# GitLab CI: Cannot connect to the Docker daemon at tcp://docker:2375. Is the docker daemon running?

**Code:** `Cannot connect to the Docker daemon (GitLab)` · **Category:** CI/CD · **Seen on:** GitLab CI, Docker

A docker-in-docker job could not reach the `docker:dind` service — it is not started, not privileged, or the TLS/host settings do not match.

## Meaning

With the Docker executor, builds need the `docker:dind` service, a privileged runner, and matching `DOCKER_HOST`/`DOCKER_TLS_CERTDIR`. Newer images enable TLS on port 2376, so an old `tcp://docker:2375` setting breaks. Alternatively mount `/var/run/docker.sock` or use Kaniko/BuildKit without a daemon.

## Common causes

- `docker:dind` service missing from the job
- Runner not privileged (`privileged = true` required for dind)
- `DOCKER_HOST` points to 2375 while TLS is on (or reverse)
- Shell executor without Docker installed for the gitlab-runner user
- Docker client and dind versions mismatched

## Quick fix

1. Add `services: [docker:27-dind]` and `variables: DOCKER_TLS_CERTDIR: "/certs"`
2. Enable `privileged = true` in the runner config.toml
3. Or build without a daemon using Kaniko

## Detailed fix by platform

### GitLab CI

1. Runner config: `[runners.docker] privileged = true` then restart gitlab-runner

## Code examples

### Docker-in-Docker with TLS

```yaml
build-image:
  image: docker:27
  services: [docker:27-dind]
  variables:
    DOCKER_TLS_CERTDIR: "/certs"
  script:
    - docker info
    - docker build -t "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA" .
```

## How to diagnose

1. **Service** — dind listed in services?
2. **Privileged** — Runner privileged?
3. **Host** — DOCKER_HOST and TLS consistent?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/cicd/gitlab-docker-daemon-not-running)