Docker socket permission denied: the real fix
⏱️ 2 min read
Why it happens
/var/run/docker.sock is owned by root:docker. Your user is not in the docker group, so the kernel refuses the open. The socket is the Docker daemon itself, so this permission is root-equivalent access.
The correct fix
sudo usermod -aG docker $USER # log out and back in (or: newgrp docker) docker ps
Group membership applies at login. If docker ps works after newgrp docker but not in your normal shell, you skipped the re-login.
Why not chmod 666
Making the socket world-writable gives every local user and every container-mounted process full root on the host. It is the classic "it works now" that quietly removes a wall. If you need rootless Docker, install rootless mode properly (dockerd-rootless-setuptool.sh) instead.
In containers (CI runners)
CI images that mount the socket face the same issue: the container user must be in the group that owns the socket, with a matching gid. In GitHub Actions runners, the runner user usually already has it; locally, match the gid:
ls -ln /var/run/docker.sock # addgroup with that gid, add user to it
And if the goal is a sandbox to experiment with Docker-in-Docker without nuking your host groups, a disposable hourly VM is the clean lab: spin one on Vultr, break it, delete it. (Partner link.)