{"record":{"id":"0ce5f5dafcab1be9","repo":"hyperledger/fabric","slug":"failed-to-ping-to-docker-daemon","errorCode":null,"errorMessage":"failed to ping to Docker daemon","messagePattern":"failed to ping to Docker daemon","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"core/container/dockercontroller/dockercontroller.go","lineNumber":85,"sourceCode":"type DockerVM struct {\n\tPeerID          string\n\tNetworkID       string\n\tBuildMetrics    *BuildMetrics\n\tHostConfig      *dcontainer.HostConfig\n\tClient          dcli.APIClient\n\tAttachStdOut    bool\n\tChaincodePull   bool\n\tNetworkMode     string\n\tPlatformBuilder PlatformBuilder\n\tLoggingEnv      []string\n\tMSPID           string\n}\n\n// HealthCheck checks if the DockerVM is able to communicate with the Docker\n// daemon.\nfunc (vm *DockerVM) HealthCheck(ctx context.Context) error {\n\tif _, err := vm.Client.Ping(ctx, dcli.PingOptions{}); err != nil {\n\t\treturn errors.Wrap(err, \"failed to ping to Docker daemon\")\n\t}\n\treturn nil\n}\n\nfunc (vm *DockerVM) createContainer(imageID, containerID string, args, env []string) error {\n\tlogger := dockerLogger.With(\"imageID\", imageID, \"containerID\", containerID)\n\tlogger.Debugw(\"create container\")\n\t_, err := vm.Client.ContainerCreate(context.Background(), dcli.ContainerCreateOptions{\n\t\tConfig: &dcontainer.Config{\n\t\t\tAttachStdout: vm.AttachStdOut,\n\t\t\tAttachStderr: vm.AttachStdOut,\n\t\t\tEnv:          env,\n\t\t\tCmd:          args,\n\t\t\tImage:        imageID,\n\t\t},\n\t\tHostConfig: vm.HostConfig,\n\t\tName:       containerID,\n\t})","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/container/dockercontroller/dockercontroller.go#L67-L103","documentation":"DockerVM.HealthCheck verifies the peer can reach the Docker daemon by issuing a client Ping. If the Ping call returns an error, the error is wrapped as 'failed to ping to Docker daemon', meaning the Docker endpoint is unreachable, misconfigured, or the daemon is down.","triggerScenarios":"Invoking HealthCheck (e.g. via the peer's health/healthz endpoint, TestHealthCheck) when vm.Client.Ping fails: Docker daemon not running, DOCKER_HOST pointing to a wrong/unreachable socket or host, TLS misconfiguration, or permission denied on /var/run/docker.sock.","commonSituations":"Peer started in a container without mounting the Docker socket; vm.endpoint set to tcp://docker-host:2375 with the daemon not listening or firewall blocking; docker daemon restarted/crashed; user not in the docker group (permission denied); TLS certs invalid for a TLS-enabled daemon.","solutions":["Verify the Docker daemon is running: 'docker info' on the peer host must succeed.","Check the configured vm.endpoint/DOCKER_HOST (core.yaml vm.endpoint) points to the correct socket or tcp address.","Fix permissions on /var/run/docker.sock (add peer user to docker group) or mount the socket into the peer container.","If using tcp/TLS, ensure the daemon listens on the exposed port, firewall rules allow it, and TLS certs match.","Restart the Docker daemon or the peer after fixing the connection, then re-run the healthz check."],"exampleFix":"# before (docker daemon unreachable)\nvm.endpoint = \"tcp://127.0.0.1:2375\"   # daemon not listening\n\n# after: use the local socket that the daemon actually serves\n# core.yaml\nvm:\n  endpoint: unix:///var/run/docker.sock","handlingStrategy":"retry","validationCode":"// check connectivity before relying on Docker VM\nconn, err := net.Dial(\"unix\", \"/var/run/docker.sock\")\nif err != nil {\n\treturn errors.New(\"docker socket not reachable: fix DOCKER_HOST/endpoint first\")\n}\nconn.Close()","typeGuard":"func dockerReachable(ctx context.Context, cli *client.Client) bool {\n\t_, err := cli.Ping(ctx, dcli.PingOptions{})\n\treturn err == nil\n}","tryCatchPattern":"err := vm.HealthCheck(ctx)\nif err != nil {\n\tif strings.Contains(err.Error(), \"failed to ping to Docker daemon\") {\n\t\t// retry with backoff, then surface config guidance\n\t\terr2 := retry.Do(3, time.Second, func() error { return vm.HealthCheck(ctx) })\n\t\tif err2 != nil {\n\t\t\treturn errors.Wrap(err, \"docker daemon unreachable: check vm.endpoint/DOCKER_HOST and daemon status\")\n\t\t}\n\t\treturn nil\n\t}\n\treturn err\n}","preventionTips":["Verify 'docker info' works as the same user that runs the peer","Mount /var/run/docker.sock into the peer container or point vm.endpoint at a reachable tcp daemon","Align TLS certs with a TLS-enabled daemon and open firewall ports for tcp endpoints","Monitor the peer /healthz endpoint to catch daemon outages early","Keep Docker daemon under a restart policy (systemd/socket activation) so it recovers automatically"],"tags":["docker","network","health-check","hyperledger-fabric","daemon"],"backgroundTag":"docker-daemon-unreachable","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}