Troubleshooting Docker Daemon Socket Permission Denied: User Not in Docker Group on Ubuntu 22.04 LTS

Fix 'permission denied' when interacting with Docker on Ubuntu 22.04 LTS. Learn to add your user to the 'docker' group for seamless container management.

When managing containers on an Ubuntu 22.04 LTS system, a common hurdle for new or reconfigured Docker installations is encountering a "permission denied" error when attempting to execute docker commands. This typically occurs because the user account executing the commands lacks the necessary privileges to communicate with the Docker daemon's Unix socket, despite the daemon itself running correctly. This guide provides a direct, technical resolution to this common issue, ensuring smooth Docker operations.

Symptom & Error Signature

You will typically observe this error when attempting to run any docker command that interacts with the Docker daemon, such as checking Docker's version, pulling images, or running containers.

docker run hello-world

The terminal output will clearly indicate a permission issue related to the Docker daemon socket:

docker: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.24/containers/json": dial unix /var/run/docker.sock: connect: permission denied.
See 'docker run --help'.

Or, in some variations, you might see a more generic connection error, but the underlying cause remains the same:

Cannot connect to the Docker daemon. Is the docker daemon running on this host?

Root Cause Analysis

The Docker daemon runs as a root process and manages containers. The docker CLI client, which users interact with, communicates with this daemon via a Unix domain socket, by default located at /var/run/docker.sock.

Inspecting the permissions of this socket reveals the core problem:

ls -l /var/run/docker.sock

Expected output:

srw-rw---- 1 root docker 0 Sep 16 09:00 /var/run/docker.sock

Here's the breakdown:

• srw-rw----: This indicates a socket file (s), with read/write permissions for the owner (root) and the primary group (docker). Other users have no permissions.
• root: The owner of the socket.
• docker: The primary group of the socket.

For a regular user (even a user with sudo privileges) to interact with the Docker daemon socket without prefixing every command with sudo, they must be a member of the docker Unix group. When Docker is installed, the docker group is created, but the current user is not automatically added to it. Consequently, the user's process attempting to access /var/run/docker.sock does not have the required group permissions, leading to the permission denied error.

Step-by-Step Resolution

Follow these steps to correctly add your user to the docker group and resolve the permission denied error.

1. Verify Current User's Group Membership

First, confirm that your user is indeed not part of the docker group.

groups $USER

Replace $USER with your actual username, or simply run groups to see all groups for the current user. If docker is not listed in the output, your user is not a member of the group.

Example of output before adding user to docker group:

johndoe adm cdrom sudo dip plugdev lpadmin lxd sambashare

2. Add Your User to the docker Group

Use the usermod command to add your user account to the docker group.

sudo usermod -aG docker $USER

• sudo: Executes the command with superuser privileges, which is required to modify user groups.
• usermod: The command for modifying user account properties.
• -a: Appends the user to the specified group(s) without removing them from other groups. This is crucial; omitting -a would remove the user from all groups except docker.
• -G docker: Specifies the group to add the user to.
• $USER: An environment variable that expands to your current username.

The changes made by usermod will not take effect immediately for your current session. You must either log out and log back in, or use a specific command to activate the new group membership for your current shell.

3. Apply Group Changes

There are two primary ways to apply the new group membership:

Option A: Log Out and Log Back In (Recommended)

This is the most reliable method, as it ensures that your user session is completely re-initialized with the updated group information.

1. Log out of your current session.
2. Log back into your system.

Option B: Activate New Group Membership for Current Shell (Faster, but less persistent)

If you prefer not to log out and back in, you can activate the new group for your current shell using newgrp or by restarting your shell environment.

newgrp docker

This command effectively creates a new shell session with the docker group active. However, this only applies to the current terminal session. If you open a new terminal window or tab, you might need to run newgrp docker again or simply log out/in as recommended.

Alternatively, you can restart your current shell:

exec su -l $USER

This command replaces the current shell with a new login shell for the same user, which will pick up the new group memberships.

4. Verify Docker Group Membership (Post-Change)

After logging out and back in (or applying newgrp docker), verify that your user is now correctly part of the docker group.

groups $USER

The output should now include docker:

johndoe adm cdrom sudo dip plugdev lpadmin lxd sambashare docker

5. Test Docker Functionality

Finally, confirm that you can now run Docker commands without sudo and without encountering the permission denied error.

docker run hello-world

You should see output similar to this, indicating a successful connection to the Docker daemon and execution of the hello-world container:

Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
2db29710123e: Pull complete
Digest: sha256:d5930325555b7617a86ad6071861057f49557766b23d9b4b03657ad5143b4f9a
Status: Downloaded newer image for hello-world:latest

Hello from Docker!
This message shows that your installation appears to be working correctly.

To generate this message, Docker took the following steps:
 1. The Docker client contacted the Docker daemon.
 2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
    (If you didn't already have it locally.)
 3. The Docker daemon created a new container from that image which runs the
    executable that produces the output you are currently reading.
 4. The Docker daemon streamed that output to the Docker client, which sent it to your terminal.

To try something more ambitious, you can run an Ubuntu container with:
 $ docker run -it ubuntu bash

Share images, automate workflows, and more with a free Docker ID:
 https://hub.docker.com/

For more examples and ideas, visit:
 https://docs.docker.com/get-started/

You can also try other commands like:

docker ps -a

This command should list all containers (even stopped ones) without any permission errors.

While adding a user to the docker group provides convenient access, it also grants significant control over the host system. Members of the docker group can execute commands with root privileges via the Docker daemon. Treat membership in the docker group with the same security consideration as sudo access. Only add trusted users to this group.