How to Fix "docker response from daemon: permission denied while trying to connect"

The "permission denied while trying to connect to the Docker daemon socket" error occurs when a non-root user attempts to execute Docker commands without appropriate Unix group permissions. Docker binds its daemon to a Unix socket owned by the root user, blocking unprivileged users from communicating with the service. Resolving this requires granting your user account access to the docker group or re-evaluating your daemon socket privileges.

The Problem

When running any Docker CLI command like docker ps or docker run hello-world as a standard user, the execution immediately fails with a socket permission error. Your console displays output similar to this:

docker: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Post "http://%2Fvar%2Frun%2Fdocker.sock/v1.24/containers/create": dial unix /var/run/docker.sock: connect: permission denied.
See 'docker run --help'.

Alternatively, if you run Docker tools or scripts in automated pipelines, you might encounter variants of this message:

permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock

dial unix /var/run/docker.sock: connect: permission denied

Why It Happens

By default, the Docker daemon (dockerd) runs with root privileges and listens on a Unix domain socket located at /var/run/docker.sock. The security architecture of Docker relies on this socket file to authenticate clients. Here is why the error occurs:

• File Ownership: The socket file /var/run/docker.sock is owned by root:docker with 0660 permissions (read/write only for owner and group).
• Missing Group Membership: Your non-root Linux user account is not currently a member of the docker system group.
• Session Cache: You were recently added to the docker group, but your active shell session has not reloaded your group membership.
• Rootless Docker Misconfiguration: You are attempting to run Docker in rootless mode, but the client is still trying to talk to the system-wide root socket.

The Fix

To fix this permanently, grant your Linux user permission to access the Docker Unix socket by adding your account to the docker group.

Step 1: Create the docker group

On most standard Linux distributions, installing Docker automatically creates the group. However, run this command to ensure it exists:

sudo groupadd docker

Step 2: Add your current user to the docker group

Use usermod with the -aG flags (append to supplemental groups) to add your user account:

sudo usermod -aG docker $USER

Step 3: Refresh group membership in your active session

Group membership changes do not apply to existing shell sessions automatically. Either log out and log back into your server, or re-evaluate your current shell session without logging out by running:

newgrp docker

Step 4: Verify permissions

Verify that your user now belongs to the docker group by inspecting your group list:

groups

Now test running a Docker command without prepending sudo:

docker run hello-world

If configured correctly, the container pulls and executes without throwing a permission denied exception on unix:///var/run/docker.sock.

Still Not Working?

If you still encounter dial unix /var/run/docker.sock: connect: permission denied after adding your user to the group, check the ownership and permissions of the physical socket file directly:

ls -la /var/run/docker.sock

If the file ownership has been corrupted (for instance, showing root:root instead of root:docker), reset the ownership manually with chown:

sudo chown root:docker /var/run/docker.sock
sudo chmod 660 /var/run/docker.sock

Additionally, check if Docker Desktop or Rootless Docker is active. If you intend to run Rootless Docker, ensure your environment variable points to the user-level socket rather than the system socket:

export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/docker.sock