diff --git a/daemon/container_operations.go b/daemon/container_operations.go
index a8a8a7aae2..9f88bb5d47 100644
--- a/daemon/container_operations.go
+++ b/daemon/container_operations.go
@@ -545,7 +545,7 @@ func (daemon *Daemon) allocateNetwork(cfg *config.Config, container *container.C
 			if err != nil {
 				return err
 			}
-			updateSandboxNetworkSettings(container, sb)
+			setNetworkSandbox(container, sb)
 			defer func() {
 				if retErr != nil {
 					sb.Delete()
@@ -747,7 +747,7 @@ func (daemon *Daemon) connectToNetwork(cfg *config.Config, container *container.
 			return err
 		}
 
-		updateSandboxNetworkSettings(container, sb)
+		setNetworkSandbox(container, sb)
 	}
 
 	joinOptions, err := buildJoinOptions(container.NetworkSettings, n)
@@ -1096,9 +1096,8 @@ func getNetworkID(name string, endpointSettings *networktypes.EndpointSettings)
 	return name
 }
 
-// updateSandboxNetworkSettings updates the sandbox ID and Key.
-func updateSandboxNetworkSettings(c *container.Container, sb *libnetwork.Sandbox) error {
+// setNetworkSandbox updates the sandbox ID and Key.
+func setNetworkSandbox(c *container.Container, sb *libnetwork.Sandbox) {
 	c.NetworkSettings.SandboxID = sb.ID()
 	c.NetworkSettings.SandboxKey = sb.Key()
-	return nil
 }
diff --git a/daemon/inspect.go b/daemon/inspect.go
index 32ec615016..a60b61d67b 100644
--- a/daemon/inspect.go
+++ b/daemon/inspect.go
@@ -60,10 +60,10 @@ func (daemon *Daemon) ContainerInspectCurrent(ctx context.Context, name string,
 		NetworkSettingsBase: types.NetworkSettingsBase{
 			Bridge:                 ctr.NetworkSettings.Bridge,
 			SandboxID:              ctr.NetworkSettings.SandboxID,
+			SandboxKey:             ctr.NetworkSettings.SandboxKey,
 			HairpinMode:            ctr.NetworkSettings.HairpinMode,
 			LinkLocalIPv6Address:   ctr.NetworkSettings.LinkLocalIPv6Address,
 			LinkLocalIPv6PrefixLen: ctr.NetworkSettings.LinkLocalIPv6PrefixLen,
-			SandboxKey:             ctr.NetworkSettings.SandboxKey,
 			SecondaryIPAddresses:   ctr.NetworkSettings.SecondaryIPAddresses,
 			SecondaryIPv6Addresses: ctr.NetworkSettings.SecondaryIPv6Addresses,
 		},
@@ -251,11 +251,11 @@ func (daemon *Daemon) getBackwardsCompatibleNetworkSettings(settings *network.Se
 		NetworkSettingsBase: types.NetworkSettingsBase{
 			Bridge:                 settings.Bridge,
 			SandboxID:              settings.SandboxID,
+			SandboxKey:             settings.SandboxKey,
 			HairpinMode:            settings.HairpinMode,
 			LinkLocalIPv6Address:   settings.LinkLocalIPv6Address,
 			LinkLocalIPv6PrefixLen: settings.LinkLocalIPv6PrefixLen,
 			Ports:                  settings.Ports,
-			SandboxKey:             settings.SandboxKey,
 			SecondaryIPAddresses:   settings.SecondaryIPAddresses,
 			SecondaryIPv6Addresses: settings.SecondaryIPv6Addresses,
 		},
diff --git a/daemon/network/settings.go b/daemon/network/settings.go
index 39646c45ee..a39cab5a60 100644
--- a/daemon/network/settings.go
+++ b/daemon/network/settings.go
@@ -15,13 +15,13 @@ import (
 type Settings struct {
 	Bridge                 string
 	SandboxID              string
+	SandboxKey             string
 	HairpinMode            bool
 	LinkLocalIPv6Address   string
 	LinkLocalIPv6PrefixLen int
 	Networks               map[string]*EndpointSettings
 	Service                *clustertypes.ServiceConfig
 	Ports                  nat.PortMap
-	SandboxKey             string
 	SecondaryIPAddresses   []networktypes.Address
 	SecondaryIPv6Addresses []networktypes.Address
 	IsAnonymousEndpoint    bool
diff --git a/libnetwork/controller.go b/libnetwork/controller.go
index 849bb4c4cc..ce9c684e27 100644
--- a/libnetwork/controller.go
+++ b/libnetwork/controller.go
@@ -887,13 +887,13 @@ func (c *Controller) NewSandbox(containerID string, options ...SandboxOption) (_
 	}
 	c.mu.Unlock()
 
-	sandboxID := stringid.GenerateRandomID()
-	if runtime.GOOS == "windows" {
-		sandboxID = containerID
-	}
-
 	// Create sandbox and process options first. Key generation depends on an option
 	if sb == nil {
+		// TODO(thaJeztah): given that a "containerID" must be unique in the list of sandboxes, is there any reason we're not using containerID as sandbox ID on non-Windows?
+		sandboxID := containerID
+		if runtime.GOOS != "windows" {
+			sandboxID = stringid.GenerateRandomID()
+		}
 		sb = &Sandbox{
 			id:                 sandboxID,
 			containerID:        containerID,