Fix Docker Permission Denied on /var/run/docker.sock

Quick Answer

• Conclusion: The "permission denied" error when connecting to the Docker daemon occurs because your user lacks access to the /var/run/docker.sock socket file. The standard fix is to add your user to the docker group.
• First checks: Run ls -l /var/run/docker.sock to verify the socket exists and belongs to the docker group. Run groups $USER to check if your user is already in the docker group.
• Minimal fix: Execute sudo usermod -aG docker $USER, then log out and log back in (or run newgrp docker in the current shell). After this, docker ps should work without sudo.
• Environment boundary: This fix applies to Linux systems running Docker Engine with the default socket location. It does not apply to Docker rootless mode, Kubernetes, or container orchestration platforms.

What Problem It Solves

When you install Docker on Linux, the Docker daemon listens on a Unix socket at /var/run/docker.sock. By default, this socket is owned by the root user and the docker group, with permissions srw-rw---- (socket read-write for owner and group only). Non-root users who are not in the docker group receive the error:

Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock

This error blocks developers and CI/CD tools from running Docker commands without sudo.

Root Cause Analysis

The Docker daemon (dockerd) creates the socket file at startup with specific ownership and permissions. The socket's group is set to docker, and only members of that group can read from and write to it. When a user not in the docker group attempts to communicate with the daemon, the kernel denies the socket connection.

The error message is unambiguous: the user lacks the necessary Unix file permissions to access the socket. This is not a Docker configuration issue but a standard Linux permission control mechanism.

Minimal Working Configuration

The standard solution has two steps:

1. Add your user to the docker group:

   BASH
   sudo usermod -aG docker $USER
   

2. Activate the group change:

   • Log out of your session and log back in, OR
   • Run newgrp docker in the current terminal (temporary, for that shell only)

After activation, verify the fix:

BASH
docker ps

If you still see permission errors, check the socket permissions:

BASH
ls -l /var/run/docker.sock

Expected output: srw-rw---- 1 root docker .... If the group is not docker or permissions are wrong, restart the Docker daemon:

BASH
sudo systemctl restart docker

Common Errors and Fixes

Production Notes and Security Checks

Adding a user to the docker group is not recommended for production servers. Here's why:

• Equivalent to root access: The docker group can execute any Docker command, including mounting host filesystems into containers. A compromised user in the docker group can gain full root access to the host.
• No audit trail: Commands run via the Docker socket bypass sudo logging.

Production alternatives to consider:

• Use Docker rootless mode (Docker 19.03+): Run the daemon as a non-root user. The socket is placed at ~/.docker/run/docker.sock. Install docker-ce-rootless-extras and run dockerd-rootless-setuptool.sh install. Set DOCKER_HOST=unix://$XDG_RUNTIME_DIR/docker.sock.
• Use sudo with restricted rules: Configure /etc/sudoers to allow specific Docker commands without password.
• Use Podman: A daemonless container engine that does not require a root-owned socket.
• Use Docker-in-Docker (DinD): Run a separate Docker daemon inside a container for CI/CD pipelines, providing better isolation.

FAQ

Q: After adding my user to the docker group, do I still need sudo to run docker commands?

A: No. Once your user is in the docker group, you can run docker commands directly without sudo. However, be aware that this grants the user effective root privileges over the host system through Docker's API.

Q: In Docker 19.03+ rootless mode, how do I fix the /var/run/docker.sock permission issue?

A: In rootless mode, the socket is at ~/.docker/run/docker.sock, not /var/run/docker.sock. Install docker-ce-rootless-extras, run dockerd-rootless-setuptool.sh install, and set DOCKER_HOST=unix://$XDG_RUNTIME_DIR/docker.sock. The socket permissions are managed automatically for the non-root user.

Q: When mounting /var/run/docker.sock inside a container, how do I avoid permission problems?

A: The container user may not match the host's docker group GID. Solutions include: 1) Use --group-add with the host's docker group GID (often 999 or 1000) in docker run; 2) Create a socket copy with adjusted permissions on the host; 3) Use Docker-in-Docker (DinD) for better isolation. DinD is recommended for CI/CD pipelines.