Dockerfile CMD vs ENTRYPOINT: differences and when to use each

updated 2026-10-20

tool: Docker
compares: CMD vs ENTRYPOINT

ENTRYPOINT defines the program the container runs; CMD provides default arguments, or the whole default command when there is no ENTRYPOINT. Arguments after the image name in docker run IMAGE args replace CMD but are appended to ENTRYPOINT. Use ENTRYPOINT for images that wrap one tool, and CMD alone for general images where users often run something else.

Criterion by criterion

Criterion	CMD	ENTRYPOINT
Purpose	default command or default arguments	the executable that always runs
docker run IMAGE x y	replaced by x y	x y appended as arguments
Override	any arguments after the image name	docker run --entrypoint PROGRAM
Several in one Dockerfile	only the last one counts	only the last one counts
Typical use	node, python and base images	CLI tool images, wrapper scripts (docker-entrypoint.sh)

How they combine (exec form)

Dockerfile	docker run IMAGE	docker run IMAGE --help
CMD ["nginx", "-g", "daemon off;"]	nginx -g "daemon off;"	--help (fails: not a command)
ENTRYPOINT ["curl"]	curl	curl --help
ENTRYPOINT ["curl"] + CMD ["https://example.com"]	curl https://example.com	curl --help

dockerfile

FROM alpine:3.22
RUN apk add --no-cache curl
ENTRYPOINT ["curl", "-fsS"]
CMD ["--help"]

Exec form vs shell form

Exec form ["prog", "arg"] runs prog as PID 1, so it receives SIGTERM from docker stop. Prefer it.
Shell form prog arg runs /bin/sh -c "prog arg"; the shell is PID 1, variables are expanded, but signals often do not reach prog. A shell-form ENTRYPOINT also ignores CMD and docker run arguments.

Sources

codes · dockerDocker container exit codes: 125, 126, 127, 137, 139, 143Docker exit codes explained: 125 is a docker run error, 126 and 127 are command problems, 137 is SIGKILL or out of memory, 143 SIGTERM and 139 a segfault.changes · docker-composedocker-compose v1 to docker compose v2: what changedCompose v2 replaces the Python docker-compose with the docker compose plugin: version is obsolete, container names use hyphens, and v1 is end of life.config · docker-composeCompose depends_on condition: service_healthy with a healthcheckdepends_on with condition: service_healthy makes Compose wait until a dependency's healthcheck passes before it starts the services that depend on it.

Criterion by criterion

How they combine (exec form)

Exec form vs shell form

Sources

Related pages