The error, verbatim
Jump to the fix ↓permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.48/containers/json": dial unix /var/run/docker.sock: connect: permission denied
Tested on
- Docker
- Engine 28.0.4
- OS
- Ubuntu 24.04.5 LTS (GitHub Actions runner)
✓ Last re-run on GitHub Actions · see the run · all repros
Contents
The usual fix, adding yourself to the docker group, works, but not in the terminal you ran it from. In my test on Ubuntu 24.04, a shell opened before usermod -aG docker still had only its old groups and still got permission denied, while a new login listed docker and docker ps worked. The socket, /var/run/docker.sock, belongs to root and the docker group on a standard install:
srw-rw---- 1 root docker 0 Oct 20 04:27 /var/run/docker.sockAnyone else gets this error. I created a fresh user on Ubuntu 24.04, and id showed why: groups=1002(dev), no docker in the list.
There’s a different error that people often mix up with this one. With the daemon stopped, the message was Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?. That one isn’t about permissions; it has its own section below.
The fix, and why it seems not to work
Add your user to the docker group:
sudo usermod -aG docker $USERThen start a new login session: log out and back in, or close the SSH connection and reconnect. Until you do, your current shell keeps the groups it started with.
The second step is where most people get stuck. I opened a shell as the user, added the group from another terminal, and then tried again in the first one. It still printed old shell groups: dev and the same permission error, even though the group change had worked.
To use the new group without logging out, start a shell that picks it up:
newgrp dockernewgrp only affects the shell it opens. Other open terminals, your editor and anything else started before the change still need a new login.
The chmod 666 shortcut
Plenty of answers suggest opening up the socket instead:
sudo chmod 666 /var/run/docker.sockIt works, for every user on the machine, which is the problem: it gives anyone with a login the same root-level access as the docker group. It also doesn’t last the way people expect. In my test:
| After | Socket permissions | Non-group user |
|---|---|---|
chmod 666 |
srw-rw-rw- |
docker ps worked |
systemctl restart docker |
still srw-rw-rw- |
still worked |
systemctl restart docker.socket docker |
back to srw-rw---- |
permission denied again |
Restarting Docker alone kept the change, so it looks permanent. The socket is created by docker.socket, though, and when that restarted, the permissions went back. The group fix is the one that lasts.
Cannot connect to the Docker daemon
This message means the client found nothing to talk to. I got it in three ways:
| What was wrong | Message |
|---|---|
Docker stopped (systemctl stop docker.socket docker) |
Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running? |
DOCKER_HOST pointing at a socket that doesn’t exist |
Cannot connect to the Docker daemon at unix:///tmp/nope.sock. Is the docker daemon running? |
DOCKER_HOST=tcp://localhost:2375 with nothing listening |
Cannot connect to the Docker daemon at tcp://localhost:2375. Is the docker daemon running? |
Read the address in the message first. If it isn’t unix:///var/run/docker.sock, something set DOCKER_HOST or a Docker context. Check both:
echo $DOCKER_HOST
docker context lsIf it is the normal socket, start Docker:
sudo systemctl start dockerThe Docker Desktop and WSL versions of this error weren’t part of this test.
How this was tested
Ubuntu 24.04.5 on a GitHub Actions runner, Docker Engine 28.0.4, October 20, 2026. A new user without the docker group ran docker ps before and after joining the group, from an old shell and a new one, with the socket at chmod 666 through two kinds of restart, with the daemon stopped and with DOCKER_HOST pointing elsewhere. Every message above is the real output, from the test script.
— N.K., end of entry No.081