Docker "error during connect: Get docker daemon" (TLS) in CI
When DOCKER_HOST points at a TLS-secured remote daemon (port 2376, common with dind-over-TCP), the CLI must complete a TLS handshake before any command runs. A daemon still booting, a missing client certificate, or a transient network blip surfaces as "error during connect". The handshake racing daemon startup is the usual transient cause.
What this error means
A docker command fails with error during connect: Get "https://docker:2376/v1.43/...": dial tcp: connect: connection refused or a TLS handshake error, especially right after a dind service starts.
error during connect: Get "https://docker:2376/v1.43/info": dial tcp 10.1.0.4:2376: connect: connection refusedCommon causes
The daemon is still starting
A dind service container has not finished booting and opening port 2376 when the first CLI command runs.
Missing or wrong TLS client certs
DOCKER_TLS_VERIFY=1 with no DOCKER_CERT_PATH (or the wrong certs) fails the handshake.
A transient network drop to the daemon host
An ephemeral connectivity blip between the CLI and the remote daemon interrupts the connect.
How to fix it
Wait for the daemon, then connect
- Poll
docker infountil the daemon answers before running build/push steps. - Point the CLI at the TLS socket with the certs the dind service generated.
export DOCKER_HOST=tcp://docker:2376
export DOCKER_TLS_VERIFY=1
export DOCKER_CERT_PATH=/certs/client
for i in $(seq 1 30); do docker info >/dev/null 2>&1 && break; sleep 2; done
docker build -t myorg/app:ci .Provide matching TLS client certificates
- Mount the dind-generated client certs and set
DOCKER_CERT_PATHto them. - Keep
DOCKER_TLS_VERIFY=1consistent with the cert path.
volumes:
- certs-client:/certs/client:ro
env:
DOCKER_TLS_VERIFY: "1"
DOCKER_CERT_PATH: /certs/clientHow to prevent it
- Gate Docker commands behind a
docker inforeadiness loop in dind setups. - Keep
DOCKER_TLS_VERIFYandDOCKER_CERT_PATHin sync with the daemon certs.