Dockerfile ENTRYPOINT vs CMD

ENTRYPOINT defines the executable a container is built to run; CMD supplies default arguments or a default command. Exec form avoids an extra shell and handles signals more predictably:

ENTRYPOINT ["/usr/local/bin/server"]
CMD ["--port", "8080"]

Running docker run image --port 9000 replaces the CMD arguments while keeping the entrypoint. A Compose command also changes the default command, while entrypoint changes the entrypoint.

Use shell form only when you need shell features and have handled signal forwarding deliberately. A wrapper script should use exec "$@" so the real process receives termination signals. Keep one clear foreground process as the container's main process; a container exits when that process exits. Do not use an entrypoint to hide migrations, background daemons, or secrets in a way operators cannot see.

Sources

• Docker documentation
• Docker CLI reference