How to fix Error response from daemon: privileged mode is required in Docker

DockerINTERMEDIATEMEDIUMUpdated Dec 6, 2025· 188 views

This error occurs when a Docker container requires elevated privileges to access host resources, devices, or kernel capabilities that are restricted by default. The solution involves either running with --privileged flag or, preferably, granting only the specific capabilities needed.

Quick fix

Fixes Error response from daemon: privileged mode is required

docker logs <container_name>
  1. Identify what privilege is actually needed
  2. Use specific capabilities instead of privileged mode (recommended)
  3. Use --device for specific device access
  4. Run with --privileged flag when necessary
docker — error
docker logs <container_name>
Error response from daemon: privileged mode is required

What this error means

When you run a Docker container, it operates in a sandboxed environment with limited access to the host system's resources. This isolation is a core security feature of containers. The Docker daemon enforces restrictions through Linux capabilities, cgroups, and security modules like SELinux or AppArmor. This error appears when your container attempts to perform an operation that requires elevated privileges, such as: - Accessing hardware devices directly (e.g., /dev/sda, USB devices) - Modifying kernel parameters or loading kernel modules - Running Docker-in-Docker (DinD) scenarios - Performing network-level operations that require raw socket access - Mounting file systems or using loop devices The Docker daemon detects that the requested operation cannot be completed with the container's current privilege level and returns this error to indicate that privileged mode is required.

Typical symptoms

  • Container fails to start with 'privileged mode is required' error
  • Operations requiring device access fail inside the container
  • Docker-in-Docker setups fail to build or run nested containers
  • Network tools like tcpdump or iptables fail with permission errors inside container
  • CI/CD pipelines requiring special device access fail unexpectedly
  • Containers that worked on development machines fail in production environments

Common causes

  1. Container attempts to access /dev devices that require elevated privileges
  2. Running Docker-in-Docker (DinD) without proper configuration
  3. Application needs to modify kernel parameters or load kernel modules
  4. Container requires raw network socket access for packet capture or manipulation
  5. Mounting host filesystems or managing loop devices from within the container
  6. Security scanning tools or monitoring agents that require deep system access
  7. Orchestration platform (Kubernetes, Docker Swarm) restricts privileged containers by default

How to fix "Error response from daemon: privileged mode is required"

1Identify what privilege is actually needed

Before enabling privileged mode, determine exactly what capability or access your container requires. Running in privileged mode gives the container nearly full host access, which is a significant security risk.

Check the container logs or application documentation to understand the specific operation that's failing:

bash
docker logs <container_name>

Common operations that trigger this error include:
- Device access (USB, GPU, storage devices)
- Network packet capture (tcpdump, Wireshark)
- Kernel module operations
- Docker-in-Docker builds

2Use specific capabilities instead of privileged mode (recommended)

Instead of granting full privileged access, add only the specific Linux capabilities your container needs using the --cap-add flag:

bash
# For network administration (iptables, routing)
docker run --cap-add=NET_ADMIN myimage

# For raw network access (packet capture)
docker run --cap-add=NET_RAW myimage

# For system administration tasks
docker run --cap-add=SYS_ADMIN myimage

# Multiple capabilities
docker run --cap-add=NET_ADMIN --cap-add=SYS_PTRACE myimage

Common capabilities:
| Capability | Use Case |
|------------|----------|
| NET_ADMIN | Network interface configuration, iptables |
| NET_RAW | Raw sockets, packet capture |
| SYS_ADMIN | Mount operations, system calls |
| SYS_PTRACE | Debugging, tracing processes |
| SYS_MODULE | Loading kernel modules |

3Use --device for specific device access

If your container needs access to specific devices, use the --device flag instead of privileged mode:

bash
# Access a specific device
docker run --device=/dev/sda:/dev/sda myimage

# Access USB devices
docker run --device=/dev/bus/usb:/dev/bus/usb myimage

# Access GPU (NVIDIA)
docker run --device=/dev/nvidia0:/dev/nvidia0 myimage

This approach is more secure because it only exposes the specific devices needed rather than all host devices.

4Run with --privileged flag when necessary

If specific capabilities and device access aren't sufficient, you can run in privileged mode:

bash
docker run --privileged myimage

For Docker Compose, add it under the service definition:

yaml
version: '3.8'
services:
  myservice:
    image: myimage
    privileged: true

Warning: This grants the container almost all capabilities of the host machine. Only use this with trusted images and when absolutely necessary.

5Configure Docker-in-Docker properly

For Docker-in-Docker scenarios (common in CI/CD), you have several options:

Option 1: Use --privileged (simple but less secure)

bash
docker run --privileged -v /var/run/docker.sock:/var/run/docker.sock docker:dind

Option 2: Mount Docker socket (shares host Docker daemon)

bash
docker run -v /var/run/docker.sock:/var/run/docker.sock docker:latest

Option 3: Use rootless Docker or Podman
Consider alternatives like rootless Docker or Podman which don't require privileged mode for nested container operations.

6Handle orchestration platform restrictions

If you're running on Kubernetes or Docker Swarm, privileged containers may be restricted by security policies.

For Kubernetes:

yaml
apiVersion: v1
kind: Pod
metadata:
  name: privileged-pod
spec:
  containers:
  - name: mycontainer
    image: myimage
    securityContext:
      privileged: true

You may also need to configure PodSecurityPolicy or PodSecurityStandards to allow privileged containers.

For Docker Swarm:
Privileged mode is not supported in Swarm mode for security reasons. Consider using capabilities or running standalone containers for tasks requiring elevated privileges.

Advanced notes

Security Implications of Privileged Mode:
Running a container with --privileged is essentially equivalent to giving it root access to the host system. The container can:
- Access all devices on the host
- Escape the container and access the host filesystem
- Load kernel modules
- Modify network configuration
- Potentially compromise other containers

This makes privileged containers a significant security risk, especially with untrusted images.

Best Practices:
1. Always start with the principle of least privilege
2. Use --cap-add for specific capabilities instead of --privileged
3. Use --device for specific device access
4. Audit images before running them in privileged mode
5. Consider using Podman's rootless mode as an alternative
6. Implement security policies in orchestration platforms to restrict privileged containers

SELinux and AppArmor:
On systems with SELinux or AppArmor enabled, even with --privileged, some operations may still be restricted. You may need to:

bash
# Disable SELinux labels for the container
docker run --privileged --security-opt label=disable myimage

# Disable AppArmor for the container
docker run --privileged --security-opt apparmor=unconfined myimage

Windows Considerations:
Windows containers do not support privileged mode. If you see this error on Windows, you may need to:
- Switch to Linux containers mode
- Use a different approach for the operation you're attempting
- Run a Linux VM for tasks requiring privileged access

Debugging Capability Requirements:
To discover what capabilities your application actually needs, you can:
1. Run with --privileged initially
2. Use tools like ausearch (SELinux) or capsh to audit required capabilities
3. Progressively remove capabilities until you find the minimum set needed

Frequently asked questions

What does "Error response from daemon: privileged mode is required" mean?
When you run a Docker container, it operates in a sandboxed environment with limited access to the host system's resources. This isolation is a core security feature of containers. The Docker daemon enforces restrictions through Linux capabilities, cgroups, and security modules like SELinux or AppArmor.
How do I fix "Error response from daemon: privileged mode is required"?
This error occurs when a Docker container requires elevated privileges to access host resources, devices, or kernel capabilities that are restricted by default. The solution involves either running with --privileged flag or, preferably, granting only the specific capabilities needed.
What causes "Error response from daemon: privileged mode is required"?
Container attempts to access /dev devices that require elevated privileges Running Docker-in-Docker (DinD) without proper configuration Application needs to modify kernel parameters or load kernel modules
Is the "Error response from daemon: privileged mode is required" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading