diff --git a/virtcontainers/api.go b/virtcontainers/api.go
index f54214c925..fbaf67ad48 100644
--- a/virtcontainers/api.go
+++ b/virtcontainers/api.go
@@ -76,13 +76,6 @@ func createSandboxFromConfig(ctx context.Context, sandboxConfig SandboxConfig, f
 		return nil, err
 	}
 
-	// Move runtime to sandbox cgroup so all process are created there.
-	if s.config.SandboxCgroupOnly {
-		if err := s.setupSandboxCgroup(); err != nil {
-			return nil, err
-		}
-	}
-
 	// cleanup sandbox resources in case of any failure
 	defer func() {
 		if err != nil {
@@ -102,6 +95,13 @@ func createSandboxFromConfig(ctx context.Context, sandboxConfig SandboxConfig, f
 		}
 	}()
 
+	// Move runtime to sandbox cgroup so all process are created there.
+	if s.config.SandboxCgroupOnly {
+		if err := s.setupSandboxCgroup(); err != nil {
+			return nil, err
+		}
+	}
+
 	// Start the VM
 	if err = s.startVM(); err != nil {
 		return nil, err