Docker daemon socket permission denied: User Not In Docker Group on CentOS Stream / Rocky Linux

Resolve 'permission denied' errors when running Docker commands on CentOS Stream or Rocky Linux by adding your user to the 'docker' group.

When working with Docker on CentOS Stream or Rocky Linux, a common issue for new users or fresh installations is encountering a "permission denied" error when attempting to execute docker commands without sudo. This prevents you from interacting with your Docker containers and images directly, often leading to frustration and the incorrect habit of always prefixing docker commands with sudo. This guide will walk you through understanding and resolving this specific permission issue.

Symptom & Error Signature

You will typically observe this error when trying to run any docker command, such as checking running containers, building images, or pulling new ones, as a non-root user:

docker ps

The output will clearly indicate a permission problem accessing the Docker daemon's Unix socket:

docker: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.24/containers/json": dial unix /var/run/docker.sock: connect: permission denied.
See 'docker --help'.

This error signifies that your current user account lacks the necessary permissions to communicate with the Docker daemon via its primary control socket.

Root Cause Analysis

The Docker daemon runs as a privileged process, typically as the root user, and exposes its API through a Unix socket located at /var/run/docker.sock. For security reasons, this socket is configured with specific file permissions.

By default, the /var/run/docker.sock file is owned by the root user and the docker group, with read and write permissions granted to the docker group.

ls -l /var/run/docker.sock

srw-rw----. 1 root docker 0 Aug  5 10:30 /var/run/docker.sock

The "permission denied" error occurs because:

1. Your current user is not root.
2. Your current user is not a member of the docker Linux group.
3. Therefore, your user does not have the necessary group permissions to read from or write to the Docker daemon socket, thus preventing interaction with the daemon.

Adding your user to the docker group grants the required permissions to access the socket without needing sudo for every command, while still maintaining a layer of security by not giving direct root access.

Step-by-Step Resolution

Follow these steps to correctly add your user to the docker group and resolve the permission issue.

1. Verify User and Docker Group Status

First, confirm your current user's group memberships and check if the docker group exists on your system.

Check your current user's groups:

id -Gn

This command will list all groups your current user is a member of. Look for docker in the output. If it's not there, you need to add it.

Check if the docker group exists:

getent group docker

If the docker group exists, it will output something like docker:x:996:. If it doesn't exist, it means Docker might not be properly installed or the installation process didn't create the group. In such a rare case, you might need to manually create the group (sudo groupadd docker) before proceeding, but usually, Docker installation handles this.

2. Add Your User to the docker Group

Use the usermod command to add your user to the docker group.

sudo usermod -aG docker $USER

• sudo: Executes the command with superuser privileges.
• usermod: Command to modify user account information.
• -a: Appends the user to the supplementary group(s) without removing them from other groups.
• -G docker: Specifies docker as the supplementary group to add the user to.
• $USER: An environment variable that expands to your current username.

The changes made by usermod do not take effect immediately for the current shell session. You must log out and log back in for the new group membership to be active. Alternatively, you can start a new shell session using su - $USER (replacing $USER with your actual username, e.g., su - myuser) to force a re-evaluation of group memberships without a full system logout.

3. Verify Group Membership and Docker Access

After logging out and logging back in (or starting a new shell session), verify that your user is now part of the docker group.

id -Gn

You should now see docker listed among your groups.

Now, attempt to run a docker command without sudo:

docker ps

If successful, you will see a list of running Docker containers (or an empty list if none are running), without any permission errors.

CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES

4. (Optional) Restart Docker Daemon

While usually not strictly necessary after adding a user to the group, restarting the Docker daemon can help ensure all components are refreshed, especially if you encountered other issues prior.

sudo systemctl restart docker

It's also a good practice to ensure Docker starts automatically on boot:

sudo systemctl enable docker

5. (Advanced/Troubleshooting) Verify SELinux Context

In rare cases on CentOS/Rocky Linux, SELinux might interfere, though it's less common for this specific permission denied error relating to the docker.sock file. If after adding your user to the docker group and re-logging in, you still encounter issues, check SELinux status.

sudo sestatus

If SELinux is in enforcing mode, you might temporarily set it to permissive to rule it out as a cause:

sudo setenforce 0

Disabling SELinux, even temporarily, can reduce your system's security posture. Only do this for troubleshooting and ensure you re-enable it (sudo setenforce 1) once you've determined it's not the cause, or if you need to configure specific SELinux policies to allow access.

If SELinux was indeed the problem, the correct long-term solution involves managing SELinux contexts, not disabling it. For Docker, ensuring the container-selinux package is installed and up-to-date usually handles common SELinux issues.

By following these steps, you should successfully resolve the "Docker daemon socket permission denied user not in docker group" error, allowing you to seamlessly manage your Docker environment without constant sudo prefixes.