Entrypoint

The command the runtime executes as the container's first process, plus the default arguments an orchestrator can override. The distinction between the fixed part and the overridable part is where most confusion lives, and wrapping it in a shell form quietly inserts an extra process that becomes PID 1. Getting it wrong shows up as containers that ignore SIGTERM and are killed by the grace-period timeout on every deployment.