← All posts

Two users, one Docker socket

Test permissions as the user that will run the command

Group membership does not apply to an already-running process.

Jenkins runs as its own system user. The permission that matters is the jenkins user's, not yours.

Test it the way Jenkins will:

sudo -u jenkins docker ps

If that fails with a socket permission error:

sudo usermod -aG docker jenkins
sudo systemctl restart jenkins

The restart is required. A running process does not pick up new group membership, which is why the fix often looks like it did not work.

Takeaway

sudo -u is the difference between testing your own access and testing the access that actually matters.