What is the difference between CMD and ENTRYPOINT in Docker?

In Docker, both `CMD` and `ENTRYPOINT` instructions are used to define the command that runs when a container starts. While they serve similar goals, their distinct behaviors offer different levels of flexibility and control over a container's primary function.

CMD (Command)

CMD is used to provide default arguments for an ENTRYPOINT instruction, or to execute an ad-hoc command inside a container. If no ENTRYPOINT is specified, CMD will define the executable itself. A Dockerfile can only have one CMD instruction; if multiple are present, only the last one takes effect.

FROM alpine
CMD ["echo", "Hello from CMD!"]

Users can easily override the CMD by providing arguments directly to the docker run command. For example, docker run myimage /bin/bash would ignore the CMD in the Dockerfile and execute /bin/bash instead.

ENTRYPOINT (Entry Point)

ENTRYPOINT specifies a command that will always be executed when the container starts. It sets the primary executable for the container, turning the image into something that acts like a single executable application. Arguments passed to docker run are appended as arguments to the ENTRYPOINT command.

FROM alpine
ENTRYPOINT ["echo"]
CMD ["Hello from CMD!"]

Overriding an ENTRYPOINT is less straightforward than CMD, requiring the --entrypoint flag with docker run. This makes ENTRYPOINT ideal for defining the core purpose of a container.

How they Work Together

The most common and powerful use case is combining ENTRYPOINT and CMD. In this setup, ENTRYPOINT defines the main executable, and CMD provides default arguments to that executable. If a user provides arguments to docker run, those arguments will override the CMD's arguments but still be passed to the ENTRYPOINT.

FROM ubuntu
ENTRYPOINT ["/usr/bin/apache2ctl"]
CMD ["-D", "FOREGROUND"]

In the above example, /usr/bin/apache2ctl -D FOREGROUND would be the command executed by default. If you run docker run myimage configtest, the command executed would be /usr/bin/apache2ctl configtest.

Key Differences and Use Cases

• CMD: Provides default arguments for an ENTRYPOINT or an executable command. It is easily overridden by arguments passed to docker run.
• ENTRYPOINT: Defines the main executable for the container. It is not easily overridden and ensures the container always runs a specific command.
• Use CMD for: Setting default flags for an ENTRYPOINT (e.g., CMD ["-g", "daemon off;"] for Nginx) or for providing a command that the user might want to override frequently (e.g., CMD ["bash"] for a utility image).
• Use ENTRYPOINT for: Making an image behave like an executable, where the container's primary purpose is to run a specific application (e.g., ENTRYPOINT ["node"] for a Node.js app or ENTRYPOINT ["nginx"] for an Nginx server).

Summary Table