{"record":{"id":"2f9ab3c1098e6e7a","repo":"hashicorp/nomad","slug":"failed-to-open-docker-client-v","errorCode":null,"errorMessage":"failed to open docker client: %v","messagePattern":"failed to open docker client: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/docker/docklog/docker_logger.go","lineNumber":80,"sourceCode":"}\n\n// dockerLogger implements the DockerLogger interface\ntype dockerLogger struct {\n\tlogger hclog.Logger\n\n\tstdout  io.WriteCloser\n\tstderr  io.WriteCloser\n\tstdLock sync.Mutex\n\n\tcancelCtx context.CancelFunc\n\tdoneCh    chan interface{}\n}\n\n// Start log monitoring\nfunc (d *dockerLogger) Start(opts *StartOpts) error {\n\tclient, err := d.getDockerClient(opts)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to open docker client: %v\", err)\n\t}\n\n\tctx, cancel := context.WithCancel(context.Background())\n\td.cancelCtx = cancel\n\n\tgo func() {\n\t\tdefer close(d.doneCh)\n\n\t\tstdout, stderr, err := d.openStreams(ctx, opts)\n\t\tif err != nil {\n\t\t\td.logger.Error(\"log streaming ended with terminal error\", \"error\", err)\n\t\t\treturn\n\t\t}\n\n\t\tsinceTime := time.Unix(opts.StartTime, 0)\n\t\tbackoff := 0.0\n\n\t\tfor {","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/docker/docklog/docker_logger.go#L62-L98","documentation":"The docker log monitoring shim (dockerLogger.Start) opens its own Docker API client via getDockerClient; failure to construct/connect is wrapped as \"failed to open docker client\". The logger cannot stream container logs without this client, so log collection for the task fails at startup.","triggerScenarios":"Starting docker log collection when the daemon endpoint is unreachable, DOCKER_HOST/docker_endpoint is wrong, or the client can't be created from the passed DockerDriverConfig (host, TLS, auth options).","commonSituations":"Daemon restarted or stopped mid-task; socket permissions changed; Nomad running inside a container without the docker socket mounted; TLS certs rotated/removed from the configured paths.","solutions":["Confirm dockerd is running and 'docker ps' works as the user Nomad runs as.","Check the docker driver's docker_endpoint/TLS config that the logger inherits; fix wrong socket paths.","Ensure /var/run/docker.sock is mounted and accessible when Nomad itself is containerized.","Inspect the underlying wrapped error for connect-refused vs permission vs TLS failure and address accordingly."],"exampleFix":"// before\nDOCKER_HOST=\"tcp://127.0.0.1:2375\" (daemon listening only on socket)\n// after\nunset DOCKER_HOST  # or set\ndocker_endpoint = \"unix:///var/run/docker.sock\"","handlingStrategy":"validation","validationCode":"// Ensure the endpoint the logger will inherit is reachable before starting tasks\ncli, err := client.NewClientWithOpts(client.WithHost(dockerEndpoint), client.WithAPIVersionNegotiation())\nif err != nil || cli.Ping(ctx) != nil {\n    return fmt.Errorf(\"docker endpoint %q unavailable for log streaming\", dockerEndpoint)\n}","typeGuard":null,"tryCatchPattern":"if err := logger.Start(opts); err != nil {\n    // retry with backoff — daemon may be restarting\n    // then fail the task's log collection explicitly\n}","preventionTips":["Keep dockerd running under systemd with automatic restart.","Ensure socket permissions/group membership are stable across daemon restarts.","When Nomad is containerized, mount /var/run/docker.sock read-write for log streaming.","Monitor daemon health so log-shim failures correlate with daemon outages."],"tags":["docker","logging","connection","driver-setup"],"backgroundTag":"docker-daemon-unreachable","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}