Differences Between Dockerfile Instructions in Shell and Exec Form

Question

What is the difference between shell and exec form for

CMD:

CMD python my_script.py arg

vs.

CMD ["python", "my_script.py", "arg"]

ENTRYPOINT:

ENTRYPOINT ./bin/main

vs.

ENTRYPOINT ["./bin/main"]

and RUN:

RUN npm start

vs.

RUN ["npm", "start"]

Dockerfile instructions?

Answer 1

There are two differences between the shell form and the exec form. According to the documentation, the exec form is the preferred form. These are the two differences:

The exec form is parsed as a JSON array, which means that you must use double-quotes (“) around words not single-quotes (‘).

Unlike the shell form, the exec form does not invoke a command shell. This means that normal shell processing does not happen. For example, CMD [ "echo", "$HOME" ] will not do variable substitution on $HOME. If you want shell processing then either use the shell form or execute a shell directly, for example: CMD [ "sh", "-c", "echo $HOME" ]. When using the exec form and executing a shell directly, as in the case for the shell form, it is the shell that is doing the environment variable expansion, not docker.

Some additional subtleties here are:

The exec form makes it possible to avoid shell string munging, and to RUN commands using a base image that does not contain the specified shell executable.

In the shell form you can use a \ (backslash) to continue a single RUN instruction onto the next line.

There is also a third form for CMD:

CMD ["param1","param2"] (as default parameters to ENTRYPOINT)

Additionally, the exec form is required for CMD if you are using it as parameters/arguments to ENTRYPOINT that are intended to be overwritten.