How to Fix Docker on Linux Server? Docker Recovery Guide

To fix Docker on a Linux server, start by verifying the Docker daemon is running, reading logs, checking disk space and permissions, then resolve common culprits: daemon.json syntax, firewall and iptables rules, storage driver errors, DNS, and cgroups. Restart services, prune unused data, or reinstall Docker as a last resort.

If you’re searching for how to fix Docker on Linux server, this guide gives you a clear, step-by-step troubleshooting workflow that covers service status, logs, permissions, storage drivers, firewalls, DNS, cgroups, and safe cleanup. I’ll also share real-world fixes I use on production servers to get Docker stable fast.

Quick Answer: Fix Docker on Linux Server in 10 Steps

• Check Docker service: status, start, enable at boot.
• Read logs with journalctl to spot errors early.
• Verify socket permissions and add your user to the docker group.
• Validate /etc/docker/daemon.json syntax.
• Check disk space/inodes and storage driver (overlay2).
• Fix network: iptables/UFW/firewalld, DNS, and IP forwarding.
• Resolve cgroups v1/v2 and kernel module issues.
• Prune unused images/volumes to free space.
• Restart Docker and containerd cleanly.
• As a last resort, back up and reinstall Docker.

Diagnose First: Is the Docker Daemon Running?

Check service status and enable it

# Check status
sudo systemctl status docker

# Start and enable on boot
sudo systemctl start docker
sudo systemctl enable docker

# If containerd is required but down
sudo systemctl status containerd
sudo systemctl start containerd

If Docker won’t start, the status output typically references a root cause (storage driver failure, invalid config, missing kernel module, or permission issues). Capture the error message to guide your fix.

Read Docker logs for clear errors

# Review last hour of logs
sudo journalctl -u docker --since -1h --no-pager

# Full boot logs (if it dies during boot)
sudo journalctl -b -u docker --no-pager

Look for lines mentioning overlay2, daemon.json, iptables, cgroup, DNS, or “Cannot connect to the Docker daemon.” These keywords map to common fixes below.

Fix socket permissions and user access

# Is the socket present and permissions correct?
ls -l /var/run/docker.sock

# If you see "permission denied", add your user to the docker group
sudo usermod -aG docker $USER
# Apply group without logout (current shell only)
newgrp docker

# Test
docker info

In secure environments, you may prefer sudo-only access to Docker. If you intentionally avoid the docker group, always run docker commands with sudo.

Common Errors and Reliable Fixes

“Cannot connect to the Docker daemon”

• Ensure the service is running: systemctl status docker.
• Fix socket permissions or add your user to the docker group.
• If using rootless Docker, ensure dockerd-rootless-setuptool.sh was run and your environment variables are set.
• Verify DOCKER_HOST is not pointing to a wrong socket or TCP endpoint.

Docker fails after upgrade (stuck or won’t start)

# Validate daemon.json (must be valid JSON)
sudo cat /etc/docker/daemon.json | jq .  # or use python -m json.tool

# Remove stale PID file if present
sudo rm -f /var/run/docker.pid

# Reload units and restart
sudo systemctl daemon-reload
sudo systemctl restart docker
sudo systemctl status docker

Compare your Docker version with containerd. A mismatch can break startup. If logs mention containerd, upgrade both from the same repo (Docker Engine or distro packages) to keep them compatible.

Storage driver and disk space (overlay2)

# Check disk space and inodes
df -h
df -i

# See Docker space usage
docker system df

# Prune unused data (confirm prompts)
docker system prune
docker image prune -a
docker volume prune
docker network prune

If overlay2 errors appear, ensure your kernel has the overlay module loaded and the filesystem supports d_type. XFS without d_type causes overlay2 failures.

# Load required modules
sudo modprobe overlay
sudo modprobe br_netfilter

# Check XFS d_type (should be ftype=1)
xfs_info /var/lib/docker 2>&1 | grep ftype

If ftype=0, migrate Docker’s data root to a partition with ftype=1 (or ext4), then restart Docker. Avoid devicemapper legacy unless you understand its implications.

Network and DNS: can’t pull images or containers can’t resolve

• Verify outbound connectivity and DNS on the host: dig or nslookup.
• Override DNS inside Docker if host resolv.conf is unusual (e.g., systemd-resolved).
• Allow IP forwarding and ensure FORWARD policy isn’t DROP.
• Align Docker iptables with your firewall (UFW, firewalld, nftables).

# Example daemon.json with DNS and log limits
sudo tee /etc/docker/daemon.json >/dev/null <<'JSON'
{
  "dns": ["1.1.1.1","8.8.8.8"],
  "log-driver": "json-file",
  "log-opts": { "max-size": "10m", "max-file": "3" }
}
JSON

sudo systemctl restart docker

# Enable IP forwarding
sudo sysctl -w net.ipv4.ip_forward=1
# Persist settings
echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-docker-ipforward.conf
sudo sysctl --system

If UFW is active, set DEFAULT_FORWARD_POLICY=“ACCEPT” in /etc/default/ufw and allow Docker’s bridge subnet or disable Docker’s iptables management and write your own rules.

Firewalls: UFW, firewalld, nftables conflicts

# UFW: forward policy and bridge allowance
sudo sed -i 's/^DEFAULT_FORWARD_POLICY=.*/DEFAULT_FORWARD_POLICY="ACCEPT"/' /etc/default/ufw
sudo ufw allow 2375/tcp  # only if you intentionally expose (not recommended without TLS)
sudo ufw reload

# firewalld: trust docker zone or allow masquerade
sudo firewall-cmd --permanent --zone=trusted --add-interface=docker0
sudo firewall-cmd --permanent --add-masquerade
sudo firewall-cmd --reload

# If nftables is default, ensure iptables-legacy is used when required
sudo update-alternatives --config iptables  # choose legacy if Docker expects it
sudo systemctl restart docker

Prefer not exposing the Docker daemon over TCP unless you enable TLS. Use a socket or SSH tunnel for remote management.

cgroups v2 incompatibility and kernel issues

• Modern Docker and containerd support cgroups v2. Update both if you’re on older releases.
• If you must revert to cgroups v1 temporarily, add the kernel parameter systemd.unified_cgroup_hierarchy=0 and reboot.
• Ensure required modules are present: overlay, br_netfilter.

# Quick module check
lsmod | egrep 'overlay|br_netfilter'
sudo modprobe overlay br_netfilter

Safely Clean Up Docker to Free Space

Excess images, stopped containers, dangling volumes, and large logs commonly break Docker with no space left on device or inode exhaustion. Clean up deliberately.

# Review space usage first
docker system df
docker image ls --digests
docker volume ls

# Remove everything unused (interactive)
docker system prune
docker system prune -a  # also removes unused images
docker volume prune
docker network prune

For production, implement log rotation and avoid unbounded container logs. The example daemon.json above caps log size and files.

Validate Configuration: daemon.json and systemd

Invalid JSON or conflicting options in /etc/docker/daemon.json will stop Docker from starting. Keep it minimal and validate after changes.

# Validate config
sudo jq . /etc/docker/daemon.json

# After editing, reload and restart
sudo systemctl daemon-reload
sudo systemctl restart docker
sudo systemctl status docker

If you modified the systemd unit, consider using a drop-in override instead of editing the main file. This avoids breaking upgrades.

# Create a drop-in and set resource limits or startup dependencies
sudo systemctl edit docker
# Then:
sudo systemctl daemon-reload
sudo systemctl restart docker

Last Resort: Reset or Reinstall Docker

When the installation is deeply corrupted, back up and reinstall. Preserve or move /var/lib/docker if you need to keep images and volumes.

# Stop services
sudo systemctl stop docker containerd

# Optional: back up Docker data
sudo rsync -aHAX --info=progress2 /var/lib/docker/ /backup/docker-$(date +%F)/

# Debian/Ubuntu: remove and install cleanly
sudo apt-get purge -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo rm -rf /var/lib/docker /var/lib/containerd
sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# RHEL/CentOS/Rocky/Alma
sudo dnf remove -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo rm -rf /var/lib/docker /var/lib/containerd
sudo dnf install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

sudo systemctl enable --now docker
docker info

Best Practices to Prevent Future Docker Outages

• Pin compatible versions of Docker and containerd; upgrade during maintenance windows.
• Keep kernel updated and ensure overlay and br_netfilter modules load at boot.
• Apply log rotation and prune schedules to prevent disk exhaustion.
• Use a dedicated filesystem with XFS ftype=1 or ext4 for /var/lib/docker.
• Document firewall rules; explicitly allow IP forwarding and NAT.
• Monitor docker.service, disk, inodes, and error logs via your observability stack.
• Avoid editing unit files directly; use systemd drop-ins for overrides.
• Secure the daemon: don’t expose it over TCP without TLS; prefer the Unix socket.

Need hands-free reliability? On YouStable VPS or Dedicated Servers, our support team can audit your Docker stack, configure best practices, and harden networking so your containers run smoothly under load.

Troubleshooting Checklist (Copy/Paste)

• systemctl status docker; journalctl -u docker
• ls -l /var/run/docker.sock; usermod -aG docker $USER
• jq . /etc/docker/daemon.json
• df -h; df -i; docker system df
• modprobe overlay br_netfilter; sysctl net.ipv4.ip_forward=1
• Review firewall (UFW/firewalld) and FORWARD policy
• Test DNS; optionally set DNS in daemon.json
• docker system prune (carefully); set log limits
• Restart docker and containerd; daemon-reload if units changed
• If still broken, back up /var/lib/docker and reinstall

FAQs