What Docker Could Not Reach
Docker cannot access /var/run/docker.sock because your user lacks permission to the daemon socket or the socket ownership is wrong.
Read this as a precise clue about which part of the workflow broke first. Once you know the failing layer, the fix path gets much shorter.
Restore Docker daemon access
The fastest fixes here come from checking the immediate failing layer before you change anything unrelated. Make one correction at a time and re-test from the same environment.
On Linux, add your user to the docker group:sudo usermod -aG docker $USER (then log out/in or run newgrp docker).
As a quick test, run the same command with sudo (do not rely on this long-term).
Avoid chmod 666 /var/run/docker.sock unless you fully understand the security impact.
Check socket permissions:ls -la /var/run/docker.sock
If SELinux/AppArmor is enabled, review the policy denial logs.
Check the daemon endpoint and socket
Print groups with groups, and check daemon socket with stat /var/run/docker.sock.
Why It Happens
Usually this comes down to your user is not in the docker group (Linux), the Docker socket has restrictive permissions, or a security policy (SELinux/AppArmor) is blocking access.
Prove the Failing Environment Can Reach It
Re-run docker version without sudo and confirm the server info is shown, and retry the original command.
How Docker reaches the daemon
The Docker CLI is only a client. Most commands talk to the Docker daemon over a local socket or a remote API, and that control plane has to be healthy before Docker can do anything with images, containers, or volumes. When that path is broken, Docker fails immediately because it never gets far enough to inspect the image or run the container command you asked for.
Examples
Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock
Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: connect: permission deniedPrevent It From Coming Back
To prevent this, provision CI runners with correct docker group membership, on Linux, treat membership in the docker group as root-equivalent access and restrict it to trusted users, and avoid running Docker commands as root unless required by policy.