Docker "permission denied ... docker.sock" in CI

By Kaveh Alemi·Latchkey

The runner user is not allowed to talk to the Docker daemon socket. The daemon is running, but the user is not in the docker group or lacks permission on /var/run/docker.sock.

What this error means

A docker command fails with permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock. The same command works under a privileged user.

Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.45/containers/json": dial unix /var/run/docker.sock: connect: permission denied

Common causes

User not in the docker group

The runner account lacks docker group membership, so it cannot access the socket.

Socket permissions/ownership wrong

A mounted docker.sock has ownership that the in-container user cannot use.

How to fix it

Grant the user socket access

1. Add the runner user to the docker group and re-login (or newgrp).
2. Verify with a non-privileged docker command.

sudo usermod -aG docker "$USER"
newgrp docker
docker ps

Fix a mounted socket

1. When mounting docker.sock into a container, run as a user that can access it or adjust group ownership.

docker run --group-add "$(stat -c '%g' /var/run/docker.sock)" -v /var/run/docker.sock:/var/run/docker.sock app

How to prevent it

• Ensure the CI user is in the docker group on self-hosted runners, and align socket ownership when mounting docker.sock into containers. This is a permissions issue, not transient.

Frequently asked questions

Related guides

References

• Docker documentation
• Docker build cache
• GitHub Actions documentation