Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
When Nginx reports connect() to unix:/run/gunicorn.sock failed (13: Permission denied), Linux has refused access for the Nginx worker identity to that exact socket path. Fix the owner, group, mode, and parent-directory traversal permissions for the socket—or correct the mandatory access-control policy—then test the connection as the actual Nginx user. Do not begin with chmod -R 777.
A Django application can run correctly under Gunicorn while Nginx still cannot reach its socket, read static files, write logs, or serve uploaded media. Each denied path is a separate filesystem case, so identify the path and process involved before changing anything.
What “permission denied” means in a Django, Gunicorn, and Nginx stack
Linux makes an access decision for a particular process attempting to use a particular path. In a common deployment, Gunicorn runs Django and Nginx acts as the reverse proxy. Nginx does not inherit Gunicorn’s permissions: its worker processes run as the user configured by Nginx or by the distribution package.
For a Unix socket at /run/gunicorn.sock, the Nginx worker must be able to:
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
- traverse every directory in the path, including
/and/run; - access the socket according to its owner, group, and mode bits; and
- pass any additional SELinux or AppArmor checks enforced by the host.
Gunicorn’s worker identity and socket settings matter as well. Its --user option selects the worker user, --group selects the worker group, and --umask influences permissions on a Unix socket that Gunicorn creates. A successful Django startup therefore does not prove that Nginx can access the socket.
First capture the exact failure
Read the Nginx error log and the Gunicorn service journal before modifying permissions. Record the complete path, service name, and errno. Similar-looking errors require different fixes.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Message or symptom | What it usually means | First check |
|---|---|---|
connect() to unix:/run/gunicorn.sock failed (13: Permission denied) |
Nginx reached the path but its process identity is not allowed to use the socket, or a mandatory access-control policy denied it. | Socket owner/group/mode, every parent directory, Nginx worker user, and SELinux/AppArmor logs. |
No such file or directory |
The socket path does not exist, is in a different runtime directory, or the service created it somewhere else. | Check the path in Nginx and the actual Gunicorn or systemd socket unit. |
Connection refused |
A socket exists, but no process is accepting connections on it, or the service has stopped. | Gunicorn status, journal, listener state, and service startup errors. |
Nginx open() reports permission denied for a file under /static/ or /media/ |
This is a file-serving permission problem, not a Gunicorn socket problem. | The denied file, its parent directories, and the Nginx read identity. |
Useful Debian-style checks are:
sudo journalctl -u nginx -e
sudo journalctl -u gunicorn.service -u gunicorn.socket -b
sudo systemctl status nginx gunicorn.service gunicorn.socketUse the service names installed on your system; they may include an instance suffix such as gunicorn@myproject.service.
Find the identities that must be allowed
Identify the Nginx worker user
Look for the top-level user directive in the active configuration and confirm it with the running processes:
sudo nginx -T | grep -E '^[[:space:]]*user[[:space:]]+'
ps -o user,group,comm -C nginxCommon names include www-data, nginx, and http, but no one name is universal. The master process and workers can have different identities; the workers are the processes that need to connect to the upstream socket and read static files.
Identify Gunicorn’s service identity
For a systemd-managed service, inspect the effective settings rather than relying on a remembered username:
sudo systemctl show gunicorn.service -p User -p Group -p WorkingDirectory -p ExecStart
sudo systemctl cat gunicorn.serviceGunicorn can also change its worker identity with --user and --group. If those options appear in ExecStart, account for them when deciding who owns application files and who creates a socket.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Inspect the socket and every parent directory
Check both the socket itself and the complete path. The x (execute) permission on a directory means “traverse”; without it, a process cannot reach an otherwise readable socket or file inside.
sudo ls -l /run/gunicorn.sock
sudo namei -l /run/gunicorn.sock
sudo stat -c '%A %a %U %G %n' /run /run/gunicorn.socknamei -l is especially useful because it displays permissions for each component. If the socket is in a project directory rather than /run, inspect every component from the filesystem root. A directory mode of 0700 owned by the application account will block Nginx even if the socket itself is 0660.
Also verify that Nginx and Gunicorn refer to exactly the same path. A relative path, a different virtual-environment service, or a stale socket under another runtime directory can produce a different error from the one you are investigating.
Fix a Unix socket with least privilege
Option 1: Let systemd create the socket
A systemd socket unit can create /run/gunicorn.sock with explicit ownership and mode before starting the service. The important settings are:
[Socket]
ListenStream=/run/gunicorn.sock
SocketUser=www-data
SocketGroup=www-data
SocketMode=0660Use the actual Nginx account or a dedicated shared group instead of copying www-data blindly. The deployment pattern documented for Gunicorn uses SocketUser=www-data, SocketGroup=www-data, and SocketMode=0660, then tests the socket as that user.
A complete socket unit might look like this:
[Unit]
Description=Gunicorn socket
[Socket]
ListenStream=/run/gunicorn.sock
SocketUser=www-data
SocketGroup=www-data
SocketMode=0660
[Install]
WantedBy=sockets.targetThe accompanying service must declare the application identity and working directory, for example:
[Unit]
Description=Gunicorn service
Requires=gunicorn.socket
After=network.target
[Service]
User=django
Group=www-data
WorkingDirectory=/srv/myproject
ExecStart=/srv/myproject/venv/bin/gunicorn --workers 3 --bind fd://0 myproject.wsgi:application
[Install]
WantedBy=multi-user.targetThis example uses socket activation, where systemd owns the listening socket and passes it to Gunicorn. If your service command tells Gunicorn to create the path itself with --bind unix:/run/gunicorn.sock, use the Gunicorn-created model instead of having two components compete to create the same socket. Follow the binding syntax supported by the Gunicorn version installed on your host.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Option 2: Let Gunicorn create the socket
If the service starts Gunicorn with a Unix-path bind, set the worker identity and umask deliberately. For example:
ExecStart=/srv/myproject/venv/bin/gunicorn --user django --group webapps --umask 007 --bind unix:/run/gunicorn.sock myproject.wsgi:applicationGunicorn documents that --user changes the worker user, --group changes the worker group, and the umask affects Unix-socket permissions. The resulting mode also depends on the socket’s base permissions, so verify it after startup rather than assuming a numeric mode.
sudo systemctl restart gunicorn.service
sudo ls -l /run/gunicorn.sockDo not apply a socket-unit configuration and a Gunicorn-created socket configuration simultaneously unless you know which component owns the listening file descriptor.
Use a dedicated shared group when appropriate
If Nginx should connect but should not become the owner of application files, a shared group gives a narrower boundary than making a whole directory world-accessible:
- Create or select a group dedicated to the proxy/application boundary.
- Add the Nginx worker user and the Gunicorn service user to that group.
- Set the socket’s group to that group and use a mode such as
0660. - Restart the affected services so they receive the new supplementary-group membership.
- Confirm the effective groups with
id nginx-userorid www-data.
For a socket under a project directory, the group also needs directory traversal on every parent. Granting group execute permission to the parent directories may be necessary while keeping file contents private.
Reload systemd and verify what it actually applied
Unit-file edits do nothing until systemd reloads its configuration. Apply changes and inspect the resulting state:
sudo systemctl daemon-reload
sudo systemctl enable --now gunicorn.socket
sudo systemctl restart gunicorn.service
sudo systemctl status gunicorn.socket gunicorn.service
sudo ls -l /run/gunicorn.sock
sudo namei -l /run/gunicorn.sockIf the socket is socket-activated, restarting the service alone may not recreate it with new socket-unit settings; restart or stop and start the socket unit as needed. A failed unit, an invalid directive, or a path collision will appear in journalctl. Always inspect the final owner and mode instead of assuming systemd accepted the file.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
/run is a runtime filesystem and is recreated during boot. That is why a systemd socket unit or another systemd-managed runtime-directory mechanism is preferable to a one-time manual touch or chmod command.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Test the connection as the real Nginx user
A test run from your own shell proves only that your shell account can connect. Use the worker identity and the exact socket path:
sudo -u www-data curl --unix-socket /run/gunicorn.sock http://localhost/Replace www-data with the account shown by your Nginx configuration. The Gunicorn deployment documentation demonstrates this style of test on Debian-like systems. A successful HTTP response confirms that the operating-system access check and the upstream response both work for that identity.
If the test still returns permission denied, run:
sudo -u www-data namei -l /run/gunicorn.sock
sudo -u www-data test -r /run/gunicorn.sock && echo readable
sudo -u www-data test -w /run/gunicorn.sock && echo writableThe socket protocol needs the permissions required to connect; do not infer success from a generic file-read test alone. Recheck the parent directories and mandatory access-control audit records.
Keep socket, static, media, logs, and generated files separate
Static files
When Nginx serves /static/ directly, its worker must be able to traverse the static root and read each requested file. Check the denied path, not just the directory named in Django’s settings:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo namei -l /srv/myproject/static/css/site.css
sudo stat -c '%A %a %U %G %n' /srv/myproject/static/css/site.cssRun collectstatic as the account intended to own the generated files, then grant Nginx read and traversal access. A socket permission change cannot repair a static-file open() denial.
Media and uploads
Uploaded media often needs to be written by Django and read by Nginx. Give the application write access only to the upload locations it needs, while giving Nginx read and traversal access. Avoid making the entire project tree writable by either service.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Logs and generated output
Gunicorn, Django, and background jobs may write to different directories. The writer needs directory write and execute permission; a reader such as Nginx may need only read and execute. Inspect the parent directory because a file can have a permissive mode while its directory blocks access.
Control sockets are a different case
Gunicorn’s control-interface socket has a documented default mode of 0600 and relies on filesystem permissions. A permission-denied error there means the process lacks the required read/write access to that control socket; do not apply its mode assumptions to the HTTP-serving socket used by Nginx.
Check SELinux or AppArmor after Unix permissions look correct
If owner, group, mode, and traversal are correct but Nginx still receives EACCES, a mandatory access-control policy may be denying the operation. Inspect the local records instead of copying a generic policy change:
- On SELinux systems, inspect AVC denials in the audit log or journal and check the current context of the socket and served files.
- On AppArmor systems, inspect profile-denial messages and identify the profile attached to Nginx or Gunicorn.
- Confirm that the path labels, profile rules, distribution, and service confinement match the host on which the failure occurs.
The correct policy adjustment depends on those records. A rule that works on one distribution or path layout can weaken another system or simply target the wrong file.
Unix socket or loopback TCP?
Both transports can connect Nginx to Gunicorn. The choice changes the access-control surface and operational behavior.
| Characteristic | Unix socket | Loopback TCP |
|---|---|---|
| Access control | Filesystem owner, group, mode, parent traversal, and mandatory access-control policy. | Bind address and port availability, firewall policy, and process/network policy; no socket-file traversal. |
| Typical endpoint | unix:/run/gunicorn.sock |
127.0.0.1:8000 or another loopback address and port. |
| Operational durability | Must be recreated correctly under /run after reboot; systemd can own creation. |
Gunicorn recreates the listener when its service starts; the port must not collide with another process. |
| Nginx configuration | Use the matching Unix-socket upstream path. | Use the loopback host and port exactly as Gunicorn binds them. |
| Best diagnostic clue | Inspect ls -l, namei -l, service users, and policy denials. |
Check whether Gunicorn is listening, whether the port is occupied, and whether local policy blocks the connection. |
Switching to TCP can remove a socket-file permission problem, but it does not fix an incorrectly configured service or a blocked process policy. Choose it intentionally rather than using it to hide unknown ownership settings.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Gunicorn-created versus systemd-created sockets
| Question | Gunicorn creates the socket | systemd creates the socket |
|---|---|---|
| Who applies ownership and mode? | Gunicorn’s process identity and umask, plus any surrounding service settings. | The socket unit’s SocketUser, SocketGroup, and SocketMode. |
| Who owns lifecycle? | The Gunicorn service creates the file when it starts and removes or replaces it according to its startup behavior. | systemd owns the listening endpoint and can activate the service on demand. |
| Reboot behavior | Depends on the service starting successfully and recreating the runtime path. | Enabling the socket unit gives a durable boot-time definition for the path. |
| Main failure to avoid | A umask or service user produces a mode Nginx cannot use. | The service command is configured to create the same path instead of consuming the systemd-provided socket. |
Common mistakes and recovery steps
“I used chmod 777 and it still fails”
A recursive mode change may miss a parent directory, may target the wrong socket, or may not affect SELinux/AppArmor policy. Restore a least-privilege owner/group/mode design, then use namei -l and the audit logs to locate the remaining denial.
“Gunicorn works when I launch it manually”
Your shell launch may run as a different user, use a different virtual environment, bind a different path, or inherit a different umask from systemd. Compare the manual command with systemctl show, the service journal, and the actual socket metadata.
“The socket disappears after reboot”
Because /run is temporary, a manually created socket is not a durable configuration. Define it in a socket unit or ensure the service creates it with the intended owner and mode every time it starts.
“Changing the socket fixed proxying, but static files still fail”
Inspect the static or media path independently. Nginx needs read permission on each file and traversal on each directory; Django’s application user may need write permission for collection or uploads. These are separate access decisions.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsQuick Recap
A compact diagnostic sequence
- Copy the exact Nginx error, including errno and full path.
- Check Nginx’s worker identity and Gunicorn’s effective
User,Group,--user, and--groupsettings. - Run
ls -landnamei -lon the socket and every parent directory. - Determine whether Gunicorn or systemd creates the socket; configure only one owner of that lifecycle.
- Set a deliberate owner, shared group, and mode such as
0660where appropriate, and account for Gunicorn’s--umaskwhen it creates the socket. - Reload systemd, restart the relevant socket and service, and verify the resulting metadata.
- Run
sudo -u <nginx-user> curl --unix-socket <socket-path> http://localhost/. - If Unix permissions are correct, inspect SELinux or AppArmor denials.
- If the denied path is static, media, logs, or generated output, repair that path’s ownership and traversal separately.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
