What is the difference between the CMD and ENTRYPOINT instructions in a Dockerfile?
Understand CMD vs ENTRYPOINT in a Dockerfile: ENTRYPOINT fixes the executable, CMD sets overridable default arguments. Clear examples and gotchas.
Expected Interview Answer
ENTRYPOINT defines the fixed executable a container always runs, while CMD provides default arguments (or a default command) that are easily overridden at runtime by arguments passed to docker run.
When both are set in exec form, ENTRYPOINT is the command and CMD supplies its default arguments, so 'docker run image extra' replaces the CMD args but keeps the ENTRYPOINT. If only CMD is set, the whole thing is the default command and any docker run arguments replace it entirely. ENTRYPOINT is meant for containers that behave like a single dedicated program; CMD is for supplying sensible defaults that users may swap. You can override ENTRYPOINT itself with the --entrypoint flag, but that is deliberately less convenient.
- ENTRYPOINT locks in the container's core executable
- CMD gives overridable, sensible defaults
- Together they model 'program + default arguments' cleanly
- Makes images behave like self-contained CLI tools
- Clear separation between what always runs and what users can change
AI Mentor Explanation
ENTRYPOINT is the fixed role a specialist bowler is picked for — he always bowls, that never changes. CMD is the captain's default field setting he starts with, which can be waved to a new position ball by ball. The bowler (ENTRYPOINT) is constant; the field (CMD) is a suggested default the captain overrides at will, exactly as docker run arguments replace CMD while keeping ENTRYPOINT.
Step-by-Step Explanation
Step 1
Set the fixed executable
Use ENTRYPOINT in exec form to declare the program the container always runs, e.g. ENTRYPOINT ["python", "app.py"].
Step 2
Add default arguments
Use CMD to supply default arguments to that executable, e.g. CMD ["--port", "8080"].
Step 3
Understand the runtime merge
docker run arguments replace CMD but are appended to ENTRYPOINT, giving 'entrypoint + user args'.
Step 4
CMD-only fallback
With no ENTRYPOINT, CMD is the whole default command and docker run arguments replace it entirely.
Step 5
Override ENTRYPOINT when needed
Use docker run --entrypoint to replace the ENTRYPOINT itself, which is intentionally less convenient.
What Interviewer Expects
- ENTRYPOINT is the fixed command, CMD the overridable arguments/defaults
- How docker run arguments interact with each
- The exec form versus shell form distinction
- When to use ENTRYPOINT + CMD together
- How to override ENTRYPOINT with --entrypoint
Common Mistakes
- Claiming CMD and ENTRYPOINT are interchangeable
- Thinking docker run arguments replace ENTRYPOINT by default
- Using shell form and losing proper signal handling and argument passing
- Defining multiple CMD/ENTRYPOINT lines expecting all to run (only the last takes effect)
- Forgetting that CMD-only means arguments replace the entire command
Best Answer (HR Friendly)
“ENTRYPOINT is the main program a container always runs, and CMD is the set of default options for that program that people can easily change when they start the container. Used together, they make an image behave like a ready-to-use tool with sensible defaults.”
Code Example
FROM python:3.12-slim
WORKDIR /app
COPY app.py .
# The container always runs python app.py ...
ENTRYPOINT ["python", "app.py"]
# Default arguments, overridable at runtime
CMD ["--port", "8080"]
# docker run image -> python app.py --port 8080
# docker run image --port 9000 -> python app.py --port 9000Follow-up Questions
- What is the difference between exec form and shell form?
- How do you override ENTRYPOINT at runtime?
- Why does exec form handle signals better than shell form?
- What happens if you define CMD twice in one Dockerfile?
- When would you use only CMD and no ENTRYPOINT?
MCQ Practice
1. With ENTRYPOINT ["echo"] and CMD ["hello"], what does 'docker run image world' print?
The runtime argument 'world' replaces the CMD default 'hello' and is appended to the ENTRYPOINT, so it prints 'world'.
2. Which instruction is designed to be easily overridden by docker run arguments?
CMD provides default arguments or a default command that docker run arguments replace, whereas ENTRYPOINT stays fixed unless --entrypoint is used.
3. If only CMD is defined, what do docker run arguments do?
With no ENTRYPOINT, CMD is the whole default command, so runtime arguments replace it entirely.
Flash Cards
What is ENTRYPOINT? — The fixed executable a container always runs; runtime arguments are appended to it, not replaced.
What is CMD? — Default arguments (or a default command) that docker run arguments override.
How do they combine? — ENTRYPOINT is the command and CMD supplies its default args: 'entrypoint + (user args or CMD)'.
How to override ENTRYPOINT? — Use the docker run --entrypoint flag, which is deliberately less convenient than overriding CMD.