Docker "permission denied ... docker.sock" in CI
The runner user is not allowed to talk to the Docker daemon socket. The daemon is running, but the user is not in the docker group or lacks permission on /var/run/docker.sock.
What this error means
A docker command fails with permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock. The same command works under a privileged user.
docker
Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.45/containers/json": dial unix /var/run/docker.sock: connect: permission deniedDiagnose it: read the container, not the compose file
A container that exits immediately in CI has almost always logged the reason and then been cleaned up. Capture the logs and the exit code before changing configuration.
Terminal
# why did it stop?
docker ps -a --format '{{.Names}}\t{{.Status}}\t{{.Image}}'
docker logs <container> 2>&1 | tail -50
docker inspect <container> --format '{{.State.ExitCode}} {{.State.OOMKilled}} {{.State.Error}}'Common causes
User not in the docker group
The runner account lacks docker group membership, so it cannot access the socket.
Socket permissions/ownership wrong
A mounted docker.sock has ownership that the in-container user cannot use.
How to fix it
Grant the user socket access
- Add the runner user to the docker group and re-login (or newgrp).
- Verify with a non-privileged docker command.
Terminal
sudo usermod -aG docker "$USER"
newgrp docker
docker psFix a mounted socket
- When mounting docker.sock into a container, run as a user that can access it or adjust group ownership.
Terminal
docker run --group-add "$(stat -c '%g' /var/run/docker.sock)" -v /var/run/docker.sock:/var/run/docker.sock appHow to prevent it
- Ensure the CI user is in the docker group on self-hosted runners, and align socket ownership when mounting docker.sock into containers. This is a permissions issue, not transient.
Frequently asked questions
What causes Docker "permission denied ... docker.sock" in CI?
There are 2 common causes: user not in the docker group and socket permissions/ownership wrong. The runner account lacks docker group membership, so it cannot access the socket.
How do I fix Docker "permission denied ... docker.sock" in CI?
There are 2 fixes depending on which cause you have: grant the user socket access and fix a mounted socket. Work through them in order, since the first is the most common.
What does Docker "permission denied ... docker.sock" in CI actually mean?
A docker command fails with permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock.
How do I stop Docker "permission denied ... docker.sock" in CI happening again?
Ensure the CI user is in the docker group on self-hosted runners, and align socket ownership when mounting docker.sock into containers.
Related guides
Docker "OCI runtime exec failed" - Fix docker exec Failures in CIFix Docker "OCI runtime exec failed: exec failed: ... executable file not found in $PATH" in CI - a docker
Docker "pull policy always but offline" in CIFix Docker pull failures with `--pull always` in CI when the runner is offline or air-gapped - the daemon
Docker "oci runtime error: container_linux mkdir /proc" in CIFix Docker "oci runtime error: container_linux.go: ... mkdir /proc: ..." in CI - the runtime could not set up