Cannot connect to the Docker daemon — 5 Reasons and How to Diagnose Each

Symptom: every docker command gets rejected

Cannot connect to the Docker daemon at unix:///var/run/docker.sock.
Is the docker daemon running?

One-line diagnosis: the docker CLI client is alive, but the dockerd daemon it talks to is not. The client reaches the daemon through a Unix socket (or TCP/SSH); if nothing answers there, this is the error. Note the difference from permission denied — that one means "the socket exists but you may not touch it"; this one means "the socket doesn't exist or nobody is behind it".

Five causes, ranked by frequency

1. The daemon isn't running (most common on Linux servers)

systemctl status docker
# ● docker.service - Docker Application Container Engine
#   Active: inactive (dead)   ← not running

sudo systemctl start docker
sudo systemctl enable docker   # and start it on boot while you're at it

Forgotten enable after a reboot, a service killed by an upgrade, or the OOM killer taking down dockerd — they all land here. Check the status before anything else.

2. Docker Desktop isn't open (macOS / Windows)

With Docker Desktop, the daemon runs inside a VM, but the CLI is separate — the App can be closed while the CLI still exists, producing the identical error. Start Docker Desktop and wait for the whale icon to settle.

3. WSL2: the distro integration got switched off

Using docker inside WSL2 on Windows requires Docker Desktop's integration for that distro (Settings → Resources → WSL Integration). An upgrade that resets the toggle is a frequent visitor:

# Restart WSL, then retry
wsl --shutdown

4. A broken daemon.json prevents the daemon from starting

When /etc/docker/daemon.json has a syntax error or an invalid field, systemctl start docker appears to succeed but actually fails. Get the real reason:

journalctl -u docker --since "10 minutes ago" | tail -20
# Common output: unable to configure the Docker daemon with file ...: invalid character

Fix the JSON (note: no trailing comma after the last key) and restart. This is the classic trap when configuring registry mirrors or log rotation.

5. Wrong docker context / missing rootless env var

docker context ls
# NAME       DESCRIPTION                          DOCKER ENDPOINT
# default *  Docker Engine at unix:///var/run/...   ← asterisk = current context

If the asterisk sits on a remote or stale context, even a perfectly healthy local daemon won't be reached: docker context use default.

Under rootless mode the socket lives in your user directory (/run/user/<uid>/docker.sock); a fresh SSH session without export DOCKER_HOST=unix:///run/user/$(id -u)/docker.sock will probe a system socket that doesn't exist.

The diagnostic route (two minutes, top to bottom)

# 1. Service status
systemctl status docker

# 2. Not active? Read the logs for the cause of death
journalctl -u docker -n 30

# 3. Service fine but still failing? Check socket and context
ls -l /var/run/docker.sock
docker context ls

# 4. Everything normal? Ask the daemon directly
sudo curl -s --unix-socket /var/run/docker.sock http://localhost/version | head -c 200

If step 4 returns JSON, the daemon is alive — the problem is your user's permission. See: Docker socket permission denied.

Telling the neighboring errors apart

| Error | Meaning | Guide | |---|---|---| | Cannot connect to the Docker daemon | daemon not running / unreachable | this post | | permission denied ... docker.sock | socket exists, your user lacks access | permissions post | | no space left on device | daemon alive, disk full | disk cleanup post | | port is already allocated | daemon alive, port taken | port conflict post |

Checklist

1. systemctl status docker — is the service active?
2. macOS/Windows — is Docker Desktop running? Is WSL integration on?
3. journalctl -u docker -n 30 — any daemon.json syntax errors?
4. docker context ls — is the asterisk on default?
5. rootless — is DOCKER_HOST set for this session?

Provided by ToolVault. Related tools: Dockerfile Generator, Linux Cheatsheet. Related reading: Docker socket permissions, Port already in use (EADDRINUSE). See the homepage for more developer tools.