ENTRYPOINT vs CMD difference in Docker - CLI Comparison

Introduction

When running a Docker container, you often want to specify what program runs first. ENTRYPOINT and CMD both set this, but they work differently. Understanding their difference helps you control how your container starts and behaves.

When you want to set a fixed main command that always runs in your container.

When you want to provide default arguments that users can override when running the container.

When you want to combine a fixed command with flexible arguments provided at runtime.

When you want to create reusable images with a default behavior but allow customization.

When you want to avoid users accidentally replacing the main command by mistake.

Config File - Dockerfile

Dockerfile

FROM alpine:3.18

# Set ENTRYPOINT to always run the echo command
ENTRYPOINT ["echo"]

# Set CMD to provide default arguments to echo
CMD ["Hello, Docker!"]

FROM alpine:3.18 sets the base image.

ENTRYPOINT ["echo"] means the container will always run the echo command first.

CMD ["Hello, Docker!"] provides default arguments to echo, which can be overridden when running the container.

Commands

Builds the Docker image named entrypoint-cmd-example using the Dockerfile in the current directory.

Terminal

docker build -t entrypoint-cmd-example .

Expected Output

Sending build context to Docker daemon  2.048kB

Step 1/4 : FROM alpine:3.18

3.18: Pulling from library/alpine

Digest: sha256:...

Status: Downloaded newer image for alpine:3.18

 ---> a24bb4013296

Step 2/4 : ENTRYPOINT ["echo"]

 ---> Running in 123abc456def

Removing intermediate container 123abc456def

 ---> 789def012345

Step 3/4 : CMD ["Hello, Docker!"]

 ---> Running in 456def789abc

Removing intermediate container 456def789abc

 ---> 0123456789ab

Successfully built 0123456789ab

Successfully tagged entrypoint-cmd-example:latest

Runs the container from the image. It uses ENTRYPOINT as the command and CMD as the default argument.

Terminal

docker run entrypoint-cmd-example

Expected Output

Hello, Docker!

Runs the container but overrides CMD arguments with 'Goodbye, World!'. ENTRYPOINT remains the same.

Terminal

docker run entrypoint-cmd-example Goodbye, World!

Expected Output

Goodbye, World!

Overrides ENTRYPOINT to run 'ls' command instead of 'echo', and passes '-l' as argument.

Terminal

docker run --entrypoint ls entrypoint-cmd-example -l

Expected Output

bin

etc

lib

media

mnt

proc

root

sys

tmp

usr

var

→

--entrypoint - Overrides the ENTRYPOINT command for this run

Key Concept

ENTRYPOINT sets the fixed command that always runs, while CMD provides default arguments that can be overridden when starting the container.

Common Mistakes

Using CMD when you want a fixed command that should never be replaced.

CMD can be overridden by arguments passed to docker run, so the main command might change unexpectedly.

Use ENTRYPOINT to set the main command and CMD to set default arguments.

Writing ENTRYPOINT and CMD as strings instead of JSON arrays.

String form runs the command in a shell which can cause unexpected behavior and harder argument passing.

Always use JSON array syntax like ["executable", "arg1", "arg2"] for ENTRYPOINT and CMD.

Expecting CMD to run alone without ENTRYPOINT.

CMD only provides default arguments; without ENTRYPOINT, CMD runs as the command itself but can be overridden.

Use CMD alone only if you want a default command that can be replaced easily.

Summary

ENTRYPOINT sets the main command that always runs in the container.

CMD provides default arguments to ENTRYPOINT or a default command if ENTRYPOINT is not set.

Arguments passed to docker run override CMD but not ENTRYPOINT unless --entrypoint is used.