Fix "permission denied while trying to connect to the Docker daemon socket"

sudo usermod -aG docker $USER
# log out and back in (or reboot), then:
docker run --rm hello-world

The full message usually looks like this:

permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.47/containers/json": dial unix /var/run/docker.sock: connect: permission denied

Older clients prefix it with "Got", and newer Docker CLI releases word it as "permission denied while trying to connect to the docker API at unix:///var/run/docker.sock". The API version in the URL varies. All mean the same thing.

What the error means

The docker command is only a client. It talks to the Docker daemon (dockerd, running as root) through the Unix socket /var/run/docker.sock. That socket is owned by root and the docker group with mode 660:

ls -l /var/run/docker.sock

Example output:

srw-rw---- 1 root docker 0 Oct 16 08:02 /var/run/docker.sock

If your user is neither root nor in the docker group, connecting fails with "permission denied". The daemon is running fine; you are just not allowed to talk to it. (If the daemon were not running, you would see "Cannot connect to the Docker daemon... Is the docker daemon running?" instead; see cause 4.)

Cause 1: your user is not in the docker group

The official Docker packages and distro packages create the docker group but do not add anyone to it. Check and fix:

id -nG                          # your current groups
getent group docker             # does the group exist, who is in it?
sudo groupadd -f docker         # create it if missing
sudo usermod -aG docker $USER

The -a is essential: without it, usermod -G removes you from every other group, including sudo or wheel. If your sudo access is already gone, see user is not in the sudoers file.

Cause 2: you have not started a new session

Groups are assigned at login. After usermod, your existing terminals, desktop session and SSH connections still have the old group list. That is why the error persists right after "fixing" it.

• Log out of the desktop completely and back in, or reboot. Closing the terminal window is not enough.
• For SSH, disconnect and reconnect.
• For just the current terminal, newgrp docker starts a subshell with the group active.

Verify with id -nG (no username, which shows the groups of your current session) and look for docker.

Cause 3: a stale ~/.docker directory owned by root

If you previously ran sudo docker ..., the client config directory can end up owned by root. You then see a related warning about ~/.docker/config.json. Fix the ownership:

sudo chown -R "$USER":"$USER" ~/.docker

Cause 4: the daemon is not running, or you are talking to another socket

systemctl status docker
sudo systemctl enable --now docker
docker context ls
echo "$DOCKER_HOST"

Docker Desktop for Linux uses its own context (desktop-linux) and a socket under your home directory; if you have both Docker Desktop and Docker Engine installed, switch with docker context use default or docker context use desktop-linux. A leftover DOCKER_HOST pointing at a rootless or remote socket causes similar errors.

The Snap package of Docker on Ubuntu behaves differently with groups and paths; if you installed it via Snap, the Docker Engine packages from Docker's APT repository are the better-supported choice. See installing Docker on Linux.

Alternative: rootless Docker or Podman

Rootless mode runs the daemon as your own user, with its own socket under $XDG_RUNTIME_DIR, so no docker group or root access is involved:

# Ubuntu / Debian (Docker's repo): install the extras, then set up
sudo apt install docker-ce-rootless-extras uidmap
dockerd-rootless-setuptool.sh install
systemctl --user enable --now docker
docker context use rootless

Rootless has limitations (binding ports below 1024 needs extra configuration, some storage and networking features differ). Details are in the official rootless documentation.

On Fedora, Podman is preinstalled and runs rootless by default with a Docker-compatible CLI (podman run ...). The podman-docker package provides a docker command that calls Podman.

What not to do

• Do not chmod 666 /var/run/docker.sock (or 777). It gives every local user and every compromised process root on the machine, and it is reset the next time Docker starts anyway.
• Do not run your editor or IDE as root to make the Docker extension work; fix the group membership instead.
• Do not alias docker to sudo docker for daily use: files created through bind mounts then end up owned by root in your project directories.

Distro notes

• Ubuntu, Debian, Mint: install docker-ce from Docker's repository (or docker.io from the distro); both create the docker group. Ubuntu 26.04 uses a keyring with signed-by for Docker's repository, since apt-key is gone.
• Fedora: moby-engine (Fedora) or docker-ce (Docker's repo); start it with sudo systemctl enable --now docker. SELinux stays enabled; use :Z on bind mounts if containers cannot read them.
• Arch: sudo pacman -S docker, then enable the service and add the group as above.
• openSUSE: sudo zypper install docker, enable the service, add the group.

Once it works, the Docker commands cheat sheet covers everyday usage, and user management explains groups in detail.

Frequently asked questions