{"record":{"id":"84fab132228517e8","repo":"slimtoolkit/slim","slug":"insufficient-socket-permissions-can-read-v-can-w","errorCode":null,"errorMessage":"insufficient socket permissions (can_read=%v can_write=%v)","messagePattern":"insufficient socket permissions \\(can_read=(.+?) can_write=(.+?)\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/docker/dockerclient/client.go","lineNumber":229,"sourceCode":"\t\tclient, err = docker.NewClientFromEnv()\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tlog.Debug(\"dockerclient.New: new Docker client (env) [5]\")\n\n\tcase config.Host == \"\" && config.Env[EnvDockerHost] == \"\":\n\t\tsocketInfo, err := GetUnixSocketAddr()\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tif socketInfo == nil || socketInfo.Address == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"no unix socket found\")\n\t\t}\n\n\t\tif socketInfo.CanRead == false || socketInfo.CanWrite == false {\n\t\t\treturn nil, fmt.Errorf(\"insufficient socket permissions (can_read=%v can_write=%v)\", socketInfo.CanRead, socketInfo.CanWrite)\n\t\t}\n\n\t\tconfig.Host = socketInfo.Address\n\t\tclient, err = docker.NewVersionedClient(config.Host, config.APIVersion)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tif config.APIVersion != \"\" {\n\t\t\tclient.SkipServerVersionCheck = true\n\t\t}\n\n\t\tlog.Debug(\"dockerclient.New: new Docker client (default) [6]\")\n\n\tdefault:\n\t\treturn nil, ErrNoDockerInfo\n\t}\n","sourceCodeStart":211,"sourceCodeEnd":247,"githubUrl":"https://github.com/slimtoolkit/slim/blob/81940d17fa112cc678e32209214bcb2355cb3004/pkg/docker/dockerclient/client.go#L211-L247","documentation":"New() checks the discovered Docker socket's permissions (CanRead/CanWrite on socketInfo) before creating the client. If the current process cannot both read and write the unix socket, it returns this error naming the actual permission bits. A Docker API client needs read+write on the socket to send requests and receive responses.","triggerScenarios":"Calling New (directly or via OnCommand, OnPullCommand, OnPushCommand, etc.) when the socket file exists but the process lacks read or write permission on it — e.g. socket owned by root:docker with mode 0660 and the user is not in the docker group.","commonSituations":"Running a tool inside a container as non-root with a mounted docker.sock; user not added to the docker group; SELinux/AppArmor restricting socket access; mounting the socket read-only (:ro) into a container.","solutions":["Run the process as root or add your user to the docker group: sudo usermod -aG docker $USER, then re-login.","Mount the socket without :ro in containers: -v /var/run/docker.sock:/var/run/docker.sock (not :ro).","Check the socket mode: ls -l /var/run/docker.sock, and chmod/adjust group membership as appropriate.","Check for SELinux/AppArmor denials (audit logs) and adjust policy or use --privileged where acceptable."],"exampleFix":"// before\ndocker run --rm -u 1000 -v /var/run/docker.sock:/var/run/docker.sock:ro my-tool\n// after\ndocker run --rm -u 1000 --group-add $(stat -g %g /var/run/docker.sock) -v /var/run/docker.sock:/var/run/docker.sock my-tool","handlingStrategy":"validation","validationCode":"func canUseDockerSocket(path string) error {\n    if err := unix.Access(path, unix.R_OK); err != nil {\n        return fmt.Errorf(\"cannot read %s: %w\", path, err)\n    }\n    if err := unix.Access(path, unix.W_OK); err != nil {\n        return fmt.Errorf(\"cannot write %s: %w\", path, err)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"cli, err := dockerclient.New(cfg)\nif err != nil {\n    if strings.Contains(err.Error(), \"insufficient socket permissions\") {\n        return fmt.Errorf(\"add user to docker group or run as root, and mount socket rw: %w\", err)\n    }\n    return err\n}","preventionTips":["Add the running user to the docker group (usermod -aG docker) or run as root.","Mount the socket without :ro in containers.","Avoid restrictive SELinux/AppArmor profiles blocking socket access; audit denials.","Preflight the socket with a read/write access check before building the client."],"tags":["go","docker","permissions","socket"],"backgroundTag":"docker-socket-permission-denied","analyzedSha":"81940d17fa112cc678e32209214bcb2355cb3004","analyzedAt":"2026-08-31T23:06:12.682Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}