What causes "failed to open the raw stream connection: %w" in docker/cli?

Verify the daemon is up: 'docker version' / 'systemctl status docker'.

failed to open the raw stream connection

Error message

failed to open the raw stream connection: %w

What it means

Returned by the hidden 'docker system dial-stdio' command when the daemon Dialer() fails to establish a raw stream connection. dial-stdio proxies stdio to the daemon socket and is invoked internally (e.g. by Docker Desktop), not manually.

Solutions

Verify the daemon is up: 'docker version' / 'systemctl status docker'.
Check DOCKER_HOST and the active context resolve to a live socket.
Ensure the user can read the socket (docker group) or use sudo/context appropriately.

Example fix

# before: dial-stdio cannot reach the socket
docker system dial-stdio

# after: confirm daemon + socket then retry
systemctl status docker
ls -l /var/run/docker.sock
docker version  # sanity check

Defensive patterns

Strategy: validation

Validate before calling

// Confirm the daemon socket is reachable before dialing
if _, err := apiClient.Ping(ctx); err != nil {
    return fmt.Errorf("daemon unreachable: %w", err)
}

Type guard

func dialerReachable(ctx context.Context, dialer client.Dialer) bool {
	conn, err := dialer(ctx)
	if err != nil {
		return false
	}
	_ = conn.Close()
	return true
}

Try / catch

conn, err := dialer(ctx)
if err != nil {
    return fmt.Errorf("failed to open the raw stream connection: %w", err)
}
defer conn.Close()

Prevention

Verify the daemon is running before dial-stdio.
Check DOCKER_HOST / context and socket permissions.
Restart Docker Desktop / dockerd if the socket is stale.

When it happens

Trigger: The Dialer closure returned by the client cannot connect to DOCKER_HOST (socket missing, TCP unreachable, TLS handshake failure, permission denied on the unix socket). Triggered at dial_stdio.go:37-39.

Common situations: Daemon not running; DOCKER_HOST points at a stale/unreachable socket; socket file permissions; Docker Desktop VM not started; TLS misconfiguration for tcp:// endpoints.

Related errors

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/e45f963228775a29. Report an issue: GitHub.

Appendix: source

Thrown at cli/command/system/dial_stdio.go:39

		Args:   cli.NoArgs,
		Hidden: true,
		RunE: func(cmd *cobra.Command, args []string) error {
			return runDialStdio(cmd.Context(), dockerCLI)
		},
		ValidArgsFunction:     cobra.NoFileCompletions,
		DisableFlagsInUseLine: true,
	}
	return cmd
}

func runDialStdio(ctx context.Context, dockerCli command.Cli) error {
	ctx, cancel := context.WithCancel(ctx)
	defer cancel()

	dialer := dockerCli.Client().Dialer()
	conn, err := dialer(ctx)
	if err != nil {
		return fmt.Errorf("failed to open the raw stream connection: %w", err)
	}
	defer conn.Close()

	var connHalfCloser halfCloser
	switch t := conn.(type) {
	case halfCloser:
		connHalfCloser = t
	case halfReadWriteCloser:
		connHalfCloser = &nopCloseReader{t}
	default:
		return errors.New("the raw stream connection does not implement halfCloser")
	}

	stdin2conn := make(chan error, 1)
	conn2stdout := make(chan error, 1)
	go func() {
		stdin2conn <- copier(connHalfCloser, &halfReadCloserWrapper{os.Stdin}, "stdin to stream")
	}()

View on GitHub (pinned to 4f84911bfe)