Permission denied to Docker daemon socket at unix:///var/run/docker.sock

Question

I have this Dockerfile:

FROM chekote/gulp:latest 

USER root
RUN apt-get update \
      && apt-get upgrade -y \
      && apt-get install -y sudo libltdl-dev

ARG dockerUser='my-user-name';
ARG group='docker';

# crate group if not exists
 RUN if ! grep -q -E "^$group:" /etc/group; then groupadd $group; fi

# create user if not exists
 RUN if ! grep -q -E "^$dockerUser:" /etc/passwd; then useradd -c 'Docker image creator' -m -s '/bin/bash' -g $group $dockerUser; fi

# add user to the group (if it was present and not created at the line above)
 RUN usermod -a -G ${group} ${dockerUser}

# set default user that runs the container
 USER ${dockerUser}

That I build this way:

docker build --tag my-gulp:latest .

and finally run by script this way:

#!/bin/bash

image="my-gulp:latest";
workDir='/home/gulp/project';

docker run -it --rm  \
-v $(pwd):${workDir} \
-v /var/run/docker.sock:/var/run/docker.sock \
-v /usr/bin/docker:/usr/bin/docker \
${image} /bin/bash

that logs me into the docker container properly but when I want to see images

docker images

or try to pull image

docker pull hello-world:latest

I get this error:

Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.38/images/json: dial unix /var/run/docker.sock: connect: permission denied

How to create docker image from chekote/gulp:latest so I can use docker inside it without the error?

Or maybe the error is because of wrong docker run command?

i am not 100% sure, but try --privileged tag while running the container. it may work. — scipsycho
@Code Bling This isn't inception, the gulp container does not run docker's containers inside of it but uses host's docker to start other docker's containers that at the same level as gulp container. The docker commands are going from gulp container outwards to the host that runs other containers, so from the host's point of view it is similar to running containers by gulp that is not containerized. Reason: you can easily switch between gulp versions (eg 3.x and 4.x) just by using different containers even there is no gulp at host at all. — Jimmix

David Maze David Maze · Accepted Answer · 2018-11-03T07:47:09

The permission matching happens only on numeric user ID and group ID. If the socket file is mode 0660 and owned by user ID 0 and group ID 32, and you're calling it as a user with user ID 1000 and group IDs 1000 and 16, it doesn't matter if one /etc/group file names gid 32 as docker and the other one names gid 16 the same; the numeric gids are different and you can't access the file. Also, since the actual numeric gid of the Docker group will vary across systems, this isn't something you can bake into the Dockerfile.

Many Docker images just run as root; if they do, they can access a bind-mounted Docker socket file regardless of its permissions.

If you run as a non-root user, you can use the docker run --group-add option to add a (numeric) gid to the effective user; it doesn't specifically need to be mentioned in the /etc/groups file. On a Linux host you might run:

docker run --group-add $(stat -c '%g' /var/run/docker.sock) ...

You wouldn't usually install sudo in a Dockerfile (it doesn't work well for non-interactive programs, you usually don't do a whole lot in interactive shells because of the ephemeral nature of containers, and you can always docker exec -u 0 to get a root shell) though installing some non-root user is often considered a best practice. You could reduce the Dockerfile to

FROM node:8
RUN apt-get update
# Trying to use the host's `docker` binary may not work well
RUN apt-get install -y docker.io
# Install the single node tool you need
RUN npm install -g gulp
# Get your non-root user
RUN adduser myusername
# Normal Dockerfile bits
WORKDIR ...
COPY ...
RUN gulp
USER myusername
CMD ["npm", "run", "start"]

(That Docker base image has a couple of things that don't really match Docker best practices, and doesn't seem to be updated routinely; I'd just use the standard node image as a base and add the one build tool you need on top of it.)

Permission denied to Docker daemon socket at unix:///var/run/docker.sock

5 Answers