containerd panics in migrateSandboxes (nil bucket) on first start after updating to 4.98.0, so Docker Desktop won't start #836

Bug report

Description

Docker Desktop auto-updated to 4.98.0, and since then it fails on every start with "service containerd failed: panic detected in containerd".

• The previous version started normally (last good start on 2026-11-08). It ran Docker Engine 28.4.0 with containerd 1.7.27.
• The VM logs show that last session shut down cleanly (disks unmounted, normal power-off), with no disk-full or I/O errors.
• The panic happens in containerd v2's metadata migration (migrateSandboxes, core/metadata/migrations.go:190). Bucket() is called on a nil *bolt.Bucket while it loops over the top-level buckets of the existing 1.7.x meta.db. It looks like the migration assumes every top-level key is a bucket.
• It reproduces on every launch (07:17Z, 13:26Z and 18:56Z on 2026-11-09).

Expected

containerd v2 migrates the existing 1.7.x metadata database, or skips entries it doesn't expect, and starts.

Actual

containerd panics during metadata.(*DB).Init, so Docker Desktop can't start.

Stack trace

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x10 pc=0xaaaae41b8bb4]

goroutine 50 [running]:
go.etcd.io/bbolt.(*Bucket).Bucket(0x0, {0xaaaae5c8bd6b, 0x9, 0x1f?})
	vendor/go.etcd.io/bbolt/bucket.go:89 +0x24
github.com/containerd/containerd/v2/core/metadata.migrateSandboxes.func1({0xffff4d3a165a, 0x7, 0x7}, 0x0)
	core/metadata/migrations.go:190 +0x140
go.etcd.io/bbolt.(*Tx).ForEach.func1(...)
	vendor/go.etcd.io/bbolt/tx.go:158 +0x64
go.etcd.io/bbolt.(*Bucket).ForEach(...)
	vendor/go.etcd.io/bbolt/bucket.go:591 +0xb8
go.etcd.io/bbolt.(*Tx).ForEach(...)
	vendor/go.etcd.io/bbolt/tx.go:157
github.com/containerd/containerd/v2/core/metadata.migrateSandboxes(...)
	core/metadata/migrations.go:182 +0x8c
github.com/containerd/containerd/v2/core/metadata.(*DB).Init.func1(...)
	core/metadata/db.go:213 +0x3ec
go.etcd.io/bbolt.(*DB).Update(...)
	vendor/go.etcd.io/bbolt/db.go:922 +0x68
github.com/containerd/containerd/v2/core/metadata.(*DB).Init(...)
	core/metadata/db.go:162 +0xc4
github.com/containerd/containerd/v2/plugins/metadata.init.1.func1(...)
	plugins/metadata/plugin.go:199 +0x7e8
github.com/containerd/containerd/v2/cmd/containerd/server.New(...)
	cmd/containerd/server/server.go:190 +0xb0c

Environment

• Docker Desktop: 4.98.0 (auto-updated; previously the release with Engine 28.4.0 / containerd 1.7.27)
• macOS 27.2 (26B123), Apple M3 Max (arm64)

Workaround

None that keeps existing data, short of downgrading. Purging data or resetting to factory defaults should avoid the crash, because it removes the old meta.db.

Platform

macOS

Version information

Version:           29.9.2
 API version:       1.56
 Go version:        go1.26.10
 Git commit:        a82e528
 Built:             Tue Oct 20 18:43:59 2026
 OS/Arch:           darwin/arm64
 Context:           desktop-linux
Error response from daemon: Docker Desktop is unable to start

Diagnostics ID

120A5ACE-EFB4-4383-AD49-4E78E546AF6D/20261109132856