ARC "permission denied ... docker.sock" in CI

By Daniel Zoghalchali·Latchkey

The runner reached the Docker socket but was denied access. The runner user is not permitted to use docker.sock, common when a custom image changes the user or a rootless setup is misconfigured.

What this error means

A docker step fails with "permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock" even though the daemon is running.

permission denied while trying to connect to the Docker daemon socket
at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/...":
dial unix /var/run/docker.sock: connect: permission denied

Common causes

A custom image changed the runner user

The default ARC runner runs as a user set up for dind; a custom image with a different USER may lack access to the socket.

Rootless or socket ownership mismatch

A rootless dind or an altered socket path/ownership leaves the runner user without permission on docker.sock.

How to fix it

Use the official runner image user for dind

1. Base custom images on the official ARC runner image and keep its user.
2. Do not override USER in a way that removes docker socket access.
3. Reinstall and re-run a docker step to confirm access.

Confirm containerMode dind rather than a manual socket mount

Let ARC manage the dind sidecar and socket instead of mounting docker.sock by hand, which avoids ownership mismatches.

containerMode:
  type: "dind"

How to prevent it

• Keep the documented runner user when building custom images.
• Let ARC dind mode manage the socket rather than mounting it manually.
• Test docker access on a custom image before wide rollout.

Frequently asked questions

Related guides

References

• GitHub Actions documentation