diff --git a/src/runtime/virtcontainers/sandbox.go b/src/runtime/virtcontainers/sandbox.go
index 0348dc783c..77078c86fc 100644
--- a/src/runtime/virtcontainers/sandbox.go
+++ b/src/runtime/virtcontainers/sandbox.go
@@ -1008,6 +1008,12 @@ func (s *Sandbox) startVM(ctx context.Context) (err error) {
 		s.cw = consoleWatcher
 	}
 
+	defer func() {
+		if err != nil {
+			s.hypervisor.stopSandbox(ctx, false)
+		}
+	}()
+
 	if err := s.network.Run(ctx, s.networkNS.NetNsPath, func() error {
 		if s.factory != nil {
 			vm, err := s.factory.GetVM(ctx, VMConfig{
@@ -1027,12 +1033,6 @@ func (s *Sandbox) startVM(ctx context.Context) (err error) {
 		return err
 	}
 
-	defer func() {
-		if err != nil {
-			s.hypervisor.stopSandbox(ctx, false)
-		}
-	}()
-
 	// In case of vm factory, network interfaces are hotplugged
 	// after vm is started.
 	if s.factory != nil {