Understanding CMD and ENTRYPOINT Differences in Docker

Whenever we are working on Docker, people often get confused between commands like CMD and ENTRYPOINT which are mostly used while writing a Dockerfile. However, if you are a beginner and just started using Docker or you don’t have enough hands-on experience, this blog will help you to understand these commands in-depth with hands-on examples.

Before we begin, it is important to discuss the forms of instructions. Docker ENTRYPOINT and CMD can have two forms i.e, Shell & Exec form.

For example:
<instruction> <command>  ---> shell form
<instruction> ["executable", "parameter"]  ---> exec form

• CMD echo "Hello World" (shell form)
• CMD ["echo", "Hello World"] (exec form)
• ENTRYPOINT echo "Hello World" (shell form)
• ENTRYPOINT ["echo", "Hello World"] (exec form)

What are CMD & ENTRYPOINT?

Before moving ahead with the differences and some hands-on, let's try to understand what are these and why we need them. Both parameters are used to specify the programs/commands to execute while initializing a container from the docker image.

CMD: Sets default parameters that can be overridden from the Docker command line interface (CLI) while running a Docker container.

ENTRYPOINT: Sets default parameters that cannot be overridden while executing Docker containers with CLI parameters.

Different between CMD & ENTRYPOINT

As we discussed above, these are used to specify programs that execute when a container starts, but the major differences between the two are:
CMD commands are ignored by the daemon when there are parameters stated within the docker run command while ENTRYPOINT instructions are not ignored but instead are appended as command line parameters by treating those as arguments of the command.

Now, let’s take a closer look. We’ll use both command forms to go through the different stages of running a Docker container.

Docker CMD

CMD in Dockerfile defines the default executable of a Docker image. You can run this image as the base of a container without adding command-line arguments. In that case, the container runs the process specified by the CMD command.

The CMD instructions are only utilized if there is no argument added to the run command when starting a container. Therefore, if you add an argument to the command, you override the CMD command specified.

To demonstrate how CMD works, we will create a sample container with CMD instructions. Here's a sample Dockerfile using Ubuntu as a base image and a basic CMD instruction.

FROM ubuntu
CMD ["echo", "Hello World"]

Now, let’s build an image out of this Dockerfile and run a container from the image created. To build an image with Dockerfile, use the following command:

docker build -t cmd-instructions .

To run a container out of the image build, execute the following command:

docker run cmd-instructions

Once you run the container, it prints Hello World and exists as you can see in the above image. This is so because no command line arguments were passed and hence default CMD instructions were executed. However, if you add an argument while starting a container, it overrides the CMD instructions given in Dockerfile. To override the default CMD instructions, execute the following commands:

docker run cmd-instructions echo "message changed"

docker run cmd-instructions printenv

As you can see in the above image, when we passed parameters with docker run a command, the default CMD instructions were overridden and it gives the output as the value of commands passed as arguments.

Note: If multiple CMD instructions are passed in a Dockerfile, all execpt the last instruction will be ignored.

Docker ENTRYPOINT

ENTRYPOINT is another instruction used to specify the behavior of the container once started. Just like with CMD, we need to specify a command and parameters. However, in the case of ENTRYPOINT we cannot override the ENTRYPOINT instructions by adding command-line parameters to the docker run command. By opting for this instruction method, you imply that the container is specifically built for certain use cases where the command should not be overridden.

Let's start the hands-on. We will again create a sample Dockerfile using Ubuntu as a base image, but this time providing an ENTRYPOINT command instead in Dockerfile as mentioned below.

FROM ubuntu
ENTRYPOINT ["echo", "Hello World"]

Now again, let’s build an image out of this Dockerfile and run a container from the image. Execute the below command to build an image and run the container from the docker image.

docker build -t entrypoint-instructions 
docker run entrypoint-instructions

The above command will print the ENTRYPOINT instructions mentioned in Dockerfile as you can see in the below image. Now let's try to pass some command line arguments and see if it overrides the default instructions or not.

As you can see in the above image, docker run did not override the initial instruction but took our argument i.e, printenv command as a parameter for echo instruction.

Note: The default nature of ENTRYPOINT in Dockerfile is not to be overridden by parameters passed in command, but with some explicit docker flags, it can be overriden. Let's look into it.

If you want to override the ENTRYPOINT instructions, execute the following command.

docker run --entrypoint printenv entrypoint-instructions

Note: The command passed in --entrypoint argument is temporary and once your exit out of the container and run the container again, it would take the default ENTRYPOINT instructions if --entrypoint is not passed explicitly.

Using ENTRYPOINT & CMD Together

There are fundamental differences between ENTRYPOINT and CMD but there can be many situations in which combining both would be the best solution for the Docker container. In such cases, the executable is defined with ENTRYPOINT, while CMD specifies the default parameter.

Note: If you are using both instructions, make sure to keep them in exec form.

Let's create a new Dockerfile with both the parameters stated. Here's a sample Dockerfile with both instructions.

FROM ubuntu
ENTRYPOINT ["echo", "Hello"]
CMD ["Abhinav"]

Now, let's build the image and run the container using docker run. The expected output should be the command passed in ENTRYPOINT followed by CMD instructions.

docker build -t entrypoint-cmd .
docker run entrypoint-cmd

As observed in the above image, the output of the command is default ENTRYPOINT instructions followed by CMD those given in the Dockerfile. Now let's try to pass some parameters and see the changes.

docker run entrypoint-cmd @abhinavd26

As you can see the ENTRYPOINT took "echo" as instruction and CMD as a parameter that's why the parameter that we passed got overridden in CMD and later on ENTRYPOINT took it as a parameter.

Use Cases

Prefer ENTRYPOINT to CMD when building executable Docker images, and you need a command always to be executed. Additionally, use CMD if you need to provide extra default arguments that could be overwritten from the command line when the docker container runs. It is not necessary to use both commands together, try to find your use case while building the Dockerfile and select the appropriate command.

After you have built the Docker containers, you may want to orchestrate them using Kubernetes. Within Kubernetes, there is a different mechanism of defining the Entrypoint and CMDs for the contianer running inside the pod.

Kubernetes uses something called as Commands and Arguments which are defined in the container spec in the configruation files. To learn about Commands and Arguments in Kubernetes, please check out this detailed blog.

Conclusion

Hurray! You made it to the end hope you got a better understanding of how ENTRYPOINT and CMD works and when to use them in your own projects. Explore and try out this with different scenarios and feel free to join our discord community. We would be happy to help you.