Fix Nginx connection failures to a PHP-FPM socket

Start with the complete Nginx error. connect() to unix:... failed (13: Permission denied) calls for permission and security-policy checks. No such file or directory points to the path or an absent socket; Connection refused calls for a listener/process check. An old php5-fpm.sock filename often survives a PHP upgrade even though FPM now listens elsewhere.

Compare the worker identity and listener

ps aux | grep '[n]ginx: worker'
grep -E '^listen([ .]|[[:space:]]*=)' /etc/php/*/fpm/pool.d/www.conf
ls -l /run/php/

These paths are common on Debian-family systems, not universal. Check the active pool file and service for your installation. Nginx's fastcgi_pass must match FPM's actual listen endpoint.

Configure a persistent socket permission

For an installation whose Nginx workers use www-data, an example FPM pool setting is:

listen = /run/php/php8.2-fpm.sock
listen.owner = www-data
listen.group = www-data
listen.mode = 0660

PHP 8.2 and the socket name are examples; substitute the installed pool's values. On another distribution the worker might use nginx, or a dedicated group may be preferable. These settings control the socket, not the user under which PHP scripts run.

If listen.acl_users or listen.acl_groups is configured on a supported system, it can override owner/group handling. Inspect those settings too. Use semicolons for comments in PHP configuration rather than adding Nginx-style inline # comments.

Restart the correct FPM service and inspect the recreated socket:

sudo systemctl restart php8.2-fpm
ls -l /run/php/php8.2-fpm.sock
namei -l /run/php/php8.2-fpm.sock

The worker must be able to traverse the socket's parent directories. Editing the socket with chmod alone is temporary because FPM can recreate it.

Nginx's matching location would use:

fastcgi_pass unix:/run/php/php8.2-fpm.sock;

Test and reload Nginx if that path changed. Retry the original request and check both FPM and Nginx logs. DataKit file-log collection can help compare affected instances when each node's logs include its identity.

FAQ

Should I set the socket mode to 0666?

Avoid granting every local user access to FPM. Give only the intended proxy user or group the required connection permissions. FPM is a backend execution service, not a public endpoint.

What if permissions look correct under SELinux?

Read the audit denial and inspect socket labels and process policy. A network-connect Boolean is not a universal fix for Unix-socket access. Apply the specific supported policy or labeling correction rather than generating broad allow rules blindly.

Can I use TCP instead?

Yes: listen = 127.0.0.1:9000 in FPM and fastcgi_pass 127.0.0.1:9000; in Nginx removes Unix-socket filesystem permissions from the path. Secure the listener and allowed clients. In separate containers, loopback refers to each container itself; use the intended private network endpoint or a deliberately shared Unix socket volume.

Reference: PHP-FPM pool and listener configuration.