Docker: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock

Question

I am new to docker. I just tried to use docker in my local machine(Ubuntu 16.04) with Jenkins.

I configured a new job with below pipeline script.

node {
    stage('Build') {
      docker.image('maven:3.3.3').inside {
        sh 'mvn --version'
      }
    }
}

But it fails with this error:

Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock

Rogerson

is it a monolithic Jenkins or has a master-slave setup? Check with which user you are executing the docker inspect command. See if /var/run/docker.sock has RW access to group. – Foundling

Possible duplicate of Got permission denied while trying to connect to the Docker daemon socket while executing docker stop – Matta

docker post-installation steps: docs.docker.com/install/linux/linux-postinstall/… – Alodi

I had a similar problem. Those resources were helpful: linuxhandbook.com/docker-permission-denied and techoverflow.net/2018/12/15/… – Mishamishaan

Answer 1

If using jenkins

The user jenkins needs to be added to the group docker:

sudo usermod -a -G docker jenkins

Then restart Jenkins.

Otherwise

If you arrive to this question of stack overflow because you receive this message from docker, but you don't use jenkins, most probably the error is the same: your unprivileged user does not belong to the docker group.

You can do:

sudo usermod -a -G docker $USER

You can check it was successful by doing grep docker /etc/group and see something like this:

docker:x:998:[user]

in one of the lines.

Then change your users group ID to docker (to avoid having to log out and log in again):

newgrp docker

Solution

and relogin user – Epley

Nice answer, but to be more general we could do this: sudo usermod -a -G docker $USER and logout or reboot. link – Urban

@JulienNyambal That adds the user that's running the command to the docker group. In this case that's not what's wanted since Jenkins is its own user and Jenkins is what needs access to docker. – Cyprio

I had to restart my server for this to actually work. – Nonconformance

I had to disconnect/reconnect my nodes for this to work (they are connected over ssh) – Seditious

Probably worth highlighting that without restart the changes will likely not take effect. – Regent

No need to login again, just use newgrp docker instead in the same terminal session. – Voe

service jenkins restart solved my docker socket problem while restarting from browser did not. – Fleeting

restart jenkins from command line ' sudo service jenkins restart ' not from ' ip:port/restart ' – Impower

If you're running Jenkins inside a docker container just run groupadd docker && usermod -a -G docker jenkins inside your Dockerfile, like this – Broadfaced

in centos I found the user dockerroot not docker. – Flanch

If running Jenkins inside docker, make sure the GIDs of 'docker' groups on container and on host are the same. E.g. groupadd -g 109 docker, where 109 is the GID on host (check it with grep docker /etc/group) – Frisette

Note: I had to run sudo service jenkins restart for the permission changes to take effect. Restarting Jenkins through its web interface is not enough. – Julietajulietta

I also had to log out of the other user accounts on the computer for this to work – Eventually

You may also have to restart docker. The docker.sock file's group is set to root if the docker group doesn't exist. So after creating the group, you need to restart docker to get to use the new group for the socket. – Hade

None of these solutions worked for me. Restarting the system and docker multiple times after applying these permissions and trying others still doesn't resolve the problem. – Sheridansherie

sudo /usr/bin/usermod -a -G docker [user] One might want to give full classpath of usermod, if it's not added in your path. – Dniren

After running sudo -a -G docker [user] command, I restarted my computer and it worked :-) (NOTE: It didn't work unless I reset it.) – Bicephalous

sudo usermod -a -G docker jenkins and service jenkins restart will work as @Solution mentioned – Fireplug

In my case line docker:x:998:[user] was already in the file but with docker:x:995:[user] and the command did not update it. I did it manually, and everything worked as expected. – Zoraidazorana

I am using Azure DevOps to run the pipeline. How would I know which user to add to the docker group? – Lundberg

It stops working when I close/reopen terminal – Marotta

Answer 2

My first solutions was:

usermod -aG docker jenkins
usermod -aG root jenkins
chmod 664 /var/run/docker.sock

But none of them work for me, I tried:

chmod 777 /var/run/docker.sock

That works, but I don't know if it is the right call.

Malia

The reason why it failed probably is because you had to reopen terminal. It failed after doing 664, but then i opened a new shell it worked. – Sladen

I tried reopening, but it started working only after the last chmod 777 – Suisse

the problem was that after reboot 777 was reset to 660. What fixed the problem for me was 'usermod -aG users jenkins'. – Suisse

I realize it was reset, but do not set the docker.sock permissions to 777. This gives anyone root on your system. They are able to talk to docker and create privileged containers with no restrictions. – Officer

Despite this worked for the author and even for me, give more access to the docker.sock file is not the best solution, you only need to execute the usermod ... instructions, and then reboot your system, otherwise it doesn't take effect – Bluff

this also worked for me on ubuntu chmod 777 /var/run/docker.sock – Nalor

Granting the Docker socket a very open permission, like 777, is something you may want to avoid in Prod, by doing this, you are giving the permissions to any process or user to fully access Docker. You only need to add Jenkins user to Docker group and then restart your server, that's pretty much all what you need to do. HTH. – Ayo

Giving full access permission on the socket may cause security problems. – Equiangular

don't do ever chmod 777 /var/run/docker.sock. never. this is giving permissions to anyone to use Docker in the machine, totally discouraged. – Gravitt

I'd love to have an option other than chmod 777 but nothing else is working for me, even after multiple restarts and attempts to fix it. – Sheridansherie

Better to try: chmod 666 /var/run/docker.sock – Silvan

That's ubuntu 23.04 issue while apt install docker-compose – Ringo

Answer 3

Success for me

sudo usermod -a -G docker $USER
reboot

Train

no need reboot. Just logout then login again. I am talking about usermod – Esperanzaespial

On Ubuntu 18.04, I had to reboot for the setting to work. – Bidet

On Ubuntu 20.04 I needed the reboot. Close session not enough. – Vassar

Or run su ${USER} instead of logging out – Schriever

I tried many of the suggestions here and elsewhere, and rebooting seems to have done the trick. – Modeling

Ubuntu 22.10 : Rebooted and worked...! – Galan

@goonerify's solution worked for me. I ran sudo usermod -a -G docker $USER and then su ${USER} and my Docker issues were fixed without needing to restart my VPS. – Sacrifice

On Manjaro 23 re-login is not enough either. Only after the full restart I can run docker commands without sudo – Aspa

Answer 4

2018-08-19

I have been stuck for days on this one and as I haven't found a complete answer with the why and how, I will post one for other people that stumble on the same problem and answers from above do not work.

These are the 3 crucial steps when running Jenkins inside docker:

1. You mount the socket /var/run/docker.sock to the jenkins container in order to be able to use the docker from the host.
2. You have to install docker inside the container in order to use it. This is a great and simple article on how to do that. Note that newer versions might already have docker installed
3. You run sudo usermod -a -G docker jenkins in order to add jenkins to the docker group. However, here you might run into a permission problem if the host docker and the container docker don't have the same group id so it is very important to adjust the container docker's gid to be the same as the host docker gid

You can do this as a part of a launch script or simply by using exec and doing it manually: groupmod -g <YOUR_HOST_DOCKER_GID> docker.

Also, do not change permissions of the /var/run/docker.sock to 777 or stuff like that because that is a big security risk, you are basically giving everyone permission to use docker on your machine

Hope this helps

Homegrown

Thanks-- note that for the current Jenkins Docker images the docker commands are already installed (and apt-get is not.) Your other points-- adding Jenkins to the right group and ensuring the GID matches the one from the Docker host, remain spot on. – Trundle

Saved my life with the group id problem. Thanks! – Harrelson

When I try to add group inside jenkins container it fails as I need to be root. If I try su - it asks me for password. How are you adding group with right ID inside the jenkins container? – Ciliolate

The default user in the container is determined by the parent image user but if you run a standard ubuntu image, it should be root and you shouldn't have any issues running a usermod command. How exactly did it fail? Can you provide and example command and error message? – Homegrown

This should be a separate answer to a separate question asking the same thing but when running Jenkins inside a container. The groupmod command can/should be in the Dockerfile. – Macaw

@UroshT. step2 only requires docker-ce-cli but not full docker. step3 is a little ambigious. It's better to point out which env for the command to run. – Epistrophe

See this for a more canonic way of doing this – Gringo

Get the host gid of the docker socket with stat -c "%g" /var/run/docker.sock – Gringo

Answer 5

Change the access permission of the docker.sock file

chmod 777 /var/run/docker.sock

or u can use sudo in the start of the command.

chmod 777 will allow all actions for all users while chmod 666 will allow all users to read and write but cannot execute the file.

Pusillanimous

chmod 777 /var/run/docker.sock worked for me I had this issue after installing from snap – Embarkment

is this a best practice? – Hirsch

This is definitely not the best option due to security reasons, but worked for me. – Milline

Of course it works because it gives everyone access. Best practice would be to create a group called docker and then sudo chown root:docker /var/run/docker.sock so that users in the docker group have access. – Cant

Thank you! This is the only solution that worked for my after trying them all. – Observable

Answer 6

This works for me in Ubuntu 20.04

sudo chmod 666 /var/run/docker.sock

Don't know what exactly it does but solve the problem.

Appalling

its working fine but when i reboot the system again it's not working. – Der

This sets the socker readable and writable to everyone. Remember - 666 is the mark of the beast, and to be avoided for anything where security matters at all. It'll certainly fix THAT problem, but may bring you a bunch of bigger ones. :) – Gabriel

@PaulHodges yeah. but it's a quick fix. – Appalling

Answer 7

Method 01 :- Safer method

sudo usermod -aG docker ${USER}

To apply the new group membership, log out of the server and back in, or type the following:

su - ${USER}

You will be prompted to enter your user’s password to continue. Confirm that your user is now added to the docker group by typing:

id -nG

Method 02 :- Not recommended for public deployments (Unsafe)

chmod 777 /var/run/docker.sock

or use

sudo chown root:docker /var/run/docker.sock

Charleencharlemagne

This was the only working solution for me!! – Groundsill

Or else you can run it as sudo – Charleencharlemagne

This solution will make docker insecure!! – Unearned

Not recommended for public deployments. – Charleencharlemagne

The answer has been edited to be more secure. @Mohsen – Charleencharlemagne

I don't know how to logout a system user, so, I restarted the Jenkins service. service jenkins restart – Hymenium

Drop your "Method 02" and add sudo chown root:docker /var/run/docker.sock – Cant

Answer 8

This is a very common permission issue and here is the Simple Solution:

check what read-write permissions docker have:

ls -l /var/run/docker.sock

if above command says: srw-rw---- 1 root docker 0 Feb 17 12:48 /var/run/docker.sock

then we need to change the permissions:

sudo chmod 666 /var/run/docker.sock

and now if you will check permissions, it says: srw-rw-rw- 1 root docker 0 Feb 17 12:48 /var/run/docker.sock

in case you are curious what is 666?

permission to Read, Write and Execute [1st digit for owner, 2nd for group, 3rd for user], 666 is more secure than 777.

Houselights

I up-voted this because you explained it simply. Now I have proven this was my underlying issue I can go ahead and implement a more secure way to gain the permission. Thanks. – Telega

I down-voted this because it's a critical security error, and allows any local process to trivially take over the host. – Eskill

Answer 9

Simply adding docker as a supplementary group for the jenkins user

sudo usermod -a -G docker jenkins

is not always enough when using a Docker image as the Jenkins Agent. That is, if your Jenkinsfile starts with pipeline{agent{dockerfile or pipeline{agent{image:

pipeline {
    agent {
        dockerfile {
            filename 'Dockerfile.jenkinsAgent'
        }
    }
    stages {

This is because Jenkins performs a docker run command, which results in three problems.

• The Agent will (probably) not have the Docker programs installed.
• The Agent will not have access to the Docker daemon socket, and so will try to run Docker-in-Docker, which is not recommended.
• Jenkins gives the numeric user ID and numeric group ID that the Agent should use. The Agent will not have any supplementary groups, because docker run does not do a login to the container (it's more like a sudo).

Installing Docker for the Agent

Making the Docker programs available within the Docker image simply requires running the Docker installation steps in your Dockerfile:

# Dockerfile.jenkinsAgent
FROM debian:stretch-backports
# Install Docker in the image, which adds a docker group
RUN apt-get -y update && \
 apt-get -y install \
   apt-transport-https \
   ca-certificates \
   curl \
   gnupg \
   lsb-release \
   software-properties-common

RUN curl -fsSL https://download.docker.com/linux/debian/gpg | apt-key add -
RUN add-apt-repository \
   "deb [arch=amd64] https://download.docker.com/linux/debian \
   $(lsb_release -cs) \
   stable"

RUN apt-get -y update && \
 apt-get -y install \
   docker-ce \
   docker-ce-cli \
   containerd.io

...

Sharing the Docker daemon socket

As has been said before, fixing the second problem means running the Jenkins Docker container so it shares the Docker daemon socket with the Docker daemon that is outside the container. So you need to tell Jenkins to run the Docker container with that sharing, thus:

pipeline {
    agent {
        dockerfile {
            filename 'Dockerfile.jenkinsAgent'
            args '-v /var/run/docker.sock:/var/run/docker.sock'
        }
    }

Setting UIDs and GIDs

The ideal fix to the third problem would be set up supplementary groups for the Agent. That does not seem possible. The only fix I'm aware of is to run the Agent with the Jenkins UID and the Docker GID (the socket has group write permission and is owned by root.docker). But in general, you do not know what those IDs are (they were allocated when the useradd ... jenkins and groupadd ... docker ran when Jenkins and Docker were installed on the host). And you can not simply tell Jenkins to user user jenkins and group docker

args '-v /var/run/docker.sock:/var/run/docker.sock -u jenkins:docker'

because that tells Docker to use the user and group that are named jenkins and docker within the image, and your Docker image probably does not have the jenkins user and group, and even if it did there would be no guarantee it would have the same UID and GID as the host, and there is similarly no guarantee that the docker GID is the same

Fortunately, Jenkins runs the docker build command for your Dockerfile in a script, so you can do some shell-script magic to pass through that information as Docker build arguments:

pipeline {
    agent {
        dockerfile {
            filename 'Dockerfile.jenkinsAgent'
            additionalBuildArgs  '--build-arg JENKINSUID=`id -u jenkins` --build-arg JENKINSGID=`id -g jenkins` --build-arg DOCKERGID=`stat -c %g /var/run/docker.sock`'
            args '-v /var/run/docker.sock:/var/run/docker.sock -u jenkins:docker'
        }
    }

That uses the id command to get the UID and GID of the jenkins user and the stat command to get information about the Docker socket.

Your Dockerfile can use that information to setup a jenkins user and docker group for the Agent, using groupadd, groupmod and useradd:

# Dockerfile.jenkinsAgent
FROM debian:stretch-backports
ARG JENKINSUID
ARG JENKINSGID
ARG DOCKERGID
...
# Install Docker in the image, which adds a docker group
RUN apt-get -y update && \
 apt-get -y install \
   apt-transport-https \
   ca-certificates \
   curl \
   gnupg \
   lsb-release \
   software-properties-common

RUN curl -fsSL https://download.docker.com/linux/debian/gpg | apt-key add -
RUN add-apt-repository \
   "deb [arch=amd64] https://download.docker.com/linux/debian \
   $(lsb_release -cs) \
   stable"

RUN apt-get -y update && \
 apt-get -y install \
   docker-ce \
   docker-ce-cli \
   containerd.io

...
# Setup users and groups
RUN groupadd -g ${JENKINSGID} jenkins
RUN groupmod -g ${DOCKERGID} docker
RUN useradd -c "Jenkins user" -g ${JENKINSGID} -G ${DOCKERGID} -M -N -u ${JENKINSUID} jenkins

Selfcongratulation

This is an excellent comprehensive solution and the only one that worked for me when using docker socket shared to docker via dockerfile. It should be its own blog post. Thanks for this! – Eby

Seems like you could pass -u jenkins:$(getent group docker | cut -d: -f3)? – Uturn

When passing the args, it's probably better to change the following line : args '-v /var/run/docker.sock:/var/run/docker.sock -u jenkins:docker' by args '-v /var/run/docker.sock:/var/run/docker.sock -u jenkins:jenkins --group-add docker' When passing -u jenkins:docker, you change the primary user group, which mean when the user write a file, let say in the workspace, it will set the file user to jenkins and the group to docker. Which is probably not what we intend. – Silverweed

Precious resource. Thank you ! – Filomena

You missed information, where do I get DOCKERGID from. Also how to run the build with those arguments from Dockerfile? – Collinsia

@Collinsia it says DOCKERGID=stat -c %g /var/run/docker.sock – Selfcongratulation

Answer 10

I added the jenkins user to root group and restarted the jenkins and it started working.

sudo usermod -a -G root jenkins
sudo service jenkins restart

Rogerson

This is a bad security practice. The preferred approach is this answer. – Zwolle

Answer 11

I used below command, it worked for me.

sudo chmod 777 /var/run/docker.sock

Faery

Answer 12

I faced a similar issue, which is a permission issue and the cause of this issue is because the Docker daemon/server always runs as the root user, and wants you to always preface the docker command with sudo.

Docker daemon binds to a Unix socket instead of a TCP port. By default that Unix socket is owned by the user root and other users can only access it using sudo.

To fix this, here's what worked for me:

Firstly, check if you have a docker group already created:

cat /etc/group

If you don't find docker in the list that is displayed, then you will need to create one:

sudo groupadd docker

Next, confirm your user and your group using the command below:

cat /etc/group

Scroll through to see the group for docker. It should be of this format

docker:x:140:promisepreston

where docker is my group and promisepreston is my user

Now we can add your user to the docker group

Also add your user to the “docker” group, If you would like to use Docker as a non-root user:

Copy and run the command below in your terminal exactly how it is stated without modifying it in any way, regardless of the docker image/container/command that you want to run or are trying to run or is causing the permission issue:

sudo usermod -aG docker $USER

After running the command above, you will need to Log out and log back in so that your group membership is re-evaluated. However, on Linux, you can also run the following command below to activate the changes to groups (Copy and run the command below in your terminal exactly how it is stated without modifying it in any way, regardless of the docker image/container/command that you want to run or are trying to run or is causing the permission issue):

newgrp docker

OR

sudo systemctl restart docker

You can now verify that you can run docker commands without sudo permissions, by running the command that is causing the permissions issue again, say (Replace my-command with the name of your image/container/command):

docker run my-command

For Docker and Local filesystem files:

If you have a copy of the files on your local filesystem, then you can change the ownership of the application directory where the application files are stored, using this format:

sudo​​ ​ chown​​ ​ your_user:your_group​​ ​ -R​​ my-app-directory/

So in my case it will be:

sudo chown promisepreston:docker -R my-app-directory/

Note: Please run this command inside the parent directory housing the application directory.

That's all.

I hope this helps

Demon

Answer 13

Step 1: add your username to the docker group:

sudo usermod -a -G docker $USER

Then logout and login again.

Step 2: Then change docker group ID :

newgrp docker

Bonus: Check your new group:

id -g

P.S If you are interested, the reference is here.

Sverige

Logout doesn't always work. Restart did work for me. – Judicative

Answer 14

I fixed this issue using the following commands:

sudo chmod 777 /var/run/docker.sock
sudo chown ${USER}:docker /var/run/docker.sock

Loveliesbleeding

Answer 15

I have Jenkins running in Docker and connected Jenkins is using Docker socket from host machine Ubuntu 16.04 via volume to /var/run/docker.sock.

For me solution was:

1) Inside Docker container of Jenkins (docker exec -it jenkins bash on host machine)

usermod -a -G docker jenkins
chmod 664 /var/run/docker.sock
service jenkins restart (or systemctl restart jenkins.service)
su jenkins

2) On host machine:

sudo service docker restart

664 means - read and write(but not execute) for owner and users from group.

Golden

This is the only solution that doesn't require a login/login, ie the solution that works when trying to run this in a shell script. – Haddix

Answer 16

While doing production config i got the permission issue.I tried below solution to resolve the issue.

Error Message

ubuntu@node1:~$ docker run hello-world
docker: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Post http://%2Fvar%2Frun%2Fdocker.sock/v1.38/containers/create: dial unix /var/run/docker.sock: connect: permission denied.
See 'docker run --help'.

Solution: permissions of the socket indicated in the error message, /var/run/docker.sock:

ubuntu@ip-172-31-21-106:/var/run$ ls -lrth docker.sock
srw-rw---- 1 root root 0 Oct 17 11:08 docker.sock
ubuntu@ip-172-31-21-106:/var/run$ sudo chmod 666 /var/run/docker.sock
ubuntu@ip-172-31-21-106:/var/run$ ls -lrth docker.sock
srw-rw-rw- 1 root root 0 Oct 17 11:08 docker.sock

After changes permission for docket.sock then execute below command to check permissions.

ubuntu@ip-172-31-21-106:/var/run$ docker run hello-world
Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
1b930d010525: Pull complete
Digest: sha256:c3b4ada4687bbaa170745b3e4dd8ac3f194ca95b2d0518b417fb47e5879d9b5f
Status: Downloaded newer image for hello-world:latest

Hello from Docker!
This message shows that your installation appears to be working correctly.

To generate this message, Docker took the following steps:
 1. The Docker client contacted the Docker daemon.
 2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
    (amd64)
 3. The Docker daemon created a new container from that image which runs the
    executable that produces the output you are currently reading.
 4. The Docker daemon streamed that output to the Docker client, which sent it
    to your terminal.

To try something more ambitious, you can run an Ubuntu container with:
 $ docker run -it ubuntu bash

Share images, automate workflows, and more with a free Docker ID:
 https://hub.docker.com/

For more examples and ideas, visit:
 https://docs.docker.com/get-started/

Juice

Answer 17

We have two methods for solve this issue..

Method 1 Apply the new group membership

sudo usermod -aG docker ${USER}
su - ${USER}

Method 2 Change the file permision and group permisions

chmod 777 /var/run/docker.sock
sudo chown root:docker /var/run/docker.sock

Method 1 is secure method.

Termite

As you said Method 1 is a secure method. but Method 2 is not recommended if we just installed docker, a reboot of the system will solve the problem. – Thun

Option 2 is gratuitously insecure; chmod 777 on anything is usually inadvisable, and access to the Docker socket comes with the ability to root the entire host, so giving very broad permissions on that socket file is all but equivalent to disabling your root password for local processes. – Eskill

Answer 18

No one seem to mention, that according to the official source: https://docs.docker.com/engine/install/linux-postinstall/#manage-docker-as-a-non-root-user - you can just "pre" your command with sudo and it will work without creating users or other manipulations. For example sudo docker pull mongo - this works.

Bryna

Answer 19

In my case, it was not only necessary add jenkins user to docker group, but make that group the primary group of the jenkins user.

# usermod -g docker jenkins
# usermod -a -G jenkins jenkins

Don't forget to reconnect the jenkins slave node or restart the jenkins server, depend on your case.

Hickie

Answer 20

2019-05-26

This worked for me !

Example docker-compose:

version: "3"
services:
  jenkins:
    image: jenkinsci/blueocean
    privileged: true
    ports:
      - "8080:8080"
    volumes:
      - $HOME/learning/jenkins/jenkins_home:/var/jenkins_home
    environment:
      - DOCKER_HOST=tcp://socat:2375
    links:
      - socat

  socat:
     image: bpack/socat
     command: TCP4-LISTEN:2375,fork,reuseaddr UNIX-CONNECT:/var/run/docker.sock
     volumes:
        - /var/run/docker.sock:/var/run/docker.sock
     expose:
        - "2375"

Hardpressed

Very convenient... No need to merge with permissions. – Hyaluronidase

Answer 21

2019-02-16

Most of the steps were the same for me as the others has written. However, I was not able to add jenkins to the group docker using usermod with the mentioned solutions.

I tried the following command from the docker host, and from the running docker container:

sudo usermod -a -G docker jenkins

(I entered to the running docker container with the following command from the docker host:

docker exec -t -i my_container_id_or_name /bin/bash

)

Received from docker host:

usermod: user 'jenkins' does not exist

Received from docker container:

We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things:

#1) Respect the privacy of others.
#2) Think before you type.
#3) With great power comes great responsibility.

[sudo] password for jenkins:

I didnt know the password.

Without the sudo part of the command, in the docker container I received:

usermod: Permission denied. usermod: cannot lock /etc/passwd; try again later.

Solution: I entered to the running docker container from the docker host with the following command:

docker exec -t -i -u root my_container_id_or_name /bin/bash

Now, I entered as root, and issued the following command:

usermod -a -G docker jenkins

Then, from the docker host, I restarted my running docker container with the following command:

docker restart my_container_id_or_name

After that, I started the jenkins job and it finished with success.

I only used the root user to issue the usermod command for the user jenkins.

Kroeger

Answer 22

If you may get errors like below,

Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock

or

level=error msg="failed to dial gRPC: cannot connect to the Docker daemon. Is 'docker daemon' running on this host?: dial unix /var/run/docker.sock: connect: permission denied"

Just try to execute the following commands,

$ sudo su - jenkins
$ sudo usermod -a -G docker $USER
$ sudo chown jenkins:docker /var/run/docker.sock

About

`sudo usermod -a -G docker $USER' will ask for the password of jenkins, not sure what is the user password. – Woolly

I think you should give the sudo permission for the Jenkins user. or you can try with the following command in root user, usermod -a -G docker jenkins and chown jenkins:docker /var/run/docker.sock – About

You shouldn't change ownership of the socket to jenkins. And you should run sudo as whatever normal user has sudo access, not as jenkins. What does this answer add to the accepted answer? – Paprika

Answer 23

I`m using the official jenkins docker image (https://hub.docker.com/r/jenkins/jenkins) but I think this solution is applicable to most use cases where we want to run Docker inside a Docker container.

The recommended way for using Docker inside a Docker container, is to use the Docker deamon of the host system. Good article regarding that: https://itnext.io/docker-in-docker-521958d34efd.

The secret to handle the permission issue, which this question is about, is to add permissions for the user of the container inside the container, not the host system. Only root user has permissions to do that by default, so

docker exec -it -u root <container-name> bash
usermod -a -G docker <username>

will do it. Remember to restart the container.

I guess the simpliest way to achive this is to create a customised Dockerfile:

# Official jenkins image
FROM jenkins/jenkins:lts
# Swith to root to be able to install Docker and modify permissions
USER root
RUN apt-get update
# Install docker
RUN curl -sSL https://get.docker.com/ | sh
# Add jenkins user to docker group
RUN usermod -a -G docker jenkins
# Switch back to default user
USER jenkins

# Bild the image:
# sudo docker build -t yourusername/imagename .
# Run the image and mount with the followin bind mount option:
# sudo docker run --name imagename -d -p8080:8080 -v /var/run/docker.sock:/var/run/docker.sock yourusername/imagename

Proper

No need to install an entire docker on Jenkins image, see my answer – Broadfaced

Answer 24

In my case this will work successfully. navigate your local repo and enter this command.

sudo chmod 666 /var/run/docker.sock

Discourse

Answer 25

sudo usermod -a -G docker jenkins
sudo service jenkins restart

Dehypnotize

Answer 26

I am running Jenkins inside a docker container. The simplest solution for me was to make a custom image that dynamically sets the GID, like:

FROM jenkins/jenkins:lts
...
CMD DOCKER_GID=$(stat -c '%g' /var/run/docker.sock) && \
    groupadd -for -g ${DOCKER_GID} docker && \
    usermod -aG docker jenkins && \
    sudo -E -H -u jenkins bash -c /usr/local/bin/jenkins.sh

See: https://github.com/jenkinsci/docker/issues/263

Alternatively you could launch jenkins with the following options:

-v /var/run/docker.sock:/var/run/docker.sock \
-u jenkins:$(getent group docker | cut -d: -f3)

This assumes your jenkins image has docker client installed. See: https://getintodevops.com/blog/the-simple-way-to-run-docker-in-docker-for-ci

Uturn

Answer 27

If you're running Jenkins inside a docker container and your Jenkins is linking to the host docker then you can fix that just by the Dockerfile below:

FROM jenkins/jenkins:2.179
USER root
RUN groupadd docker && usermod -a -G docker jenkins
USER jenkins 

Broadfaced

jenkins/jenkins image does not contain docker nor docker-cli. You need to install docker-cli or mount it from host. – Classy

Answer 28

sudo setfacl --modify user:(user name or ID):rw /var/run/docker.sock

Several times I tried to execute the command

sudo chmod 777 /var/run/docker.sock

but unfortunately, I have to do this every time when I'm logging in to ubuntu system. It doesn't require a restart and is more secure than usermod or chown. user ID is required when the user name only exists inside the container, but not on the host.

I hope that it will help you solve the problem.

Micronesian

Answer 29

check if ur docker is running sudo systemctl status docker

To check the error docker ps -a

Give Permission sudo usermod -aG docker ${USER} next command su - ${USER}

check again if it gives error docker ps -a

Semicentennial

Answer 30

I was getting problem that after restarting the ubuntu server docker was loosing the access if I have given the permission via sudo chmod 666 /var/run/docker.sock

Hence I needed to add my username (ubuntu) to the docker group via: sudo usermod -aG docker ubuntu

Subdivision

Answer 31

On the server where Jenkins is running, I used

sudo setfacl -m user:tomcat:rw /var/run/docker.sock

And then run each docker container with

-v /var/run/docker.sock:/var/run/docker.sock

Using setfacl seems a better option, and no "-u user" is needed. The containers then run as the same user that is running Jenkins. But I would appreciate any feedback from the security experts.

Duffer

Answer 32

use below dockerfile

FROM jenkins/jenkins

USER root

# Install Docker
RUN apt-get update && \
    apt-get -y install apt-transport-https \
    ca-certificates \
    curl \
    gnupg2 \
    software-properties-common && \
    curl -fsSL https://download.docker.com/linux/$(. /etc/os-release; echo "$ID")/gpg > /tmp/dkey; apt-key add /tmp/dkey && \
    add-apt-repository \
    "deb [arch=amd64] https://download.docker.com/linux/$(. /etc/os-release; echo "$ID") \
    $(lsb_release -cs) \
    stable" && \
    apt-get update && \
    apt-get -y install docker-ce


# Compose
RUN curl -L "https://github.com/docker/compose/releases/download/1.22.0/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose && chmod +x /usr/local/bin/docker-compose



RUN usermod -aG docker jenkins
RUN usermod -aG root jenkins

USER jenkins

Whitelaw

Answer 33

in my case it was just starting docker service :

sudo service docker start

Brownson

Answer 34

Change bellow ""your_user" to true user

echo "your_user ALL=(ALL) NOPASSWD: /usr/local/bin/docker, /usr/local/sbin/docker, /usr/bin/docker, /usr/sbin/docker, /bin/docker, /sbin/docker" > /etc/sudoers.d/sudo_docker

usermod -aG docker your_user

chmod 0660 /var/run/docker.sock

chown root:docker /var/run/docker.sock

Papal

Answer 35

when we run the Docker in Jenkins pipeline , the pipeline is run with jenkins user so we have to add Jenkin user into docker group , for add the user into docker group run below command

sudo usermod -a -G docker jenkins

after that logout form Jenkins and login into jenkins

it is work for me

Clevie

Answer 36

I am using Fedora 38 and my user is in the docker group, but I still got permission denied. The fix was to set ryuk.container.privileged = true in /home/myuser/.testcontainers.properties. There was no need to change permissions of /var/run/docker.sock.

Poultice

Answer 37

If someone is still facing the issue on their local machine(Ubuntu) then try below command:

sudo chmod 666 /var/run/docker.sock

Librarianship

Answer 38

often need a reboot to take effect on the new user group and user.

Prevent

Looks like a dangling comment - not an answer. – Classy

Answer 39

If you want to keep it simple, use fixdockergid on your Dockerfile.

Iain

Answer 40

In addition to adding the user to the docker group and trying everything mentioned in this thread, it took me a while to realize that I had to restart my terminal and then log back into the ec2 instance. It worked after that.

Thinskinned

Answer 41

I was able to make this work as well without having to change the permissions on the local unix socket /var/run/docker.sock. What I had to do was to enable tcp connections on the build agent node and then specify the docker host in the Jenkins cloud configuration.

Assuming that you are using a aws image, ssh into your build agent node(s) and enable tcp ports using the /etc/sysconfig/docker file

Add the -H tcp://127.0.0.1:2376 option.

# Additional startup options for the Docker daemon, for example:
# OPTIONS="--ip-forward=true --iptables=true"
# By default we limit the number of open files per container
OPTIONS="-H tcp:/127.0.0.1:2376 --default-ulimit nofile=1024:4096"

Make sure to restart the daemon using sudo service docker restart

Finally you need to tell Jenkins to use tcp by default using the DOCKER_HOST environment variable configured in the cloud nodes configuration. Note this is not a configuration in the Jenkins pipeline environment.

Navigate to Jenkins -> Manage Jenkins -> Manage Cloud And Nodes -> Some Configuration -> Node Properties -> Environment Variables

Then add your DOCKER_HOST environment variable.

NOTE: I am using Launch agents via ssh to make this work.

Trouvaille

This approach opens up a trivial remote root exploit on your system. – Eskill

Then use 127.0.0.1 instead of 0.0.0.0 – Trouvaille

Answer 42

Resolved by following steps: sudo groupadd docker sudo usermod -aG docker $USER newgrp docker

Verified by running docker run hello-world

Halinahalite

You can also try to run this command "sudo chmod 666 /var/run/docker.sock" – Halinahalite

Answer 43

Maybe you should run the docker with option "-u root" from the very beginning

At least that solved my problem

Exhortation

Then you may get files being created as user root. At least this is what happened to me, with Docker 18.06.1. – Wooded