Problem
A Dockerfile must have one CMD and one ENTRYPOINT instruction. When multiple instructions exist, only the last one takes effect, which can cause unexpected behavior.
Description
Docker applies only the final CMD or ENTRYPOINT in a stage. Earlier declarations are overridden, which can mislead maintainers and hide real startup behavior during reviews.
Ambiguous startup definitions cause avoidable production issues, especially when scripts rely on one command but the image runs another. Keeping one explicit startup contract improves reliability and shortens incident diagnosis.
Related rules: use JSON notation for CMD and ENTRYPOINT, avoid multiple HEALTHCHECK instructions, avoid duplicate stage aliases.
Solution
Define one CMD and one ENTRYPOINT per stage, and make startup intent explicit so container runtime behavior stays deterministic.
Problematic code
FROM ubuntu:20.04
USER nobody
# Multiple CMD instructions: only the last one is used.
CMD ["echo", "Hello"]
CMD ["echo", "World"]
# Multiple ENTRYPOINT instructions: only the last one is used.
ENTRYPOINT ["run-app"]
ENTRYPOINT ["start-app"]Verified code
FROM ubuntu:20.04
USER nobody
# Single CMD instruction ensures the correct command runs.
CMD ["echo", "Hello World"]
# Single ENTRYPOINT instruction ensures the correct entrypoint runs.
ENTRYPOINT ["start-app"]