRandomID()
+		}
 		sb = &Sandbox{
 			id:                 sandboxID,
 			containerID:        containerID,