Diag: docker socket permission denied, fix group membership not chmod

Diag: permission denied on the Docker socket

Symptom (exact): agent log: permission denied opening /var/run/docker.sock. Container metrics missing, Docker check failing, everything else fine.

Likely causes: (a) agent user not in the docker group (host install), (b) socket not mounted into the agent container, (c) socket mounted read-only or with wrong perms.

Confirm:

1. Host: groups dd-agent (or the agent user). Missing docker is the answer.
2. As the agent user, try reading the socket. Permission denied reproduces it exactly.
3. Container: inspect the agent container mounts. No /var/run/docker.sock mount means the agent cannot see Docker at all, different symptom (no error, just no containers).

Fix:

• Host: add the agent user to the docker group and restart the agent (group membership needs a fresh process).
• Container: mount the socket into the agent container per the docs.
• Do not chmod 777 the socket. Group membership is the fix; world-writable docker socket is a security incident.

Verify: Docker check OK in agent status, containers appear in Infrastructure, Containers. If you use containerd/crio instead of Docker, the socket path differs: configure the right runtime socket, not the Docker one.

The ECS and container docs require the agent container to access the Docker socket to discover containers; host installs need the dd-agent user in the docker group for the same. Verified against live docs 2026-09-26.