CMD and ENTRYPOINT in a Dockerfile

ENTRYPOINT selects the startup executable, while CMD supplies a default command or default arguments. In the common exec-form combination, arguments after the image name replace CMD and are passed to the entrypoint.

FROM ubuntu:24.04
ENTRYPOINT ["sleep"]
CMD ["10"]

After building this as sleep-demo:

docker run --rm sleep-demo
# Runs sleep 10

docker run --rm sleep-demo 30
# Runs sleep 30

The entrypoint is a default, not an unchangeable security boundary. --entrypoint can replace it explicitly.

A command without an entrypoint

FROM ubuntu:24.04
CMD ["sleep", "10"]

Here, docker run sleep-demo sleep 20 replaces the whole default command. With shell form, CMD sleep 10, Docker invokes the configured shell—normally /bin/sh -c for Linux images. That shell comes from Dockerfile shell-form semantics, not from a supposed shell ENTRYPOINT in the Ubuntu image.

Only the last CMD and last ENTRYPOINT in a stage determine that stage's defaults. Inherited image settings also matter; inspect the resulting image when extending a base image with its own startup logic.

Use a wrapper when initialization is needed

A minimal /entrypoint.sh might contain:

#!/bin/sh
set -e
# Perform required initialization here.
exec "$@"

Package it with an executable mode:

COPY --chmod=755 entrypoint.sh /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]
CMD ["nginx", "-g", "daemon off;"]

This fragment assumes an image containing Nginx. The final exec replaces the wrapper process with the application. Initialization scripts in official images use variations of this pattern; their behavior is image-specific.

FAQ

Why prefer exec form?

It avoids an unnecessary shell between Docker and the application. A shell wrapper that does not forward signals or replace itself can interfere with shutdown. Exec form improves delivery but does not automatically make the application handle termination or reap child processes correctly. --init can help with an appropriate process-reaping arrangement.

How can I start a debug shell instead?

docker run --rm -it --entrypoint /bin/sh myapp:1.2

The image must contain that shell. Overriding the entrypoint also clears the image's default CMD, so supply any desired shell arguments explicitly.

What are the Kubernetes fields?

Kubernetes command corresponds to overriding the image entrypoint, and args supplies arguments in place of the image's default CMD. Do not assume Docker CLI, Compose, and Kubernetes interpret every shell-looking string identically.

See the Dockerfile startup-command reference and container run reference.