CMD vs ENTRYPOINT

What actually runs when a container starts.

Two instructions decide what runs when a container starts, and beginners constantly confuse them. CMD sets the default command and arguments — and anything you type after the image name on docker run replaces it. ENTRYPOINT sets a fixed executable that always runs, with docker run arguments appended to it rather than replacing it. Roughly: CMD is “the default, override me freely,” ENTRYPOINT is “this container is this program.”

# CMD only: the default, fully overridable
CMD ["nginx", "-g", "daemon off;"]
#   docker run myimage echo hi   ->  runs "echo hi" instead
 
# ENTRYPOINT only: fixed program, run args become its arguments
ENTRYPOINT ["curl"]
#   docker run myimage https://example.com  ->  runs "curl https://example.com"

Using them together

The idiomatic pattern combines the two: ENTRYPOINT is the executable, and CMD supplies default arguments that a user can override. The container behaves like a command-line tool — run it with no arguments and it does the sensible default; run it with arguments and they flow through to the entrypoint.

ENTRYPOINT ["python", "backup.py"]
CMD ["--help"]
#   docker run backup                 ->  python backup.py --help
#   docker run backup /data --gzip     ->  python backup.py /data --gzip