Compose deploy wraps service command in 'sh -c' appended after image ENTRYPOINT, breaking entrypoint+CMD images

[tizerluo]

Bug

When deploying a compose-style service with a command, Openship creates the container with Cmd=["sh","-c","<command>"] while preserving the image ENTRYPOINT. For images whose entrypoint is a binary that takes the command as argv (e.g. ENTRYPOINT ["node","dist/index.js"], CMD ["mcp"]), the process receives argv = ["sh","-c","<command>"], fails to parse it, prints usage and exits — the container restart-loops.

Reproduce

1. Create a folder-upload project with this compose:

services:
  app:
    image: ghcr.io/knockoutez/wigolo:0.2.1-full   # ENTRYPOINT ["node","dist/index.js"], CMD ["mcp"]
    command: ["serve", "--host", "0.0.0.0"]
    ports: ["127.0.0.1:3333:3333"]

2. Deploy to a server. Deployment reports ready, but docker inspect shows Cmd=["sh","-c","serve --host 0.0.0.0"] and the container restart-loops with exit code 1 (CLI prints its help text).

Both the compose list form (command: ["serve","--host","0.0.0.0"]) and a JSON-array string in the service API end up wrapped in sh -c.

Expected

Compose command (string or list) should map to the container Cmd (overriding image CMD), per docker-compose semantics — no sh -c wrapping appended after the entrypoint. If shell interpretation is needed, replacing the entrypoint or documenting the behavior would avoid silent breakage.

Workaround we used

Build a derivative image that bakes the args into ENTRYPOINT (ENTRYPOINT ["node","dist/index.js","serve","--host","0.0.0.0"], CMD []) and leave the service command empty — Openship accepts local (non-registry) images, which made this possible.

Environment: Openship self-hosted (cloud context), deployed 2026-07-30, target server Ubuntu 26.04 / Docker 29.6.2.

[ValenFelizia]

I traced the command pipeline and also compared OpenShip against Docker Compose using docker compose config, docker compose create, and docker inspect.

The confirmed behavior is:

• omitted / null command → Cmd: null, preserving the image CMD
• command: "" or command: [] → Cmd: [], explicitly clearing image CMD
• string-form commands are normalized to argv without an implicit shell
• list-form commands are preserved as argv
• shell execution only happens when /bin/sh -c is explicitly part of the command

OpenShip currently loses these semantics in three places:

1. API and CLI compose ingestion flatten list commands with .join(" ")
2. the stored service model only supports command as text and loses null vs empty
3. the Docker runtime wraps every non-empty command in ["sh", "-c", command]

A complete fix therefore needs a structured argv representation, not only a runtime change.

I think the safest design, or at least the safest I found, is an additive nullable JSONB field such as commandArgv, retaining the existing text command column for compatibility:

• both null → use image CMD
• commandArgv: [] → clear image CMD
• commandArgv: [...] → pass the argv directly to Docker
• existing text-only rows need an explicit compatibility policy

In order to procede with a PR to adress the fix, I would need to know if the team prefers:

1. the additive commandArgv approach, keeping legacy text rows, or
2. a broader migration that changes the existing command representation?

In that sense, another remaining compatibility decision is whether existing text rows should keep the current sh -c behavior or be normalized to Compose-compatible argv.

[Hydralerne]

fixed, thank you