ConfigClarity

Free browser-based DevOps audit tools — no signup, nothing leaves your browser

Home › Errors › Permission denied docker.sock

permission denied: /var/run/docker.sock

Got permission denied while trying to connect to the Docker daemon

❌ The error 
Got permission denied while trying to connect to the Docker daemon socket
at unix:///var/run/docker.sock: dial unix /var/run/docker.sock:
connect: permission denied

Fix 1 — Add your user to the docker group (recommended)

✅ One-time setup 
# Add current user to docker group
sudo usermod -aG docker $USER

# Apply group change (or log out and back in)
newgrp docker

# Verify it worked
docker ps
Security note: The docker group grants effective root access on the host. Only add trusted users. Consider rootless Docker for multi-user environments.

Fix 2 — Rootless Docker (more secure)

Run Docker without root privileges. Each user runs their own Docker daemon.

# Install rootless Docker
dockerd-rootless-setuptool.sh install

# Add to your shell profile
export PATH=/usr/bin:$PATH
export DOCKER_HOST=unix:///run/user/1000/docker.sock

Fix 3 — Use sudo (not recommended for daily use)

sudo docker ps
sudo docker compose up -d

Audit your Docker Compose file

Check for hardcoded secrets, missing healthchecks, port collisions and insecure 0.0.0.0 bindings before deploying.

Open Docker Auditor →

Frequently Asked Questions

Why do I need to log out after adding myself to the docker group?

Group membership is read at login. Your current shell session still has the old group list. Run newgrp docker to apply the change in the current session without logging out, or open a new terminal.

Is adding a user to the docker group a security risk?

Yes. A user in the docker group can mount the host filesystem into a container and escape to root. Only add users you fully trust. In production, prefer rootless Docker or sudo with specific command allowlists.

Why does docker.sock show up in some compose files?

Some containers (Portainer, Traefik, Watchtower) need to communicate with the Docker daemon to manage other containers. They mount /var/run/docker.sock:/var/run/docker.sock. This is a significant privilege — only use trusted images.