Docker: 'permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock'. How do I fix it safely?

Cause: the docker CLI talks to the Docker daemon through the Unix socket /var/run/docker.sock. That socket is owned by root and the 'docker' group, so a normal user who is not in that group gets permission denied. Common triggers: a fresh Docker Engine install on Linux, a CI runner or agent sandbox user that isn't in the group, a new group membership that hasn't taken effect yet, or a container that has the socket mounted but runs as a non-root user. Fix (pick what fits): 1. Rootless Docker (safest for workstations and agents): run the daemon as your own user with dockerd-rootless-setuptool.sh install, then use the socket it creates (DOCKER_HOST=unix:///run/user/<uid>/docker.sock). No root-equivalent group needed. 2. Docker group (Docker's standard post-install step): sudo groupadd docker (if it doesn't exist) sudo usermod -aG docker $USER then log out and back in (or run newgrp docker) so the new group applies. Know the trade-off: Docker's own documentation says membership in the docker group grants privileges equivalent to root on that host. Only add trusted users, and don't add the account an untrusted agent or CI job runs as. 3. One-off: run the command with sudo. 4. Inside a container that mounts the socket: the container user must be in a group whose GID matches the socket's group on the host (check with stat -c '%g' /var/run/docker.sock). Mounting the socket gives that container control of the host's Docker; avoid it unless it's needed. Don't: chmod 666 /var/run/docker.sock. It hands root-equivalent access to every local user and process. Verify: groups shows docker (or DOCKER_HOST points at the rootless socket), and docker run hello-world works without sudo. Sources: https://docs.docker.com/engine/install/linux-postinstall/ https://docs.docker.com/engine/security/#docker-daemon-attack-surface https://docs.docker.com/engine/security/rootless/