code: func (ds *dockerService) getIP(podSandboxID string, sandbox *dockertypes.ContainerJSON) string {
  	if sandbox.NetworkSettings == nil {
  		return ""
  	}
  	if networkNamespaceMode(sandbox) == runtimeapi.NamespaceMode_NODE {
  		// For sandboxes using host network, the shim is not responsible for
  		// reporting the IP.
  		return ""
  	}
  
  	// Don't bother getting IP if the pod is known and networking isn't ready
  	ready, ok := ds.getNetworkReady(podSandboxID)
  	if ok && !ready {
  		return ""
  	}
  
  	ip, err := ds.getIPFromPlugin(sandbox)
  	if err == nil {
  		return ip
  	}
  
  	// TODO: trusting the docker ip is not a great idea. However docker uses
  	// eth0 by default and so does CNI, so if we find a docker IP here, we
  	// conclude that the plugin must have failed setup, or forgotten its ip.
  	// This is not a sensible assumption for plugins across the board, but if
  	// a plugin doesn't want this behavior, it can throw an error.
  	if sandbox.NetworkSettings.IPAddress != "" {
  		return sandbox.NetworkSettings.IPAddress
  	}
  	if sandbox.NetworkSettings.GlobalIPv6Address != "" {
  		return sandbox.NetworkSettings.GlobalIPv6Address
  	}
  
  	// If all else fails, warn but don't return an error, as pod status
  	// should generally not return anything except fatal errors
  	// FIXME: handle network errors by restarting the pod somehow?
  	klog.Warningf("failed to read pod IP from plugin/docker: %v", err)
  	return ""
  }
docs: // getIP returns the ip given the output of `docker inspect` on a pod sandbox,
  // first interrogating any registered plugins, then simply trusting the ip
  // in the sandbox itself. We look for an ipv4 address before ipv6.