Docker Core
The daemon answered, but the current Unix user lacks rights on the socket.
permission-denied-docker-socketReviewed for reference consistency: August 11, 2026
The daemon answered, but the current Unix user lacks rights on the socket.
What permission-denied-docker-socket Means
The permission-denied-docker-socket error on the Docker Core indicates the daemon answered, but the current unix user lacks rights on the socket.. This typically occurs due to the invoking user is not a member of the docker group.
On Linux the daemon listens on /var/run/docker.sock, a Unix socket owned by root with group-write access for the docker group. A shell user outside that group gets a permission denial on connect, and the client reports the failure against the socket path rather than as a generic fault.
How to fix permission-denied-docker-socket
General informational guidance, not professional advice. Commands can affect your system or data — back up first and proceed at your own risk. FixerCode is an independent reference, not affiliated with any vendor mentioned.
Inspect the daemon socket permissions
The listing exposes the owner and group of the socket file named in the error.
ls -l /var/run/docker.sockList the groups your session belongs to
A session missing the docker group cannot open the socket; the comparison against the socket's group explains the denial.
id -nG
Technical Background
Denial at the socket is a different failure from a stopped engine: the endpoint exists and something answers the connect attempt, then the kernel blocks the operation for this specific user.
Membership in the docker group is effectively root-equivalent access to the engine, which is why the install docs gate it deliberately. Group changes apply to new login sessions, so processes started earlier keep the old credentials until they are restarted.
Common Causes
- The invoking user is not a member of the docker group
- The docker group itself does not exist because the package install skipped it
- A containerized tool mounts the host socket without carrying the matching group ID
- The socket was recreated by a daemon restart while permissions had been customized manually
Typical Scenarios
- A fresh install where the first docker run happens under a regular user account
- A Jenkins or CI agent process whose service user was never added to the docker group
- An SSH session opened before group membership changed, so the old group set is still active
What to Know
The error names the exact socket path, which makes it easy to compare the file's owner and group against the current user's groups; sessions opened before the group change are the most common reason the adjustment appears not to apply.
Frequently Asked Questions
Common questions about Docker permission-denied-docker-socket error
It grants full control of the daemon, including mounting host paths, so the access level is comparable to root on that machine and should be limited to trusted accounts.
sudo runs the client as root, the socket's owner, so the permission check passes; the underlying group membership gap remains for the regular user.
Related Error Codes
Related Errors From Other Categories
Similar error codes documented across different platforms and systems