4.2.6.5 CMD Entrypoint Pairing

CMD entrypoint pairing is the common Dockerfile pattern of using ENTRYPOINT to define a fixed executable and CMD to supply default arguments to it, combining a stable, non-overridable command with flexible, overridable defaults.

How the Pairing Works

When both are present, ENTRYPOINT defines what always runs, while CMD's contents are appended as arguments to it — overriding CMD at run time changes only the arguments, not the underlying executable being run.

ENTRYPOINT ["python", "app.py"]
CMD ["--mode", "production"]

docker run myapp
docker run myapp --mode development

Both invocations run python app.py, with the second supplying different arguments than the image's default.

Why This Pairing Is Useful

This pairing is particularly valuable for images meant to behave like a specific, fixed command-line tool, where the actual program to run should never change, but the specific options or subcommands passed to it reasonably might.

ENTRYPOINT ["myapp"]
CMD ["serve", "--port", "8080"]

docker run myimage migrate

This image behaves like the myapp command-line tool itself, with serve --port 8080 as its default invocation, while still allowing any other valid subcommand to be substituted easily.

Contrasting With CMD Alone

Without ENTRYPOINT, a runtime override replaces the entire command, including the executable itself, which is a meaningfully different and less constrained behavior than overriding only the arguments to a fixed program.

CMD ["python", "app.py"]

docker run myapp some-completely-different-program

This works without error, since there is no ENTRYPOINT constraining what program ultimately runs.

Why This Pairing Pattern Matters

Pairing ENTRYPOINT and CMD this way gives an image both a stable identity (always running the same underlying program) and practical flexibility (supporting different arguments or subcommands), which is generally the most useful combination for images intended to be used as reusable tools rather than single-purpose, fixed invocations.