Gotcha: Docker ENTRYPOINT vs CMD interaction

Confusion about how ENTRYPOINT and CMD interact, leading to containers that don't start correctly or ignore arguments.

Understanding the interaction:

# CMD only - entire command, easily overridden
CMD ["python", "app.py"]
# docker run myimage          -> python app.py
# docker run myimage bash     -> bash (CMD replaced)

# ENTRYPOINT only - always runs, args appended
ENTRYPOINT ["python", "app.py"]
# docker run myimage          -> python app.py
# docker run myimage --debug  -> python app.py --debug

# Both - CMD provides default args to ENTRYPOINT
ENTRYPOINT ["python", "app.py"]
CMD ["--port", "8080"]
# docker run myimage          -> python app.py --port 8080
# docker run myimage --debug  -> python app.py --debug

# Common pattern: entrypoint script
ENTRYPOINT ["/entrypoint.sh"]
CMD ["serve"]

Shell form vs exec form:

• Exec form ["cmd", "arg"]: runs directly, gets signals
• Shell form cmd arg: runs via /bin/sh -c, PID 1 is shell
• Always use exec form for ENTRYPOINT (signal handling)

Shell form ENTRYPOINT wraps the process in a shell, which swallows signals like SIGTERM, preventing graceful shutdown.

Writing Dockerfiles and debugging container startup behavior