Docker Socket Permission Checker
Paste ls -l /var/run/docker.sock and id output to find out whether permission denied comes from a missing group, a stale session or the wrong socket.
ls -l /var/run/docker.sock
idpermission denied while trying to connect to the Docker daemon socket is not one error, it is four. This tool reads the two commands that separate them and tells you which one you have.
The two commands
ls -l /var/run/docker.sock
id
The first line says who may talk to the socket. The second says which groups your current shell actually carries. The mismatch between them is the error 90% of the time.
What the modes mean
| Mode | Meaning |
|---|---|
srw-rw---- | root and the docker group can read and write; nobody else can. This is the default |
srw-rw-rw- | everyone can talk to the daemon — a hole, not a fix |
srw------- | only the owner; group members are locked out even if the group is right |
Why adding the group is not enough
sudo usermod -aG docker $USER changes the account, not the session you are sitting in. Group membership is read when the session starts, so an open terminal keeps the old list. newgrp docker or a fresh login is required — and a new tab in the same desktop session does not always count, because the session leader still holds the old credentials.
Two other traps:
- A systemd unit started before the change keeps the old group set. Restart the unit, not just the shell.
- Snap and rootless installs use a different socket path (
$XDG_RUNTIME_DIR/docker.sock), where nodockergroup is involved at all.