From 264478e0dcef3738981abd1e854115aed900770d Mon Sep 17 00:00:00 2001
From: Aneurin Barker Snook <aneurin@aneur.in>
Date: Sat, 19 Sep 2026 21:10:10 +0100
Subject: [PATCH] Drop ENTRYPOINT in favor of CMD ["pass-cli"]

Every real caller (code.aneur.in/cloud/cloud's deploy workflows) runs a
mounted-in script against pass-cli, not bare pass-cli args, so an
ENTRYPOINT override was needed on every invocation. With no ENTRYPOINT,
`docker run this-image sh /script.sh` just replaces CMD directly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 Dockerfile | 13 ++++++++-----
 README.md  | 17 ++++++++++++-----
 2 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 3ceb59c..0a5b41e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,10 +3,13 @@
 # (fcntl64, __res_init, ...) that Alpine's gcompat/libc6-compat don't shim,
 # so it can't run in e.g. the docker:cli image directly.
 #
-# ENTRYPOINT is pass-cli itself, so `docker run this-image <args>` behaves
-# like `pass-cli <args>`. Callers who need to run their own script against
-# pass-cli instead (login, fetch a note, parse it, etc.) override the
-# entrypoint: `docker run --entrypoint sh this-image /path/to/script.sh`.
+# No ENTRYPOINT -- just CMD ["pass-cli"]. `docker run this-image` runs bare
+# pass-cli; `docker run this-image <args>` replaces CMD entirely, so a
+# caller running their own script against pass-cli (login, fetch a note,
+# parse it, etc.) just does `docker run this-image sh /path/to/script.sh`
+# with no --entrypoint override needed. The cost: `docker run this-image
+# --version` doesn't work as shorthand -- write `docker run this-image
+# pass-cli --version` instead.
 
 FROM debian:bookworm-slim
 
@@ -26,4 +29,4 @@ RUN apt-get update \
 # No kernel keyring in a container -- store the session on disk instead.
 ENV PROTON_PASS_KEY_PROVIDER=fs
 
-ENTRYPOINT ["pass-cli"]
+CMD ["pass-cli"]
diff --git a/README.md b/README.md
index 64cdff5..f852fe6 100644
--- a/README.md
+++ b/README.md
@@ -20,22 +20,29 @@ its own glibc environment.
 
 ## Usage
 
-The image's `ENTRYPOINT` is `pass-cli` itself:
+There's no `ENTRYPOINT` -- just `CMD ["pass-cli"]`. Run bare:
 
 ```sh
-docker run --rm code.aneur.in/cloud/pass-cli:<tag> --version
+docker run --rm code.aneur.in/cloud/pass-cli:<tag>
 ```
 
 To run your own script against `pass-cli` instead (login, fetch an item,
-parse the result, etc.), override the entrypoint and mount the script in:
+parse the result, etc.), mount it in and pass it as the command -- it
+replaces `CMD` entirely, no `--entrypoint` override needed:
 
 ```sh
 docker run --rm \
   -e PROTON_PASS_PERSONAL_ACCESS_TOKEN \
   -v "$PWD/my-script.sh:/script.sh:ro" \
-  --entrypoint sh \
   code.aneur.in/cloud/pass-cli:<tag> \
-  /script.sh
+  sh /script.sh
+```
+
+For one-off interactive use, prefix `pass-cli` explicitly, since args
+replace `CMD` rather than appending to it:
+
+```sh
+docker run --rm code.aneur.in/cloud/pass-cli:<tag> pass-cli --version
 ```
 
 `PROTON_PASS_KEY_PROVIDER` is set to `fs` in the image by default, since a