The often misunderstood difference between ENTRYPOINT and CMD in Docker

TL;DR
System call formula: ENTRYPOINT + CMD
The ENTRYPOINT instruction specifies a system call that will be executed when the container starts.
The CMD instruction specifies arguments that will be fed to the ENTRYPOINT.
If no ENTRYPOINT is defined, the default ENTRYPOINT, /bin/sh -c, will be executed.

Using ENTRYPOINT alone

The _ENTRYPOINT_ instruction specifies a system call that will be executed as a system call when the container starts.

There are two main ways to define the ENTRYPOINT:

• in the Dockerfile, as an instruction
• in the command docker run, as a command line argument --entrypoint. This override the ENTRYPOINT defined in the Dockerfile

Let’s take an exemple. Let’s start by defining the ENTRYPOINT in the Dockerfile.

When we run the container, The entrypoint is executed.

We can override the entrypoint by passing it as a command line argument:

Using ENTRYPOINT and CMD together

The CMD instruction can complete the ENTRYPOINT instruction.
Let’s take an exemple. We re-use the Dockerfile wroten before, and append the line CMD[“HOME”] at the end.

Let’s run the container:

The container execute the command composed by the ENTRYPOINT and the CMD instruction. In this case it will be /bin/printenv HOME.
It’s possible to override the CMD present in the Dockerfile by specifing it it the command line. One can see the CMD present in the Dockerfile as the default option.
Here we’re gonna override the default CMD with the custom value HOSTNAME. We can see that the output of our container has changed: It now consist of the value of the environment variable HOSTNAME.

Using CMD alone

We can also define solely the CMD in the Dockerfile.
When no ENTRYPOINT is defined, the default system call is executed: /bin/sh -c.
Let’s take this Dockerfile to illustrate that:

Here we run the container using the CMD defined in the Dockerfile:

It’s also possible to override the default CMD by passing another CMD in the command line:

Conclusion

System call formula: _ENTRYPOINT_ + _CMD_
The _ENTRYPOINT_ instruction specifies a system call that will be executed when the container starts.
The _CMD_ instruction specifies arguments that will be fed to the _ENTRYPOINT_.
If no _ENTRYPOINT_ is defined, the default _ENTRYPOINT_, _/bin/sh -c_, will be executed.