{"record":{"id":"8f4b27d47aceebb9","repo":"hashicorp/nomad","slug":"failed-to-connect-to-docker-daemon-s","errorCode":null,"errorMessage":"failed to connect to docker daemon: %s","messagePattern":"failed to connect to docker daemon: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"drivers/docker/network.go","lineNumber":33,"sourceCode":"const (\n\t// dockerNetSpecLabelKey is the label added when we create a pause\n\t// container to own the network namespace, and the NetworkIsolationSpec we\n\t// get back from CreateNetwork has this label set as the container ID.\n\t// We'll use this to generate a hostname for the task in the event the user\n\t// did not specify a custom one. Please see dockerNetSpecHostnameKey.\n\tdockerNetSpecLabelKey = \"docker_sandbox_container_id\"\n\n\t// dockerNetSpecHostnameKey is the label added when we create a pause\n\t// container and the task group network include a user supplied hostname\n\t// parameter.\n\tdockerNetSpecHostnameKey = \"docker_sandbox_hostname\"\n)\n\nfunc (d *Driver) CreateNetwork(allocID string, createSpec *drivers.NetworkCreateRequest) (*drivers.NetworkIsolationSpec, bool, error) {\n\t// Initialize docker API clients\n\tdockerClient, err := d.getDockerClient()\n\tif err != nil {\n\t\treturn nil, false, fmt.Errorf(\"failed to connect to docker daemon: %s\", err)\n\t}\n\n\tif err := d.pullInfraImage(allocID); err != nil {\n\t\treturn nil, false, err\n\t}\n\n\tconfig, err := d.createSandboxContainerConfig(allocID, createSpec)\n\tif err != nil {\n\t\treturn nil, false, err\n\t}\n\n\tspecFromContainer := func(id string, net *container.NetworkSettings, hostname string) *drivers.NetworkIsolationSpec {\n\t\tspec := &drivers.NetworkIsolationSpec{\n\t\t\tMode: drivers.NetIsolationModeGroup,\n\t\t\tPath: net.SandboxKey,\n\t\t\tLabels: map[string]string{\n\t\t\t\tdockerNetSpecLabelKey: id,\n\t\t\t},","sourceCodeStart":15,"sourceCodeEnd":51,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/docker/network.go#L15-L51","documentation":"CreateNetwork needs a Docker API client to set up the allocation's network isolation (pause container / netns). If getDockerClient cannot establish a connection to the Docker daemon, the allocation network creation is aborted with this wrapped error containing the underlying connection failure.","triggerScenarios":"Calling Driver.CreateNetwork(allocID, createSpec) when d.getDockerClient() fails: the Docker daemon is not running, DOCKER_HOST points at an unreachable socket/host, or the daemon socket is not accessible.","commonSituations":"Docker service stopped or not installed on the client host; misconfigured DOCKER_HOST (wrong tcp:// address or missing unix socket); the Nomad client lacks permission on /var/run/docker.sock; remote Docker daemon unreachable through TLS/network.","solutions":["Verify the Docker daemon is running (systemctl status docker / docker info)","Check the client's docker plugin configuration (docker.endpoint / DOCKER_HOST) points to a reachable daemon socket or address","Fix filesystem permissions on /var/run/docker.sock for the Nomad agent user","If using a remote daemon, verify network connectivity and TLS certificates"],"exampleFix":"# before\nDOCKER_HOST=\"\"\n# after\nDOCKER_HOST=\"unix:///var/run/docker.sock\"","handlingStrategy":"try-catch","validationCode":"// before creating networks, probe the daemon\ncli, err := client.NewClientWithOpts(client.FromEnv)\nif err != nil || cli.Ping(ctx) != nil {\n    return errors.New(\"docker daemon unreachable; check docker.endpoint and daemon status\")\n}","typeGuard":"func isDaemonConnErr(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"failed to connect to docker daemon\")\n}","tryCatchPattern":"spec, created, err := driver.CreateNetwork(allocID, req)\nif isDaemonConnErr(err) {\n    // transient infra issue: retry with backoff after checking daemon\n    return retryAfterDockerHealthCheck(ctx, err)\n}","preventionTips":["Verify docker info works on every client before joining the cluster","Pin docker.endpoint explicitly in client config rather than relying on env","Monitor docker.service health with systemd or a node exporter","Ensure the Nomad user has group membership/ACLs for docker.sock"],"tags":["docker","network","daemon-connection"],"backgroundTag":"docker-daemon-unreachable","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}