Fix Docker permission denied: End the daemon socket error without sudo

Fix Docker permission denied: End the daemon socket error without sudo

permission denied while trying to connect to the Docker daemon socket
at unix:///var/run/docker.sock: ... dial unix /var/run/docker.sock: connect: permission denied

Just installed Docker on Ubuntu, excitedly ran docker ps, and this red error popped up? Congratulations(?). This is a rite of passage almost every Linux beginner goes through. I'll lead with the fix for anyone in a hurry, then walk through the "why" step by step.

Copy-paste this: The canonical 5-minute fix

Paste the following into your terminal as-is.

sudo groupadd docker          # 그룹이 없을 때만 (이미 있으면 에러 나도 무시 OK)
sudo usermod -aG docker $USER # 현재 사용자를 docker 그룹에 추가
newgrp docker                 # 재로그인 없이 그룹을 즉시 적용
docker run hello-world        # 검증

If the hello-world container greets you normally, you're done. You no longer need to prepend sudo.

The most reliable method is to log out and log back in. newgrp docker is closer to a temporary workaround that applies the group only to the current shell; you need a full logout/login for the group to take effect in every new shell and process. On WSL2, run wsl --shutdown and re-enter.

Root cause: Ownership of docker.sock

To understand this error, you only need one fact. The Docker daemon (dockerd) runs in the background as root. The docker CLI you type does not talk to that daemon directly—it communicates through a gateway called a Unix socket file. That gateway is /var/run/docker.sock.

Check it yourself:

ls -l /var/run/docker.sock

srw-rw---- 1 root docker 0 Jun 12 09:00 /var/run/docker.sock

Break that line down:

• Leading s → this file is a socket
• rw-rw---- → owner (read/write), group (read/write), everyone else (no permissions)
• root → owner is root
• docker → owning group is docker

The key is that last ----. A regular user who is not in the group has no permissions at all. If you are not in the docker group, you cannot access the socket, so you get "permission denied". What usermod -aG docker $USER does is add you to that docker group, after which the group rw- permission applies and access is granted.

Why sudo is only a workaround

sudo docker ps works in the moment. That is not a real fix—it is bypassing with root every time. There are three problems:

1. Tangled file ownership: Containers started with sudo create volume files and logs owned by root. Later, when you try to delete or edit those files as a regular user, you hit another permission error—a vicious cycle.
2. Security exposure: Running containers as root means a container escape puts the entire host at risk.
3. Simple hassle: Typing a password for every command eats into productivity.

One more point that has to be said. Joining the docker group is effectively equivalent to having root-level privileges. The Docker daemon runs as root, and group members can issue commands to that daemon. If you wanted to, you could mount any host file into a container and tamper with it. Grant the docker group only to trusted users. Do not add just anyone on a shared server.

A safer alternative: rootless Docker

If security matters on a multi-user server, consider rootless Docker. This runs the daemon itself under a regular user account.

dockerd-rootless-setuptool.sh install

As of 2026, adoption of rootless Docker and Podman (daemonless and rootless by default) has been noticeably increasing alongside the security-hardening trend. Even if a container escape happens, damage is limited to regular user privileges rather than root, so the blast radius is much smaller. You do not really need this for a personal dev environment, but on a server used by multiple people it is worth serious consideration.

Environment differences at a glance

This error is really closer to a native Linux-specific problem. Here is the breakdown by environment.

Docker Desktop on macOS and Windows runs the daemon inside a lightweight VM, so you almost never hit this permission error. WSL2 splits into two paths. If you integrate with Docker Desktop, the WSL integration toggle in the GUI settings is the key; if you install the daemon directly inside WSL without Docker Desktop, you need the same docker group setup as Ubuntu.

One practical tip: Because of Docker Desktop's licensing policy, more developers at companies have been setting up a native daemon directly on WSL2. I changed our internal guide in that direction too, and the most common sticking point was exactly this permission error. On WSL, adding the group often does not take effect; in most cases, fully shutting down the instance with wsl --shutdown and starting it again solves it.

Still not working? Checklist

If you ran all of the commands above and you are still stuck, check the following in order.

systemctl status docker        # 1. 데몬이 살아있는지 확인 (active 인지)
sudo systemctl start docker    # 2. 죽어 있으면 시작
sudo systemctl enable docker   # 3. 부팅 시 자동 시작 등록
ls -l /var/run/docker.sock     # 4. 소켓 퍼미션·소유권 확인 (root docker)
groups                         # 5. 출력에 docker가 보이는지 확인

• If docker does not appear in groups output → the group has not been applied to the shell yet. Fully log out and log back in.
• If you are on WSL → run wsl --shutdown from PowerShell, then re-enter.
• If systemctl status docker shows the daemon is down → this is not a permission problem; the daemon itself is not running, so start it first.

Conclusion: 3-line summary

1. Cause: /var/run/docker.sock is owned by root:docker, so users not in the docker group cannot access it.
2. Fix: sudo usermod -aG docker $USER then re-login (or newgrp docker).
3. Caution: sudo is a workaround; the docker group is root-equivalent, so grant it only to trusted users. If security matters, consider rootless Docker/Podman.

References: Official docs

The primary source for the behavior, settings, and errors covered in this post is the following official documentation. Check there for version-specific options and exact behavior.

• Docker official documentation

FAQ

Q. I ran usermod -aG docker $USER but I still get permission denied. A. Group changes are not applied immediately to the current shell. Temporarily apply with newgrp docker, or most reliably, fully log out and log back in. On WSL2 you need wsl --shutdown then re-enter.

Q. Can't I just use sudo docker every time? A. It works, but it is not recommended. Files created by containers become root-owned and permissions get messy later, and it is also worse for security. Join the docker group once and you can use it cleanly without sudo after that.

Q. I heard putting someone in the docker group is dangerous—how bad is it? A. Members of the docker group effectively have privileges equivalent to host root. That is because they can mount the host filesystem into a container and do anything. Fine on a personal PC, but on a multi-user server grant it only to trusted users and consider rootless Docker.