4.2.7.1 ENTRYPOINT Fixed Executable

ENTRYPOINT fixed executable describes the central characteristic of ENTRYPOINT: the program it specifies is not optional or easily replaced the way CMD is — it defines what the container fundamentally is, in terms of what program it always executes.

Why "Fixed" Matters

Unlike CMD, which a caller can override entirely just by supplying a different command, ENTRYPOINT remains in effect even when arguments are supplied at run time — those arguments are appended to the fixed executable rather than replacing it.

ENTRYPOINT ["aws"]

docker run myimage s3 ls
docker run myimage ec2 describe-instances

Both invocations run the aws command with different arguments; neither replaces aws itself, because it is fixed by ENTRYPOINT.

Modeling an Image as a Specific Tool

This fixed-executable behavior is what allows an image to function as a distributable version of a specific command-line tool, where users interact with docker run myimage <args> much as they would interact with the underlying tool directly, without needing it installed locally.

docker run --rm -v "$(pwd)":/data myimage some-cli-tool-command

Genuinely Overriding the Fixed Executable

Because ENTRYPOINT is fixed only by default, it can still be explicitly replaced using the --entrypoint flag, which is primarily useful for debugging a container that would otherwise immediately execute its normal program.

docker run -it --entrypoint sh myimage

This deliberately bypasses the fixed executable to get an interactive shell instead, useful for inspecting the container's filesystem or environment directly.

Why Treating ENTRYPOINT as Fixed Matters

Designing an image around a fixed ENTRYPOINT communicates a clear contract to anyone using the image: this is what it does, and the supplied arguments only customize how it does it — a meaningfully different and more constrained design than an image whose entire command can be freely substituted.