fix(build, buildah, dockerfile, staged): ensure setting ENTRYPOINT correctly resets base image CMD

If CMD is defined from the base image, setting ENTRYPOINT will reset CMD to an empty value. In this scenario, CMD must be defined in the current image to have a value.

Reference: https://docs.docker.com/reference/dockerfile/#understand-how-cmd-and-entrypoint-interact

Signed-off-by: Alexey Igrychev <alexey.igrychev@flant.com>

Author: alexey-igrychev

pkg/build/image/dockerfile.go

@@ -176,6 +176,18 @@ func mapDockerfileToImagesSets(ctx context.Context, cfg *dockerfile.Dockerfile,
 			instrNum = 0
 		}
 
+		var entrypointResetCMD bool
+	loop:
+		for _, instr := range stg.Instructions {
+			switch any(instr).(type) {
+			case *dockerfile.DockerfileStageInstruction[*instructions.CmdCommand]:
+				entrypointResetCMD = false
+				break loop
+			case *dockerfile.DockerfileStageInstruction[*instructions.EntrypointCommand]:
+				entrypointResetCMD = true
+			}
+		}
+
 		for _, instr := range stg.Instructions {
 			stageLogName := fmt.Sprintf("%s%d", strings.ToUpper(instr.GetInstructionData().Name()), instrNum+1)
 			isFirstStage := (len(img.stages) == 0)
@@ -193,7 +205,7 @@ func mapDockerfileToImagesSets(ctx context.Context, cfg *dockerfile.Dockerfile,
 			case *dockerfile.DockerfileStageInstruction[*instructions.CopyCommand]:
 				stg = stage_instruction.NewCopy(typedInstr, dockerfileImageConfig.Dependencies, !isFirstStage, &baseStageOptions)
 			case *dockerfile.DockerfileStageInstruction[*instructions.EntrypointCommand]:
-				stg = stage_instruction.NewEntrypoint(typedInstr, dockerfileImageConfig.Dependencies, !isFirstStage, &baseStageOptions)
+				stg = stage_instruction.NewEntrypoint(typedInstr, dockerfileImageConfig.Dependencies, !isFirstStage, entrypointResetCMD, &baseStageOptions)
 			case *dockerfile.DockerfileStageInstruction[*instructions.EnvCommand]:
 				stg = stage_instruction.NewEnv(typedInstr, dockerfileImageConfig.Dependencies, !isFirstStage, &baseStageOptions)
 			case *dockerfile.DockerfileStageInstruction[*instructions.ExposeCommand]:

pkg/build/stage/instruction/entrypoint.go

@@ -18,8 +18,8 @@ type Entrypoint struct {
 	*Base[*instructions.EntrypointCommand, *backend_instruction.Entrypoint]
 }
 
-func NewEntrypoint(i *dockerfile.DockerfileStageInstruction[*instructions.EntrypointCommand], dependencies []*config.Dependency, hasPrevStage bool, opts *stage.BaseStageOptions) *Entrypoint {
-	return &Entrypoint{Base: NewBase(i, backend_instruction.NewEntrypoint(*i.Data), dependencies, hasPrevStage, opts)}
+func NewEntrypoint(i *dockerfile.DockerfileStageInstruction[*instructions.EntrypointCommand], dependencies []*config.Dependency, hasPrevStage, entrypointResetCMD bool, opts *stage.BaseStageOptions) *Entrypoint {
+	return &Entrypoint{Base: NewBase(i, backend_instruction.NewEntrypoint(*i.Data, entrypointResetCMD), dependencies, hasPrevStage, opts)}
 }
 
 func (stg *Entrypoint) GetDependencies(ctx context.Context, c stage.Conveyor, cb container_backend.ContainerBackend, prevImage, prevBuiltImage *stage.StageImage, buildContextArchive container_backend.BuildContextArchiver) (string, error) {

pkg/buildah/common.go

@@ -106,13 +106,17 @@ type ConfigOpts struct {
 	CmdPrependShell        bool
 	Entrypoint             []string
 	EntrypointPrependShell bool
-	User                   string
-	Workdir                string
-	Healthcheck            *thirdparty.BuildahHealthConfig
-	OnBuild                string
-	StopSignal             string
-	Shell                  []string
-	Maintainer             string
+
+	// If CMD is defined from the base image, setting ENTRYPOINT will reset CMD to an empty value.
+	// https://docs.docker.com/reference/dockerfile/#understand-how-cmd-and-entrypoint-interact
+	EntrypointResetCMD bool
+	User               string
+	Workdir            string
+	Healthcheck        *thirdparty.BuildahHealthConfig
+	OnBuild            string
+	StopSignal         string
+	Shell              []string
+	Maintainer         string
 }
 
 type CopyOpts struct {

pkg/buildah/native_linux.go

@@ -641,6 +641,10 @@ func (b *NativeBuildah) Config(ctx context.Context, container string, opts Confi
 		builder.SetShell(opts.Shell)
 	}
 
+	if opts.EntrypointResetCMD {
+		builder.SetCmd(nil)
+	}
+
 	if len(opts.Cmd) > 0 {
 		var cmd []string
 		if opts.CmdPrependShell {

pkg/container_backend/instruction/entrypoint.go

@@ -12,10 +12,11 @@ import (
 
 type Entrypoint struct {
 	instructions.EntrypointCommand
+	EntrypointResetCMD bool
 }
 
-func NewEntrypoint(i instructions.EntrypointCommand) *Entrypoint {
-	return &Entrypoint{EntrypointCommand: i}
+func NewEntrypoint(i instructions.EntrypointCommand, entrypointResetCMD bool) *Entrypoint {
+	return &Entrypoint{EntrypointCommand: i, EntrypointResetCMD: entrypointResetCMD}
 }
 
 func (i *Entrypoint) UsesBuildContext() bool {
@@ -27,6 +28,7 @@ func (i *Entrypoint) Apply(ctx context.Context, containerName string, drv builda
 		CommonOpts:             drvOpts,
 		Entrypoint:             i.CmdLine,
 		EntrypointPrependShell: i.PrependShell,
+		EntrypointResetCMD:     i.EntrypointResetCMD,
 	}); err != nil {
 		return fmt.Errorf("error setting entrypoint %v for container %s: %w", i.CmdLine, containerName, err)
 	}