permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock — your Linux user may not open the socket the Docker Engine listens on. Add the user to the docker group with sudo usermod -aG docker <user>, start a new login or run newgrp docker, and the same command works.

Docker 29.9.2 shortens the line to permission denied while trying to connect to the docker API at unix:///var/run/docker.sock. The 28.5.2 and 27.5.1 clients printed the longer form with a Get "http://%2Fvar%2Frun%2Fdocker.sock/..." URL and connect: permission denied at the end. Same cause, same fix, whichever wording you have.

The error

$ id
uid=1000(maria) gid=1000(maria) groups=1000(maria),27(sudo)
$ docker ps
permission denied while trying to connect to the docker API at unix:///var/run/docker.sock
$ ls -l /var/run/docker.sock
srw-rw---- 1 root docker 0 Oct 30 02:50 /var/run/docker.sock

A second test user, also outside the group, with the 28.5.2 client:

$ /tmp/fix7-old/x/usr/bin/docker ps
permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.51/containers/json": dial unix /var/run/docker.sock: connect: permission denied

Why it happens

The docker command is only a client. Every command becomes an HTTP request to the engine, dockerd, over the Unix socket /var/run/docker.sock. The socket belongs to root and the group docker with mode srw-rw----: read and write for the owner and the group, nothing for anyone else. The docker-ce package creates the group but puts nobody in it, so an ordinary user's first docker ps is refused by the kernel before the engine sees the request. sudo docker ps worked at once in the test, because root may open anything.

Joining the group is not the end of it. usermod changes /etc/group at once, but a running shell keeps the group list it started with: straight after usermod, id still showed no docker group and docker ps was still refused.

The fix

$ sudo usermod -aG docker maria
$ newgrp docker
$ id
uid=1000(maria) gid=989(docker) groups=989(docker),27(sudo),1000(maria)
$ docker ps
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES

newgrp docker starts a shell that has the group, which fixes the current terminal. A new login fixes every later session: in WSL, close the terminal and open the distribution again (the second session in the test showed 989(docker) without newgrp); on a Linux desktop, log out and back in.

Know what the group means before you add anyone. A member can start a container that mounts the host's root file system, so the group is as good as root. In the test, maria could not read /etc/shadow directly, then read it through a container without sudo: 

$ head -1 /etc/shadow
head: cannot open '/etc/shadow' for reading: Permission denied
$ docker run --rm --network none -v /:/host alpine head -1 /host/etc/shadow
root:*:20704:0:99999:7:::

Add only users you would trust with sudo, and keep sudo docker as the stopgap on machines where you would not.

How it was reproduced

A throwaway WSL distribution made with wsl --install Ubuntu-24.04 --name fix7-dk --no-launch on WSL 2.7.10 (Ubuntu 24.04.5 LTS, systemd on), with docker-ce 29.9.2 and containerd.io 2.4.2 installed from Docker's own apt repository, and the error captured as the first command of an ordinary user. The test engine ran with bridge networking and iptables off so that it left nothing in the network WSL distributions share; the socket does not depend on either. The older clients were extracted from Docker's 28.5.2 and 27.5.1 packages without installing them. maria, the second user and the fix7- names are the test's own, and the distribution was unregistered afterwards.

Frequently asked

How do I fix permission denied while trying to connect to the Docker daemon socket?
Add your user to the docker group with sudo usermod -aG docker and your user name, then start a new login or run newgrp docker. The socket is open only to root and the docker group.
Why does docker still say permission denied after usermod?
A running shell keeps the groups it started with. If id does not list docker, run newgrp docker or open a new session; in WSL, close the terminal and open the distribution again.
Is adding my user to the docker group safe?
It gives the user root-level control of the machine, because a container can mount the host file system. In the test, an ordinary user in the group read /etc/shadow through a container. Add only users you would trust with sudo.

More decoded errors in the Fixes category. Once the group is right but the engine is stopped, the message changes to Cannot connect to the Docker daemon. To use Docker Desktop's engine from WSL instead of installing one, see docker could not be found in this WSL 2 distro.