Fix "permission denied" on the Docker socket

Right after installing Docker, many people run their first command and get this:

permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock

Docker is working. Your user simply is not allowed to talk to it yet. This guide explains why, shows the standard fix, and helps you decide whether giving your user that access is the right choice.

Before you start

• A Linux VPS with Docker Engine installed. See Install Docker and Docker Compose.
• SSH access as the user who should run Docker commands, for example deploy, and sudo rights for the fix.
• Confirm the Docker service is running, because a stopped daemon gives a different error:

sudo systemctl is-active docker

It should print active. If not, see Fix Docker daemon not starting.

Why the error happens

The docker command is only a client. It sends requests to the Docker daemon through a Unix socket file, /var/run/docker.sock. Look at its permissions:

ls -l /var/run/docker.sock

srw-rw---- 1 root docker 0 Nov  9 10:00 /var/run/docker.sock

Only root and members of the docker group can read and write it. Any other user gets permission denied.

Option 1: use sudo

The quickest workaround is to run Docker commands with sudo:

sudo docker ps
sudo docker compose up -d

This keeps access limited to users with sudo rights, and each command is logged. The downside is typing sudo every time and some tools, such as editor plugins, cannot use it.

Option 2: add your user to the docker group

This is the standard fix on a single-admin VPS. Make sure the group exists, then add your user:

sudo groupadd -f docker
sudo usermod -aG docker $USER

The -a flag is important. Without it, usermod -G would replace all your other groups, including sudo.

Apply the new group

Group membership is read when you log in. Your current session still has the old list, so the error remains until you start a new one. Choose one:

• Log out of SSH and log back in. This is the most reliable.
• Start a shell with the new group for this session only:

newgrp docker

Check that docker now appears in your groups:

id -nG

If you use VS Code Remote SSH or a terminal multiplexer such as tmux, close the old sessions or restart the server side as well, because they keep the old groups.

The security trade-off

Membership of the docker group is equivalent to root access. A member can start a container that mounts the whole host filesystem and change any file:

docker run --rm -it -v /:/host alpine chroot /host

So:

• Add only trusted admin accounts to the group.
• Never add the account a web app runs under, such as www-data.
• Protect group members' SSH access with keys, not passwords.

If you need users to run containers without that power, use Docker rootless mode instead.

Do not chmod the socket

You may see advice to run sudo chmod 666 /var/run/docker.sock. It removes the error by giving every user and process on the server root-equivalent access, and the change is lost on the next restart anyway. Use the group or sudo instead.

Check it works

In a fresh login session, run without sudo:

docker ps
docker run --rm hello-world

docker ps should print the table header, and the test container should print Hello from Docker!.

Troubleshooting

• Still permission denied after adding the group: you have not logged in again. Check id -nG; if docker is missing, reconnect over SSH.
• usermod: group 'docker' does not exist: Docker is not installed the standard way. Run sudo groupadd docker, then restart Docker so it applies the socket's group.
• Socket owned by root:root: the group was created after Docker started. Run sudo systemctl restart docker.socket docker.
• Error mentions /run/user/1000/docker.sock: you use rootless Docker, or DOCKER_HOST is set. Check echo $DOCKER_HOST and docker context ls.

Next steps

• Harden the server around Docker: Docker security checklist for a public VPS.
• Run Docker on a Linux VPS with full root access.