`docker0` network interface is always *DOWN*, `Error locationg sandbox id ... not found`

[Babbili]

Description

on Linux Debian 13, Docker version 28.5.2, build ecc6942

docker0 network interface is always DOWN even if you have a container running on the bridge network.
please check screenshot below

when checking docker.service status we get a warning with the error message below, could be related

msg="error locating sandbox id 98f05a04268b7b0492388b9000587972c5783e14c7f2acb722bd4ddfbab3f3cd: sandbox 98f05a04268b7b0492388b9000587972c5783e14c7f2acb722bd4ddfbab3f3cd not found"

sudo systemctl status docker.service
#output 
● docker.service - Docker Application Container Engine
     Loaded: loaded (/usr/lib/systemd/system/docker.service; enabled; preset: enabled)
     Active: active (running) since Fri 2025-11-07 19:31:41 +04; 2min 14s ago
 Invocation: 7ea7d31463584a0487913c37e19e6b2a
TriggeredBy: ● docker.socket
       Docs: https://docs.docker.com
   Main PID: 1760 (dockerd)
      Tasks: 13
     Memory: 102M (peak: 104.8M)
        CPU: 367ms
     CGroup: /system.slice/docker.service
             └─1760 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock

Nov 07 19:31:40 DEB2BA4I2DLL dockerd[1760]: time="2025-11-07T19:31:40.385518599+04:00" level=info msg="[graphdriver] using prior storage driver: overlay2"
Nov 07 19:31:40 DEB2BA4I2DLL dockerd[1760]: time="2025-11-07T19:31:40.387956965+04:00" level=info msg="Loading containers: start."
Nov 07 19:31:41 DEB2BA4I2DLL dockerd[1760]: time="2025-11-07T19:31:41.016366318+04:00" level=warning msg="error locating sandbox id 98f05a04268b7b0492388b9000587972c5783e14c7f2acb722bd4ddfbab3f3cd: sandbox 98f05a04268b7b0492388b9000587972c5783e14c7f2acb722bd4ddfbab3f3cd not found"
Nov 07 19:31:41 DEB2BA4I2DLL dockerd[1760]: time="2025-11-07T19:31:41.016423305+04:00" level=info msg="Loading containers: done."
Nov 07 19:31:41 DEB2BA4I2DLL dockerd[1760]: time="2025-11-07T19:31:41.026789335+04:00" level=info msg="Docker daemon" commit=89c5e8f containerd-snapshotter=false storage-driver=overlay2 version=28.5.2
Nov 07 19:31:41 DEB2BA4I2DLL dockerd[1760]: time="2025-11-07T19:31:41.026926852+04:00" level=info msg="Initializing buildkit"
Nov 07 19:31:41 DEB2BA4I2DLL dockerd[1760]: time="2025-11-07T19:31:41.048686243+04:00" level=info msg="Completed buildkit initialization"
Nov 07 19:31:41 DEB2BA4I2DLL dockerd[1760]: time="2025-11-07T19:31:41.052903288+04:00" level=info msg="Daemon has completed initialization"
Nov 07 19:31:41 DEB2BA4I2DLL dockerd[1760]: time="2025-11-07T19:31:41.052957389+04:00" level=info msg="API listen on /run/docker.sock"
Nov 07 19:31:41 DEB2BA4I2DLL systemd[1]: Started docker.service - Docker Application Container Engine.

restarting docker.service also didn't bring docker0 UP, nor updating

Reproduce

1. on Linux Debian 13, docker run a container on the default bridge network
2. ip a show docker0
   its status is DOWN which is affecting connectivity

Expected behavior

dev docker0 should be UP when we're having a container running on the bridge network.

docker version

Client: Docker Engine - Community
 Version:           28.5.2
 API version:       1.51
 Go version:        go1.25.3
 Git commit:        ecc6942
 Built:             Wed Nov  5 14:43:33 2025
 OS/Arch:           linux/amd64
 Context:           desktop-linux

Server: Docker Desktop 4.47.0 (206054)
 Engine:
  Version:          28.4.0
  API version:      1.51 (minimum version 1.24)
  Go version:       go1.24.7
  Git commit:       249d679
  Built:            Wed Sep  3 20:57:37 2025
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.7.27
  GitCommit:        05044ec0a9a75232cad458027ca83437aae3f4da
 runc:
  Version:          1.2.5
  GitCommit:        v1.2.5-0-g59923ef
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

docker info

Client: Docker Engine - Community
 Version:    28.5.2
 Context:    desktop-linux
 Debug Mode: false
 Plugins:
  ai: Docker AI Agent - Ask Gordon (Docker Inc.)
    Version:  v1.9.11
    Path:     /home/babbili/.docker/cli-plugins/docker-ai
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.28.0-desktop.1
    Path:     /home/babbili/.docker/cli-plugins/docker-buildx
  cloud: Docker Cloud (Docker Inc.)
    Version:  v0.4.29
    Path:     /home/babbili/.docker/cli-plugins/docker-cloud
  compose: Docker Compose (Docker Inc.)
    Version:  v2.39.4-desktop.1
    Path:     /home/babbili/.docker/cli-plugins/docker-compose
  debug: Get a shell into any image or container (Docker Inc.)
    Version:  0.0.42
    Path:     /home/babbili/.docker/cli-plugins/docker-debug
  desktop: Docker Desktop commands (Docker Inc.)
    Version:  v0.2.0
    Path:     /home/babbili/.docker/cli-plugins/docker-desktop
  extension: Manages Docker extensions (Docker Inc.)
    Version:  v0.2.31
    Path:     /home/babbili/.docker/cli-plugins/docker-extension
  init: Creates Docker-related starter files for your project (Docker Inc.)
    Version:  v1.4.0
    Path:     /home/babbili/.docker/cli-plugins/docker-init
  mcp: Docker MCP Plugin (Docker Inc.)
    Version:  v0.21.0
    Path:     /home/babbili/.docker/cli-plugins/docker-mcp
  sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc.)
    Version:  0.6.0
    Path:     /home/babbili/.docker/cli-plugins/docker-sbom
  scout: Docker Scout (Docker Inc.)
    Version:  v1.18.3
    Path:     /home/babbili/.docker/cli-plugins/docker-scout

Server:
 Containers: 1
  Running: 1
  Paused: 0
  Stopped: 0
 Images: 4
 Server Version: 28.4.0
 Storage Driver: overlayfs
  driver-type: io.containerd.snapshotter.v1
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Discovered Devices:
  cdi: docker.com/gpu=webgpu
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 05044ec0a9a75232cad458027ca83437aae3f4da
 runc version: v1.2.5-0-g59923ef
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.10.14-linuxkit
 Operating System: Docker Desktop
 OSType: linux
 Architecture: x86_64
 CPUs: 8
 Total Memory: 3.666GiB
 Name: docker-desktop
 ID: f5daa3d8-dcf5-4691-ae1a-04622daf3972
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 HTTP Proxy: http.docker.internal:3128
 HTTPS Proxy: http.docker.internal:3128
 No Proxy: hubproxy.docker.internal
 Labels:
  com.docker.desktop.address=unix:///home/babbili/.docker/desktop/docker-cli.sock
 Experimental: false
 Insecure Registries:
  hubproxy.docker.internal:5555
  ::1/128
  127.0.0.0/8
 Live Restore Enabled: false

Additional Info

No response

[Babbili]

just an update on this, most likely it's a permission thing as by running sudo docker run ...
it brings the docker0 network interface UP, but it's uncommon to run sudo behind docker.

dockerd i guess is the one bringing UP the network interface, and it's root owned.

could be on my end, but my user is added to docker group sudo usermod -aG docker $USER and docker run cannot bring docker0 UP without sudo.
or could be an issue

[thaJeztah]

This looks to be an issue on the daemon side (dockerd). This repository is for the Docker CLI, so not the best place to track this.

If you're still having this issue (also with the latest version of docker), and have more details, it's best top open a ticket in https://github.com/moby/moby/issues, which is where the daemon code is maintained. Unfortunately, I cannot transfer this ticket (as GitHub doesn't allow moving tickets between orgs), so I'll close this ticket here for now, but feel free to continue the conversation.