Healthcheck: CMD vs CMD-SHELL

It's not clear to me what are the differences between CMD and CMD-SHELL in Docker Compose healthcheck.

What are the benefits of using CMD-SHELL compared to CMD? What are the use cases for CMD and CMD-SHELL?

Docker can either run the command using CMD which is the equivalent of the OS exec syscall directly in the kernel, or it can run using CMD-SHELL which runs a shell to call your command (typically /bin/sh.)

A shell provides functionality you are accustomed to from the command line, including:

• I/O redirection and pipes (>, >>,






• Command chaining (&& and ||)






• Variable expansion ($var)




However, a shell may also intercept signals, particularly when running as pid 1, which can prevent a graceful shutdown of a container (not much of an issue for a healthcheck).

In addition, to run a the shell syntax, your container's image must include a shell, which means that won't work for images based on scratch that do not include a /bin/sh`.

StackExchange DevOps Q#11501, answer score: 23