difference between cmd and entrypoint in Dockerfile

Question

I am new to docker and have a simple question about the Dockerfile. We can write entrypoint and CMD in Dockerfile. Seems that ENTRYPOINT is executed during creating the container. And CMD is executed during starting the container. Is this true?

Answer 1

Not exactly:

ENTRYPOINT configures a container that will run as an executable.
So it is always executed (or the default /bin/sh -c is).

ENTRYPOINT ["executable", "param1", "param2"] (exec form, preferred)
ENTRYPOINT command param1 param2 (shell form)

Command line arguments to docker run <image> will be appended after all elements in an exec form ENTRYPOINT, and will override all elements specified using CMD.

The shell form prevents any CMD or run command line arguments from being used, but has the disadvantage that your ENTRYPOINT will be started as a subcommand of /bin/sh -c, which does not pass signals.
This means that the executable will not be the container’s PID 1 - and will not receive Unix signals - so your executable will not receive a SIGTERM from docker stop <container>.

You can view CMD as parameters for the ENTRYPOINT.
if there is no entrypoint (the default command is "/bin/sh -c"), CMD can include an executable.
If ENTRYPOINT already runs an executable, then the CMD arguments are parameters to this command (if docker run is used without additional parameters).

---

With docker start, as mentioned in issue 1437, the ENTRYPOINT is executed, but only with parameters from CMD (so CMD is used, but you cannot override it with parameters of your own on the command-line).
IF you want to use CMD, you need docker run, not docker start.

There actually is a recent PR in progress (PR 19746) which allows for the docker start command to take an optional --cmd (-c) flag to specify the cmd to use instead of the default one from cmd/entrypoint.

---

The Official Dockerfile documentation now has a section "Understand how CMD and ENTRYPOINT interact":

• Dockerfile should specify at least one of CMD or ENTRYPOINT commands.
• ENTRYPOINT should be defined when using the container as an executable.
• CMD should be used as a way of defining default arguments for an ENTRYPOINT command or for executing an ad-hoc command in a container.
• CMD will be overridden when running the container with alternative arguments.

That means, if your Dockerfile includes:

• No CMD:

  • if No ENTRYPOINT: error, not allowed
  • ENTRYPOINT exec_entry p1_entry means /bin/sh -c exec_entry p1_entry
  • ENTRYPOINT ["exec_entry", "p1_entry"] means exec_entry p1_entry

• CMD ["exec_cmd", "p1_cmd"] (one command, one parameter)

  • if No ENTRYPOINT: exec_cmd p1_cmd,
  • ENTRYPOINT exec_entry p1_entry means /bin/sh -c exec_entry p1_entry exec_cmd p1_cmd
  • ENTRYPOINT ["exec_entry", "p1_entry"] means exec_entry p1_entry exec_cmd p1_cmd

• CMD ["p1_cmd", "p2_cmd"]

  • if No ENTRYPOINT: p1_cmd p2_cmd
  • ENTRYPOINT exec_entry p1_entry means /bin/sh -c exec_entry p1_entry p1_cmd p2_cmd (good)
  • ENTRYPOINT [“exec_entry”, “p1_entry”] means exec_entry p1_entry p1_cmd p2_cmd

• CMD exec_cmd p1_cmd:

  • if No ENTRYPOINT: /bin/sh -c exec_cmd p1_cmd
  • ENTRYPOINT exec_entry p1_entry means /bin/sh -c exec_entry p1_entry /bin/sh -c exec_cmd p1_cmd
  • ENTRYPOINT [“exec_entry”, “p1_entry”] means exec_entry p1_entry /bin/sh -c exec_cmd p1_cmd