How to Fix 'Permission Denied' on /var/run/docker.sock Without Sudo
The error permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock occurs when you attempt to run Docker commands without sudo and your current Linux user account does not belong to the group authorized to access the Docker UNIX socket.
The error permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock occurs when you attempt to run Docker commands without sudo and your current Linux user account does not belong to the group authorized to access the Docker UNIX socket.
Quick Diagnostics
unix:///var/run/docker.sock): Current Linux user is not a member of the docker system groupdocker group with usermod and refresh sessionStep-by-Step Solution
-
1
Step 1: Create the Docker Group and Add Your User
Check if the
dockergroup exists on your system and add your current user usingusermod:BASH# Create docker group if it doesn't already exist sudo groupadd docker # Add your active user ($USER) to the docker group sudo usermod -aG docker $USER -
2
Step 2: Apply Group Membership Changes to Current Session
For group changes to take effect immediately without rebooting or logging out entirely, execute:
BASHnewgrp dockerAlternatively, if connected via SSH or a desktop terminal, log out of your session and log back in.
-
3
Step 3: Verify /var/run/docker.sock Ownership and Test
Ensure that
/var/run/docker.sockis owned by thedockergroup:BASHls -l /var/run/docker.sock(Output should indicate ownership such as
root:dockerwithsrw-rw----permissions).Test running a Docker container without
sudo:BASHdocker run hello-world
Prevention Advice
Recommended security practices:
- Avoid using
chmod 777on the socket file: Never grant world-writable permissions to/var/run/docker.sock, as doing so gives unprivileged users full root access to the host system. - Consider Rootless Docker: In high-security environments, evaluate setting up Rootless Docker mode to run the daemon and containers inside a non-root user namespace.
- Configure CI/CD Runner Permissions: Ensure automated build runners (such as GitHub Actions self-hosted runners or GitLab Runners) are assigned to the
dockergroup on the host.