# Docker: Permission Denied While Connecting to the Docker Daemon Socket

```text
permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock
```

The Docker CLI talks to the Docker daemon through a Unix socket, `/var/run/docker.sock`. On Linux that socket belongs to root and the `docker` group:

```bash
$ ls -l /var/run/docker.sock
srw-rw---- 1 root docker 0 Oct 15 09:12 /var/run/docker.sock
```

`srw-rw----` is mode [660](/chmod/660): read and write for the owner and the group, nothing for anyone else. If your user isn't in the `docker` group, the CLI can't connect.

## The standard fix

Add yourself to the group:

```bash
sudo usermod -aG docker $USER
```

Then **log out and back in** — group membership is read when you log in, so the change doesn't reach existing shells. To use it in the current shell straight away, run `newgrp docker`. Check with:

```bash
groups            # should list docker
docker run --rm hello-world
```

If `usermod` complains that the group doesn't exist, create it first with `sudo groupadd docker`, then restart Docker so the socket picks up the group.

## Know what that grants

Membership of the `docker` group is effectively root access: anyone in it can start a container that mounts the host's root filesystem and edit anything. That's fine on your own development machine; think twice on shared servers.

Alternatives when that's too much:

- **Use `sudo docker …`** for occasional commands.
- **Rootless Docker** runs the daemon as your user, so the socket is yours: `dockerd-rootless-setuptool.sh install`.
- **Podman** runs containers without a root daemon, with a largely Docker-compatible CLI.

## Don't chmod 666 the socket

A common answer online is `sudo chmod 666 /var/run/docker.sock`. It makes the error go away by letting **every user and process on the machine** control Docker — which means giving every one of them root. It also resets when the daemon restarts, so it doesn't even stick. Use the group instead.

## A different error: is the daemon running?

```text
Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
```

This one isn't about permissions — nothing is listening. Start it:

```bash
sudo systemctl start docker
sudo systemctl enable docker   # start on boot
```

On macOS and Windows, start Docker Desktop. If you use a remote or rootless daemon, check that `DOCKER_HOST` or the current `docker context` points where you expect.

## Inside CI and containers

Jobs that mount the host socket into a container (Jenkins agents, Docker-in-Docker setups) hit the same error when the container's user isn't in a group with the socket's group ID. Add the socket's GID to the container:

```bash
docker run --group-add "$(stat -c %g /var/run/docker.sock)" \
  -v /var/run/docker.sock:/var/run/docker.sock my-ci-image
```

For what each permission digit means, try the [chmod calculator](/chmod).