What is the difference between ENTRYPOINT and CMD in a Dockerfile?

In a Dockerfile, ENTRYPOINT and CMD specify commands that will be executed when the container starts, but they serve different purposes and behaviors:

• ENTRYPOINT defines the main executable of the container. It always runs and cannot be overridden by command-line arguments when starting the container (unless using --entrypoint). This makes the container more predictable.

• CMD sets default arguments for ENTRYPOINT or, if ENTRYPOINT is not set, the default command. CMD can be overridden when starting the container by passing different arguments.

Example:

ENTRYPOINT ["/usr/bin/python3"]
CMD ["app.py"]

When starting the container, by default, /usr/bin/python3 app.py will be executed. If other arguments are provided at runtime, for example docker run image script.py, the command will be /usr/bin/python3 script.py.

If only CMD is set, for example:

CMD ["echo", "Hello"]

then echo Hello will be executed when the container runs, but if other arguments are provided, they will completely replace CMD.

Thus, ENTRYPOINT fixes the executable, and CMD sets default parameters that can be overridden.