Fix Docker socket permission denied on Linux

Quick answer

Run sudo usermod -aG docker $USER, then log out and back in (or run newgrp docker to skip the logout).

What's actually happening here

Docker runs as a daemon that listens on a Unix socket at /var/run/docker.sock. By default, that socket is owned by root:docker with permissions 660. So only root and members of the docker group can read/write to it. If your user isn't in that group, every docker ps or docker run command slaps you with a permission denied error.

This is by design — Docker doesn't want any random user talking to the daemon without explicit permission. The socket is the gateway to root-level container operations (like mounting filesystems or spawning privileged containers). So you can't just chmod it to 777; that'd be a security nightmare.

Fix steps

Add your user to the docker group
```
sudo usermod -aG docker $USER
```
Here, usermod -aG appends (note the -a — without it, -G replaces your secondary groups entirely, which is bad) the user to the docker group. If you skip the -a, you'll lose access to other groups you're in (like sudo). I've seen that mistake lock people out of sudo. Don't skip it.
Log out and log back in
```
exit (or close your terminal) then log in again
```
Group membership changes are applied at login time. If you don't log out, your current session still has the old groups. You can test with groups in a new terminal after logging back in — you should see docker listed.
Or skip the logout with newgrp
```
newgrp docker
```
This spawns a subshell with the new group. It's a workaround, not permanent. Run docker ps in that shell to confirm it works.
Verify the fix
```
docker ps
```
If you see a list of running containers (or an empty table), it worked. If you still get the permission denied error, check that Docker daemon is actually running (sudo systemctl status docker) or that the socket exists (ls -l /var/run/docker.sock).

If the main fix doesn't work

Check if the docker group exists
```
getent group docker
```
If it doesn't, install Docker again — the package creates the group during installation. On Ubuntu/Debian, that's sudo apt install docker.io. On Fedora, sudo dnf install docker-ce.
Manually create the group
```
sudo groupadd docker
```
Then add your user and restart Docker (sudo systemctl restart docker).
Check the socket permissions
```
ls -l /var/run/docker.sock
```
It should show srw-rw---- 1 root docker. If it's something else (like root:root or wrong permissions), something's misconfigured. Run sudo chown root:docker /var/run/docker.sock and sudo chmod 660 /var/run/docker.sock to fix it. But this is a symptom of a deeper issue — check your Docker configuration or restart the daemon.

Prevention tip

After adding yourself to the docker group, any user in that group can effectively run containers with root privileges (they can mount the host filesystem, for example). So only add trusted users. If you're on a shared system, consider using sudo for Docker commands instead — it's more audit-friendly. Or switch to rootless Docker mode (since Docker 19.03), which avoids the socket group issue entirely by running the daemon under your user's UID. That's the real long-term fix for multi-user environments.