DEV Community

Cover image for Fix: Permission Denied on the Docker Daemon Socket
Shubham Sharma
Shubham Sharma

Posted on Originally published at techdevmantra.com

Fix: Permission Denied on the Docker Daemon Socket

#selfhosting #linux #docker

You ran a normal docker command on Linux and got this instead of output:

permission denied while trying to connect to the docker API at unix:///var/run/docker.sock
Enter fullscreen mode Exit fullscreen mode

On older Docker versions the same problem reads a little differently, but it is the exact same wall:

Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock
Enter fullscreen mode Exit fullscreen mode

Nothing is broken. Docker is running fine. Your user account just is not allowed to talk to it yet. This guide shows you why that happens, the one-line fix that gets you working right now, the permanent fix, and the one "fix" you should never copy from a random forum answer.

Info

Everything below was run on a real Docker Engine (Client 29.8.0 / Server 29.8.0) on Ubuntu 24.04.5 LTS. The commands and output are the genuine results, not illustrations.

Why this happens

Docker does its real work in a background service (the daemon) that runs as root. Your docker command is just a client. It talks to the daemon through a Unix socket, a special file at /var/run/docker.sock. Look at who owns that file:

ls -l /var/run/docker.sock
Enter fullscreen mode Exit fullscreen mode 
srw-rw---- 1 root docker 0 Sep 10 15:41 /var/run/docker.sock
Enter fullscreen mode Exit fullscreen mode

Read that line right to left. The socket is owned by user root and group docker, and its permissions are rw for the owner, rw for the group, and nothing for everyone else. So only root and members of the docker group can read from or write to it. A brand-new user is in neither:

id
Enter fullscreen mode Exit fullscreen mode 
uid=1000(tester) gid=1000(tester) groups=1000(tester)
Enter fullscreen mode Exit fullscreen mode

No docker group in that list, so the connection is refused. That is the whole story. The error is a file-permission error wearing a scary costume.

Fix 1: run it right now with sudo

If you just need the command to work this second, run it as root with sudo:

sudo docker ps
Enter fullscreen mode Exit fullscreen mode 
NAMES     STATUS
Enter fullscreen mode Exit fullscreen mode

The command connects and returns cleanly (an empty table here just means no containers are running). This is fine for a one-off, but typing sudo before every docker command gets old fast, and it means every container you start is being managed as root. For your own machine, set up the permanent fix instead.

Fix 2: add your user to the docker group (the real fix)

Add your user to the docker group once, and you never need sudo for Docker again:

sudo usermod -aG docker $USER
Enter fullscreen mode Exit fullscreen mode

-aG means "append to this group" (the -a matters; without it you would replace all your other groups). Confirm it took:

id
Enter fullscreen mode Exit fullscreen mode 
uid=1000(tester) gid=1000(tester) groups=1000(tester),990(docker)
Enter fullscreen mode Exit fullscreen mode

There is the docker group. But if you try docker ps in the same terminal, you may still get permission denied, and this is the step everyone trips on.

Warning

Group membership is only read when a login session starts. Your current shell was started before you joined the group, so it still has your old group list. You need a fresh session for the change to apply.

Get a fresh session in any one of these ways:

# option A: load the new group into the current shell right now
newgrp docker

# option B: log out and back in (or close and reopen your terminal)

# option C: over SSH, disconnect and reconnect
Enter fullscreen mode Exit fullscreen mode

After that, Docker works as your normal user, no sudo:

docker ps
Enter fullscreen mode Exit fullscreen mode 
NAMES     STATUS
Enter fullscreen mode Exit fullscreen mode

Connected, no permission error, no sudo. That is the fix you want.

The "fix" to avoid

Search this error and you will find answers telling you to just open up the socket:

# do NOT do this
sudo chmod 666 /var/run/docker.sock
Enter fullscreen mode Exit fullscreen mode

It makes the error go away, and it is a genuinely bad idea. 666 lets every user and process on the machine read and write the Docker socket. Anyone who can talk to the Docker daemon can start a container that mounts your entire host filesystem as root, which is effectively handing them root on the box. The docker group already gives your user that same power, so understand what you are joining.

Error

Adding a user to the docker group (or opening the socket) grants root-equivalent access to the whole machine. That is expected and documented, but it means you should only do it for accounts you fully trust. On shared or production servers, prefer rootless Docker or calling Docker through sudo with a controlled sudoers rule.

Quick reference 

# see who owns the socket (root:docker, group-only access)
ls -l /var/run/docker.sock

# right now, one-off
sudo docker ps

# permanent: join the group, then start a fresh session
sudo usermod -aG docker $USER
newgrp docker      # or log out and back in
docker ps          # works, no sudo
Enter fullscreen mode Exit fullscreen mode

That is every legitimate way out of this error. If sudo docker ps also fails, your problem is different: the daemon itself is not running. Start it with sudo systemctl start docker and check sudo systemctl status docker.

New to Docker and want the mental model behind all this? Start with our guide on running your first containers, then work through the Docker Foundations series.

Top comments (0)