Problem:
You are running a command like docker ps but you get this error message:
Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.39/containers/json: dial unix /var/run/docker.sock: connect: permission denied
Solution:
As a quick fix, running the command as root using sudo (e.g. sudo docker ps) will solve the issue temporarily.
The issue here is that the user you’re running the command as is not a member of the docker group. In order to add it to the docker group, run
sudo usermod -a -G docker $USER
After running that command, you need to logout and log back in to your computer (or terminate your SSH session and re-connect in case you are logged in using SSH) – else, the group change does not take effect.
Running groups should show you that you now belong to the docker group:
$ groups uli sudo www-data lxd docker # Check if docker appears here!
After that, retry running the command (e.g. docker ps) – the error should now have disappeared.
See What does sudo usermod -a -G group $USER do on Linux? for details on what this command changes on your system and what the parameters mean.
Background information
When you run any docker command on Linux, the docker binary will try to connect to /var/run/docker.sock. This allows you to run docker commands as non-root-user without using sudo all the time.
When you start the docker daemon, it will create /var/run/docker.sock as a unix socket for client applications to connect to.
You can have a look at the owner, group and permissions of the docker socket by using stat /var/run/docker.sock on the command line:
$ stat /var/run/docker.sock File: /var/run/docker.sock Size: 0 Blocks: 0 IO Block: 4096 socket Device: 16h/22d Inode: 677 Links: 1 Access: (0660/srw-rw----) Uid: ( 0/ root) Gid: ( 999/ docker) Access: 2019-04-30 01:32:21.718150679 +0200 Modify: 2019-04-24 18:37:39.236357175 +0200 Change: 2019-04-24 18:37:39.240357175 +0200 Birth: -
For our purposes, the interesting information is Uid: ( 0/ root) Gid: ( 999/ docker) which tells you that the docker socket is owned by the user root and the group docker. The group ID might be different on your computer, but only the name of the group is relevant.
Given the permissions Access: (0660/srw-rw----), both the owner (root) and the group (docker) can read & write (rw) to the docker socket. This means that if you are either the user root (which you can become temporarily using sudo) or you are a member of the docker group, you will be able to connect to that socket and communicate with the docker daemon.
Note that the docker daemon itself (dockerd) is running as root, which you can check using
$ ps aux | grep dockerd root 2680 0.1 0.3 1247872 19828 ? Ssl Apr24 7:44 /usr/bin/dockerd -H fd://
For more information on the docker daemon, see the official Docker daemon guide.