Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The error means Nginx cannot open the configured upstream endpoint. For a Unix socket, that usually means the Nginx worker lacks permission to traverse one of the parent directories or to read/write the socket under its owner, group, or mode. It can also mean Nginx is using a directive that does not match the backend protocol.
Use the exact socket or TCP endpoint shown in the error log, verify that the WSGI server is listening there, inspect every directory in the path, then assign a deliberate owner/group/mode. Test the endpoint as the Nginx account before reloading the web server.
What the error actually tells you
A typical message looks like:
connect() to unix:/run/uwsgi/app.sock failed (13: Permission denied) while connecting to upstreamErrno 13 is an access-control failure at the upstream connection step. Nginx reached the point where it tried to open the endpoint, but the operating system refused access. The endpoint may be a Unix-domain socket such as /run/uwsgi/app.sock, or it may be a TCP address and port.
The message does not prove that the socket file itself has the wrong mode. Unix-socket access is evaluated against all of the following:
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
- The account running the Nginx worker process.
- The socket’s owner, group, and permission bits.
- Search (execute) permission on every parent directory in the path.
- Mandatory access-control policy, such as SELinux or AppArmor, when enabled.
- The endpoint and protocol configured on both sides.
A backend can be running normally while Nginx is denied access. Conversely, changing permissions will not help if Nginx points at an old path, the WSGI process is listening on another port, or the backend speaks HTTP while Nginx is configured for the uWSGI protocol.
Run the diagnosis in this order
1. Capture the exact endpoint and errno
Follow the Nginx error log while reproducing one request:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorssudo tail -f /var/log/nginx/error.logRecord the complete unix: path or TCP address, the errno, and the location block handling the request. Do not substitute a guessed socket path; every later check must use the endpoint printed by Nginx.
2. Confirm that the WSGI server is listening at that endpoint
Check the service status and its startup logs. Gunicorn and uWSGI can listen on Unix sockets, TCP sockets, HTTP, or the uWSGI protocol. The configured Nginx endpoint must be the one actually created by the running process.
sudo systemctl status your-wsgi-service
sudo ss -lx | grep app.sock
sudo ss -ltn | grep ':8000'Replace the service name, socket name, and port with the values used by your deployment. A missing socket usually indicates a failed service, a different runtime directory, or a startup option that does not match the Nginx configuration. A TCP listener on a different address or port is the same kind of configuration mismatch.
3. Check every directory in the path
Inspect the complete path, not just the final socket:
Recommended Free Tools
namei -l /run/uwsgi/app.socknamei prints ownership and mode for /, /run, /run/uwsgi, and the socket. The Nginx worker needs search permission on each directory. A directory with mode 0700 owned by the WSGI account blocks Nginx even when the socket itself is mode 0666 or 0777.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
4. Inspect the socket metadata
stat -c '%A %U %G %n' /run/uwsgi/app.sockCompare the reported owner and group with the account that Nginx workers use. Find that account in the Nginx configuration or service definition; common distributions use a web-server account, but its name is distribution-specific. Also verify that the path is a socket and not a regular file left by an interrupted startup.
5. Test access as Nginx
For a Unix socket, make a request as the same account Nginx uses. Gunicorn’s deployment guidance demonstrates the pattern with a Unix-socket curl request:
sudo -u www-data curl --unix-socket /run/gunicorn.sock http://localhost/Use your actual Nginx account and socket. If this command returns a permission error, fix Unix permissions or mandatory access control before touching Nginx. If it succeeds but a browser request fails, inspect the Nginx location block, upstream protocol, and any additional proxy settings.
Free tools Windows power users keep installed
One-click scans. No signup required.
6. Validate and reload only after the endpoint works
sudo nginx -t
sudo systemctl reload nginxRestart or reload the WSGI service when changing its user, group, umask, socket path, or socket mode. A socket is commonly recreated during a restart, so a manual permission change can disappear immediately.
How Unix-socket permissions are evaluated
Owner, group, and mode
A practical arrangement is to keep the application process under its own user, add both that user and the Nginx worker to a dedicated shared group, and create the socket with group read/write access. A mode such as 0660 is restrictive and usually sufficient when both services share a group. In deployments where only read/write access by the web server is needed and the application has a different operational requirement, 0664 may be appropriate. uWSGI documentation uses --chmod-socket=664 as a more sensible example than world-writable mode 666.
Write access is normally required for a client to connect to a Unix stream socket. Granting access to every local user with 0666 or 0777 weakens isolation and does not address directory traversal, service restarts, or security policy. Prefer the smallest group and mode that allow the two services to communicate.
Parent-directory traversal
Directory permissions use the execute bit for traversal. Nginx does not need to list a directory, but it must be able to pass through each component. For example, a socket mode of 0660 is useless if /run/uwsgi is mode 0700 for the WSGI user. Set a group and directory mode that permit traversal without exposing unrelated files; a group-traversable runtime directory is generally safer than opening the entire directory to all users.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Socket recreation and umask
Socket files are often deleted and recreated when Gunicorn or uWSGI restarts. Gunicorn documents that its --user, --group, and --umask settings affect Unix-socket permissions. Set these options deliberately rather than relying on an interactive shell’s defaults. A restrictive umask can remove group write permission from an otherwise correct mode, while a service running under a different user can create a socket that Nginx cannot use.
Identity checks that prevent false fixes
- Confirm the WSGI process user and group in the service definition.
- Confirm the Nginx worker user in its configuration or service file.
- Confirm that the socket’s group is the group both services actually share.
- Check whether a restart changes the owner, group, mode, or parent directory.
Use a matching Nginx directive and backend protocol
uWSGI protocol with uWSGI
When uWSGI is serving its native uWSGI protocol on a Unix socket, use uwsgi_pass and include the uWSGI parameters:
location / {
include uwsgi_params;
uwsgi_pass unix:/run/uwsgi/app.sock;
}The socket path must exactly match the uWSGI process configuration. If uWSGI creates a TCP listener instead, use the corresponding address and port in uwsgi_pass.
HTTP-speaking Gunicorn with proxying
Gunicorn commonly speaks HTTP to a client or reverse proxy. In that case, configure Nginx’s HTTP proxy settings rather than uwsgi_pass. A Unix socket can still be used as the transport, but the protocol carried over it is HTTP. The directive and upstream mode must agree with what Gunicorn is serving.
Recognize a protocol mismatch
A pure permission failure normally reports errno 13. If permissions are correct but errors change to connection refusal, an invalid response, or a protocol parsing failure, compare the backend’s bind options with the Nginx directive. Changing file modes cannot turn an HTTP listener into a uWSGI listener.
Reliable configuration patterns
Dedicated group for a hand-managed Unix socket
- Create a group used only for the application socket.
- Add the WSGI service account and Nginx worker account to that group.
- Configure Gunicorn or uWSGI to create the socket with that group and a mode such as
0660or0664. - Ensure the runtime directory is group-traversable and is recreated with the same ownership after reboot.
- Restart the WSGI service, verify with
namei -landstat, then test as Nginx.
This keeps the application user separate from the web-server user while avoiding world-writable permissions.
systemd runtime directory
Runtime files belong under /run, which is recreated at boot. A systemd-managed service can declare RuntimeDirectory=uwsgi so the directory is created predictably for the service. The resulting path can be used in the Nginx configuration, for example /run/uwsgi/app.sock.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
[Service]
RuntimeDirectory=uwsgi
The exact service unit also needs the WSGI command and its user/group settings. Verify the directory and socket after each restart because ownership can be controlled by the unit rather than by a shell command.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
systemd socket activation
With a separate socket unit, systemd creates the endpoint before starting the service and can enforce its identity and mode:
[Socket]
ListenStream=/run/uwsgi/app.sock
SocketUser=nginx
SocketGroup=uwsgi
SocketMode=0660
Use the account names that exist on your system. If the application must own the socket instead, set the appropriate SocketUser and shared group. Socket activation also gives systemd responsibility for startup ordering and cleanup, which prevents stale files and boot-time race conditions.
Gunicorn options
When Gunicorn creates the socket itself, set its user, group, and umask in the service command rather than changing the file after startup. The effective result must be visible in stat after every restart. Keep the application account separate from Nginx where practical; grant Nginx only the group access needed to connect.
Why chmod 777 often fails
The socket may be replaced
Changing a live socket to a permissive mode is temporary if the WSGI service removes and recreates it. The newly created endpoint inherits the service’s user, group, and umask, so the error returns after a restart or deployment.
The parent directory can still block Nginx
Mode 0777 on the final file does not grant traversal through a parent directory. Use namei -l to find the component that denies access.
The error may not be about ordinary mode bits
SELinux or AppArmor can deny a connection even when owner, group, mode, and directory traversal appear correct. Their denials are logged separately and must be investigated using the security documentation for your Linux distribution.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Permissions cannot repair a wrong endpoint or protocol
If Nginx points to a socket that no process owns, or uses uwsgi_pass for an HTTP-speaking backend, a broader mode is irrelevant. First establish that the process, path, transport, and protocol all match.
Unix socket or TCP: which should you choose?
| Deployment choice | Access control | Exposure | Operational considerations |
|---|---|---|---|
| Unix socket | Controlled by socket owner/group/mode and every parent directory; local policy also applies. | Not network-routable; access is limited to local processes permitted by the filesystem and security policy. | Efficient for local Nginx-to-WSGI traffic, but runtime paths and ownership must be recreated consistently. |
| TCP socket | Controlled primarily by the listener’s bind address, port, host firewall, and service policy rather than filesystem modes. | May be reachable beyond the host if bound to a non-loopback address or exposed by firewall rules. | Simpler across separate hosts and avoids Unix path traversal issues, but requires deliberate network exposure controls. |
Choose a Unix socket for a local reverse-proxy arrangement when you can manage runtime ownership reliably. Choose TCP when the processes are on different hosts or when a network endpoint makes service management clearer. In either case, Nginx must target the listener that actually exists.
uWSGI and Gunicorn: protocol choices at a glance
| Backend setup | Nginx side | Typical failure when mismatched |
|---|---|---|
| uWSGI serving the uWSGI protocol | uwsgi_pass plus include uwsgi_params |
Connection or protocol errors if Nginx uses HTTP proxying or the wrong path. |
| Gunicorn serving HTTP | HTTP proxy configuration targeting its Unix or TCP listener | Invalid upstream response or protocol parsing errors if configured with uwsgi_pass. |
| Any backend on TCP | Use the matching directive with the configured address and port | Refusal or timeout when the address, port, bind interface, or protocol differs. |
The words “WSGI backend” describe the application interface, not necessarily the wire protocol Nginx should use. Read the service’s bind and worker options before selecting the Nginx directive.
Mandatory access control: the next branch after Unix permissions
If namei -l, stat, and an Nginx-user test all show valid access but the error remains errno 13, inspect the host’s mandatory access-control logs. SELinux and AppArmor policies can restrict which domains may connect to a socket or traverse a runtime directory.
- Identify which policy system is enabled on the distribution.
- Review its denial records at the same timestamp as the Nginx error.
- Adjust the policy or place the socket in a path approved for the web-server domain, following the distribution’s security guidance.
- Retest with the Nginx account and keep the policy change narrower than a blanket disablement.
There is no single policy command that is correct for every distribution. Do not disable mandatory access control as a first-line fix; an audit record is evidence that the policy, not merely the Unix mode, needs attention.
Recovery checklists for common symptoms
Socket exists, but Nginx still reports errno 13
- Run
namei -land correct the first parent directory that lacks traversal permission. - Run
statand compare owner/group with the actual Nginx worker account. - Check the service’s umask and whether a restart recreated the socket.
- Test with
sudo -u <nginx-user> curl --unix-socket .... - Inspect SELinux or AppArmor denials if ordinary permissions pass.
Socket is missing after reboot
- Check the WSGI service status and startup log.
- Move runtime creation into systemd with
RuntimeDirectoryor a socket unit. - Confirm that Nginx reloads after the socket is available.
- Verify that the configured path under
/runis recreated with the intended owner, group, and mode.
Permissions look correct, but the request fails with a different error
- Compare the Nginx directive with the backend protocol.
- Confirm that the process is listening on the exact path, address, or port in the error log.
- Check whether the backend switched between HTTP, uWSGI, Unix, and TCP modes during deployment.
- Run
nginx -t, reload Nginx, and review both service logs for the new failure.
Final verification sequence
- Read the live Nginx error and copy the endpoint exactly.
- Confirm the WSGI process is running and listening at that endpoint.
- Inspect all path components with
namei -l. - Inspect socket owner, group, and mode with
stat. - Verify the Nginx worker identity and shared-group membership.
- Confirm the Nginx directive matches HTTP or uWSGI protocol behavior.
- Check mandatory-access-control logs when Unix permissions are not the cause.
- Test a request as the Nginx user.
- Run
nginx -t, reload Nginx, and repeat the request.
Once the endpoint, identity, path traversal, mode, and protocol are aligned, the “permission denied while connecting to upstream” failure is resolved without relying on insecure world-writable permissions.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
