diff --git a/daemon/libnetwork/drivers/overlay/encryption.go b/daemon/libnetwork/drivers/overlay/encryption.go
index 67bf2d4bad..51bee928cb 100644
--- a/daemon/libnetwork/drivers/overlay/encryption.go
+++ b/daemon/libnetwork/drivers/overlay/encryption.go
@@ -407,7 +407,7 @@ func (d *driver) restoreNetworkEncryptionFirewall(ctx context.Context, nid strin
 	}
 
 	for _, s := range n.subnets {
-		if !s.sboxInit {
+		if !s.initDone {
 			continue
 		}
 		// Unlike programOverlayEncryptionFirewall, do not roll back the
diff --git a/daemon/libnetwork/drivers/overlay/encryption_linux_test.go b/daemon/libnetwork/drivers/overlay/encryption_linux_test.go
index 6b10e55534..828089dc99 100644
--- a/daemon/libnetwork/drivers/overlay/encryption_linux_test.go
+++ b/daemon/libnetwork/drivers/overlay/encryption_linux_test.go
@@ -148,7 +148,7 @@ func TestProgramMangleLifecycle(t *testing.T) {
 	const vniA, vniB = 4096, 4097
 
 	// First encrypted network on the node: the marking rule is programmed
-	// when the subnet sandbox is set up, ...
+	// when the subnet is set up in the network sandbox, ...
 	assert.NilError(t, d.programMangle(vniA, true))
 	// ... and the mark-stripping rule when the first peer is discovered.
 	assert.NilError(t, d.programMangleMarkSpoofProtection(true))
@@ -201,15 +201,15 @@ func TestRestoreIptablesEncryptionRulesOnFirewalldReload(t *testing.T) {
 	skip.If(t, nftables.Enabled(), "test is for the iptables backend")
 	defer netnsutils.SetupTestOSContext(t)()
 
-	const encVNI, clearVNI, noSboxVNI = 4097, 4098, 4099
+	const encVNI, clearVNI, notSetUpVNI = 4097, 4098, 4099
 	d := newDriver(t.TempDir())
 	d.advertiseAddress = netip.MustParseAddr("192.0.2.1")
 	d.networks["enc"] = &network{id: "enc", driver: d, secure: true, subnets: []*subnet{
-		{vni: encVNI, sboxInit: true},
-		// A subnet whose sandbox has not been set up.
-		{vni: noSboxVNI},
+		{vni: encVNI, initDone: true},
+		// A subnet which has not been set up.
+		{vni: notSetUpVNI},
 	}}
-	d.networks["clear"] = &network{id: "clear", driver: d, subnets: []*subnet{{vni: clearVNI, sboxInit: true}}}
+	d.networks["clear"] = &network{id: "clear", driver: d, subnets: []*subnet{{vni: clearVNI, initDone: true}}}
 
 	ipt := iptables.GetIptable(iptables.IPv4)
 	type ruleset struct{ MangleOutput, FilterInput []string }
@@ -227,8 +227,8 @@ func TestRestoreIptablesEncryptionRulesOnFirewalldReload(t *testing.T) {
 	}
 	noRules := dump()
 
-	// Install the rules as initSubnetSandbox does for the subnet of the
-	// secure network with a sandbox.
+	// Install the rules as initSubnet does for the subnet of the
+	// secure network which has been set up.
 	// Install and remove the rules for the other network's VNI, as for a
 	// deleted secure network whose VNI was reassigned.
 	ctx := t.Context()
diff --git a/daemon/libnetwork/drivers/overlay/ov_network.go b/daemon/libnetwork/drivers/overlay/ov_network.go
index 2fed1bdedc..39ffcff187 100644
--- a/daemon/libnetwork/drivers/overlay/ov_network.go
+++ b/daemon/libnetwork/drivers/overlay/ov_network.go
@@ -30,7 +30,7 @@ import (
 type networkTable map[string]*network
 
 type subnet struct {
-	sboxInit  bool
+	initDone  bool
 	vxlanName string
 	brName    string
 	vni       uint32
@@ -254,16 +254,16 @@ func (n *network) joinSandbox(s *subnet, incJoinCount bool) error {
 	}
 
 	subnetErr := s.initErr
-	if !s.sboxInit {
-		subnetErr = n.initSubnetSandbox(s)
+	if !s.initDone {
+		subnetErr = n.initSubnet(s)
 		// We can recover from these errors
 		if subnetErr == nil {
 			s.initErr = subnetErr
-			s.sboxInit = true
+			s.initDone = true
 		}
 	}
 	if subnetErr != nil {
-		return fmt.Errorf("subnet sandbox join failed for %q: %v", s.subnetIP.String(), subnetErr)
+		return fmt.Errorf("network sandbox join failed for subnet %q: %v", s.subnetIP.String(), subnetErr)
 	}
 
 	if incJoinCount {
@@ -293,7 +293,7 @@ func (n *network) leaveSandbox() {
 	n.sboxInit = false
 	n.initErr = nil
 	for _, s := range n.subnets {
-		s.sboxInit = false
+		s.initDone = false
 		s.initErr = nil
 	}
 }
@@ -376,7 +376,7 @@ func (n *network) getBridgeNamePrefix(s *subnet) string {
 	return fmt.Sprintf("ov-%06x", s.vni)
 }
 
-func (n *network) setupSubnetSandbox(s *subnet, brName, vxlanName string) error {
+func (n *network) setupSubnet(s *subnet, brName, vxlanName string) error {
 	// create a bridge and vxlan device for this subnet and move it to the sandbox
 	sbox := n.sbox
 
@@ -472,7 +472,7 @@ func setDefaultVLAN(ns *osl.Namespace) error {
 }
 
 // Must be called with the network lock
-func (n *network) initSubnetSandbox(s *subnet) error {
+func (n *network) initSubnet(s *subnet) error {
 	brName := n.generateBridgeName(s)
 	vxlanName := n.generateVxlanName(s)
 
@@ -483,7 +483,7 @@ func (n *network) initSubnetSandbox(s *subnet) error {
 		return err
 	}
 
-	if err := n.setupSubnetSandbox(s, brName, vxlanName); err != nil {
+	if err := n.setupSubnet(s, brName, vxlanName); err != nil {
 		return err
 	}
 
diff --git a/daemon/libnetwork/drivers/overlay/ov_network_test.go b/daemon/libnetwork/drivers/overlay/ov_network_test.go
index 173c1051b0..d55ac4d9cc 100644
--- a/daemon/libnetwork/drivers/overlay/ov_network_test.go
+++ b/daemon/libnetwork/drivers/overlay/ov_network_test.go
@@ -78,7 +78,7 @@ func withSandbox(t *testing.T, n *network, key string) {
 	n.sbox = sbox
 	n.sboxInit = true
 	n.subnets = []*subnet{{
-		sboxInit:  true,
+		initDone:  true,
 		vxlanName: "vx-absent",
 		subnetIP:  netip.MustParsePrefix("10.0.0.0/24"),
 	}}
diff --git a/daemon/libnetwork/drivers/overlay/peerdb.go b/daemon/libnetwork/drivers/overlay/peerdb.go
index 5c0ede737c..d858db6fcd 100644
--- a/daemon/libnetwork/drivers/overlay/peerdb.go
+++ b/daemon/libnetwork/drivers/overlay/peerdb.go
@@ -152,7 +152,7 @@ func (n *network) addNeighbor(peerIP netip.Prefix, peerMac hashable.MACAddr, vte
 	}
 
 	if err := n.joinSandbox(s, false); err != nil {
-		return fmt.Errorf("subnet sandbox join failed for %q: %v", s.subnetIP.String(), err)
+		return fmt.Errorf("network sandbox join failed for subnet %q: %v", s.subnetIP.String(), err)
 	}
 
 	if n.secure {