title: Pycharm Docker Unix / TCP socket (with unix:///var/run/docker.sock): Permission Denied
body: <p>I get a Permission Denied error when trying to setup Docker in PyCharm Professional edition. I'm on Debian Jessie (BunsenLabs).</p>
  
  <pre><code>Cannot connect: io.netty.channel.AbstractChannel$AnnotatedConnectException: connect(..) failed: Permission denied: /var/run/docker.sock
  caused by: java.net.ConnectException: connect(..) failed: Permission denied
  </code></pre>
  
  <p>It happens with both the default settings (using Unix socket) and with the TCP socket, Engine API URL = <code>unix:///var/run/docker.sock</code> (does it make sense?).</p>
  
  <p>If we look at the permissions on the socket:</p>
  
  <pre><code>$ ls -l /var/run/docker.sock
  srw-rw---- 1 root docker 0 Jul  5 11:18 /var/run/docker.sock
  </code></pre>
  
  <p>We see that its owned by root and the docker group.</p>
  
  <p>So I tried to add my user to the docker group (with <code>sudo usermod -a -G docker USERNAME</code>), and restarted the Docker service (with <code>sudo service docker restart</code>), but it still does not work.</p>
  
  <p>One way to allow PyCharm to use the socket is to run it with root permissions, i.e. <code>sudo pycharm</code>, but I would like to avoid this. I was also able to fix this by setting read and write permissions for others on the socket (<code>sudo chmod o+rw /var/run/docker.sock</code>) but now everybody can use Docker on that machine without admin privilege.</p>
  
  <p>What is the most secure way to allow PyCharm to connect to the Docker socket?</p>
  
  <p>Also, please note that Docker works fine on the command-line. Before the quick-and-dirty-fix (<code>chmod o+rw</code>), I had to use <code>sudo docker</code>, and had updated <code>/etc/sudoers</code> to not type the password for this command. Now it works even without <code>sudo</code>. It does not feel secure, but it's a development machine so if there is no other solution, I'll keep it like that.</p>
  
  <p><strong>EDIT:</strong> I am adding additional, important information.</p>
  
  <p>First, adding my user in the Docker group was indeed the way to go. The thing is that when using <code>sudo usermod</code>, changes are not immediately reflected for the user account you are using. <strong>You need to log out and log in again to refresh the system.</strong> More information in this post and answer: <a href="https://stackoverflow.com/questions/7537197/add-user-to-group-but-not-reflected-when-run-id#7537275">Add user to group but not reflected when run &quot;id&quot;</a>.</p>
  
  <p>Secondly, adding yourself in the Docker group <strong>allows privilege escalation!</strong> Any user being able to run <code>docker</code> without <code>sudo</code> (and therefore without typing a password) will also be able to run a container with the root of the system mounted in a volume: <code>docker run -v /:/host_root -it --rm ubuntu /bin/bash</code>. Since you are root in the container, it means you can manipulate the host system <strong>as if you were root on the host</strong>. Please take this into consideration before adding users in the docker group.</p>