criticalFoundationSymptom-first#daemon#dockerd#socket#docker-host#systemd

Cannot connect to the Docker daemon — daemon stopped or DOCKER_HOST wrong

Cannot connect to the Docker daemon at unix:///var/run/docker.sock — Is the docker daemon running?

Likely source:availabilityconfiguration

Focused incident mode — strips away everything but this runbook.

Symptoms

  • Cannot connect to the Docker daemon at unix:///var/run/docker.sock — Is the docker daemon running?
  • docker ps fails with connection refused
  • All docker commands fail with same daemon error

On systems with rootless Docker or Docker Desktop, the socket path may differ (e.g., /run/user/1000/docker.sock). Check DOCKER_HOST first.

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Docker service status

    systemctl status docker

  • DOCKER_HOST environment variable

    env | grep DOCKER

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • systemctl status docker shows inactive (dead) or failed
  • /var/run/docker.sock does not exist

Confirm before fixing

systemctl is-active docker
READ

Check if the service is active

Expected: active

Fix

sudo systemctl start docker && sudo systemctl enable docker
CHANGE

Start and enable the Docker daemon

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
systemctl status docker
READ

Check daemon service state

2
ls -la /var/run/docker.sock
READ

Verify socket exists and permissions

3
env | grep -i DOCKER
READ

Check DOCKER_HOST override

4
sudo systemctl start docker && sudo systemctl enable docker
CHANGE

Start and persist the Docker daemon

5
groups <USER> | grep docker
READ

Confirm user group membership

Prevention

  • Enable the Docker daemon on boot: systemctl enable docker.
  • Add deployment users to the docker group during provisioning.
  • Use systemd socket activation for environments with strict socket permissions.
  • Document the expected DOCKER_HOST and socket path in the runbook.

Related runbooks

Same stack, same failure family — worth a skim.

Container has no internet access — DNS or network broken insidecritical

ping: Temporary failure in name resolution inside the container

DockerIntermediate3 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.