What are the differences between CMD and ENTRYPOINT in Dockerfile?

CMD and ENTRYPOINT are both used to specify what command runs when container starts, but they behave differently: 1) CMD: Provides default command and arguments, Can be overridden by docker run arguments, Only last CMD instruction is used, Example: CMD ["nginx", "-g", "daemon off;"], 2) ENTRYPOINT: Configures container as executable, Cannot be overridden (only appended to), Arguments from docker run are passed to ENTRYPOINT, Example: ENTRYPOINT ["nginx"], CMD ["-g", "daemon off;"], 3) Combined usage: ENTRYPOINT defines the executable, CMD provides default arguments, docker run myapp -t will run "nginx -t" instead of "nginx -g daemon off;", 4) Best practices: Use ENTRYPOINT for main command, Use CMD for default arguments, Use exec form (JSON array) for both to avoid shell overhead.