Docker

Docker ENTRYPOINT vs CMD: your container lied to you

ENTRYPOINT defines the executable; CMD supplies default arguments. Use exec form so signals reach your application and command overrides behave predictably.

By Thien Nguyen

Updated July 6, 2026 · 1 min read

Containers often fail to shut down cleanly because a shell wrapper became PID 1 instead of the application.

ENTRYPOINT ["node", "server.js"]
CMD ["--port", "3000"]

Short answer: use ENTRYPOINT for the fixed executable and CMD for defaults callers may replace. Prefer JSON exec form, not shell form, so SIGTERM reaches the process that must handle it.

Instruction	Role
ENTRYPOINT	What the image runs
CMD	Default arguments/command

Shell-form CMD node server.js inserts a shell and changes signal handling. It is rarely what a service container wants.

Make runtime overrides intentional, then test docker stop rather than assuming the Dockerfile tells the truth.

Cover photo by Stanislav Kondratiev on Pexels.

References

Primary documentation and specifications checked when this article was last updated.

Dockerfile reference

DockerContainersDevOps

Related articles

Docker multi-stage builds: shrink your image without breaking the deploy

Container graceful shutdown: SIGTERM is the beginning, not the shutdown

DNS records for developers: the records you actually configure

Env files and secrets management: `.env` is configuration, not a vault