63

What is the difference between shell and exec form for

CMD:

CMD python my_script.py arg

vs.

CMD ["python", "my_script.py", "arg"]

ENTRYPOINT:

ENTRYPOINT ./bin/main

vs.

ENTRYPOINT ["./bin/main"]

and RUN:

RUN npm start

vs.

RUN ["npm", "start"]

Dockerfile instructions?

Mike
  • 1,080
  • 1
  • 9
  • 25
Sheena
  • 15,590
  • 14
  • 75
  • 113
  • 2
    Does this answer your question? [What are shell form and exec form?](https://stackoverflow.com/questions/47904974/what-are-shell-form-and-exec-form) – fgul Feb 23 '20 at 07:25

2 Answers2

70

There are two differences between the shell form and the exec form. According to the documentation, the exec form is the preferred form. These are the two differences:

The exec form is parsed as a JSON array, which means that you must use double-quotes (“) around words not single-quotes (‘).

Unlike the shell form, the exec form does not invoke a command shell. This means that normal shell processing does not happen. For example, CMD [ "echo", "$HOME" ] will not do variable substitution on $HOME. If you want shell processing then either use the shell form or execute a shell directly, for example: CMD [ "sh", "-c", "echo $HOME" ]. When using the exec form and executing a shell directly, as in the case for the shell form, it is the shell that is doing the environment variable expansion, not docker.

Some additional subtleties here are:

The exec form makes it possible to avoid shell string munging, and to RUN commands using a base image that does not contain the specified shell executable.

In the shell form you can use a \ (backslash) to continue a single RUN instruction onto the next line.

There is also a third form for CMD:

CMD ["param1","param2"] (as default parameters to ENTRYPOINT)

Additionally, the exec form is required for CMD if you are using it as parameters/arguments to ENTRYPOINT that are intended to be overwritten.

Community
  • 1
  • 1
Matthew Schuchard
  • 25,172
  • 3
  • 47
  • 67
  • 36
    I'd also note that using the shell form for ENTRYPOINT likely means you're [not propagating signals correctly](https://hynek.me/articles/docker-signals/) to your app, which can cause problems, in particular in Kubernetes clusters. – rln Oct 21 '19 at 15:03
  • 10
    this comment is much more important than the answer, which just repeats the documentation – 4c74356b41 Dec 24 '19 at 11:19
  • 4
    It's not useful to just copy and paste the documentation without further explanation! – Shaaer Mar 09 '21 at 15:15
  • 3
    What does the documentation mean by "shell string munging"? – Rnj Jan 24 '22 at 14:43
  • 1
    @Rnj I think it means shell expansion. The `variable substitution` part describes it. – krave Oct 08 '22 at 04:37
2

In the docker documentation, there is a table that summarizes how ENTRYPOINT and CMD interact when they are in the exec form or in the shell form :

enter image description here

Source : https://docs.docker.com/engine/reference/builder/#understand-how-cmd-and-entrypoint-interact

Mathieu Rollet
  • 2,016
  • 2
  • 18
  • 31