devkult_
tools29converters34
home/blog/docker-permission-denied-socket
dockerlinuxpermissions

Docker: Permission Denied While Connecting to the Docker Daemon Socket

permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock

The Docker CLI talks to the Docker daemon through a Unix socket, /var/run/docker.sock. On Linux that socket belongs to root and the docker group:

$ ls -l /var/run/docker.sock
srw-rw---- 1 root docker 0 Oct 15 09:12 /var/run/docker.sock

srw-rw---- is mode 660: read and write for the owner and the group, nothing for anyone else. If your user isn't in the docker group, the CLI can't connect.

The standard fix

Add yourself to the group:

sudo usermod -aG docker $USER

Then log out and back in — group membership is read when you log in, so the change doesn't reach existing shells. To use it in the current shell straight away, run newgrp docker. Check with:

groups            # should list docker
docker run --rm hello-world

If usermod complains that the group doesn't exist, create it first with sudo groupadd docker, then restart Docker so the socket picks up the group.

Know what that grants

Membership of the docker group is effectively root access: anyone in it can start a container that mounts the host's root filesystem and edit anything. That's fine on your own development machine; think twice on shared servers.

Alternatives when that's too much:

  • Use sudo docker … for occasional commands.
  • Rootless Docker runs the daemon as your user, so the socket is yours: dockerd-rootless-setuptool.sh install.
  • Podman runs containers without a root daemon, with a largely Docker-compatible CLI.

Don't chmod 666 the socket

A common answer online is sudo chmod 666 /var/run/docker.sock. It makes the error go away by letting every user and process on the machine control Docker — which means giving every one of them root. It also resets when the daemon restarts, so it doesn't even stick. Use the group instead.

A different error: is the daemon running?

Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

This one isn't about permissions — nothing is listening. Start it:

sudo systemctl start docker
sudo systemctl enable docker   # start on boot

On macOS and Windows, start Docker Desktop. If you use a remote or rootless daemon, check that DOCKER_HOST or the current docker context points where you expect.

Inside CI and containers

Jobs that mount the host socket into a container (Jenkins agents, Docker-in-Docker setups) hit the same error when the container's user isn't in a group with the socket's group ID. Add the socket's GID to the container:

docker run --group-add "$(stat -c %g /var/run/docker.sock)" \
  -v /var/run/docker.sock:/var/run/docker.sock my-ci-image

For what each permission digit means, try the chmod calculator.

More from the blog