Docker: permission denied while trying to connect to the Docker daemon socket

Docker is installed and running, but every command without sudo stops with a permission error on /var/run/docker.sock. Your user simply isn’t allowed to talk to the Docker daemon yet.

What the error means

The docker command is only a client. It sends every request to the Docker daemon through a Unix socket, normally /var/run/docker.sock. On Linux that socket belongs to root and the docker group:

$ ls -l /var/run/docker.sock
srw-rw---- 1 root docker 0 Nov  4 09:12 /var/run/docker.sock

The rw-rw---- part means only root and members of the docker group may connect (how to read permission strings). If your user is in neither, you get:

permission denied while trying to connect to the Docker daemon socket at
unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.47/containers/json":
dial unix /var/run/docker.sock: connect: permission denied

A different message, Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?, means the daemon isn’t running at all: start it with sudo systemctl start docker (and enable it to start at boot).

The fix, step by step

sudo groupadd docker          # usually exists already; harmless if it does
sudo usermod -aG docker $USER # -a matters: without it you lose your other groups
newgrp docker                 # or log out and back in
id -nG                        # "docker" should now be in the list
docker run --rm hello-world

The most common reason it “still doesn’t work”: group changes only apply to new login sessions. An open terminal, a tmux session, an SSH connection or a VS Code remote server started before the change keeps the old groups. Close them all (for VS Code remote, kill the server) or reboot.

Why not chmod 666 or sudo everything?

• chmod 666 /var/run/docker.sock lets every user and every compromised process on the machine control Docker, which means mounting / into a container and becoming root. It also resets when Docker restarts, so it fixes nothing for long.
• The docker group is root-equivalent too. Only add people you would trust with sudo.
• sudo docker works, but files created in bind mounts end up owned by root and your ~/.docker/config.json logins are ignored.

Safer: rootless Docker or Podman

Rootless mode runs a daemon as your own user, with its socket at $XDG_RUNTIME_DIR/docker.sock, so a container escape only reaches your account. Install the docker-ce-rootless-extras package and run dockerd-rootless-setuptool.sh install, then point the client at it with docker context use rootless. Podman is daemonless and rootless by default and accepts most docker commands.

Special cases

Comparing group IDs between the host and a container? Run getent group docker on the host and id inside the container: the numbers must match.

Docker filling your disk? See docker system prune explained.

Git inside a container complaining about dubious ownership? See git dubious ownership. No sudo rights to add yourself to the docker group? See user is not in the sudoers file.

Questions

Published 4 November 2026.