The ENTRYPOINT argument can be used for executing a specific command.

The ENTRYPOINT specifies a command that will always be executed when the container starts.

The CMD arguments will not be passed to the ENTRYPOINT.

The ENTRYPOINT is the top level directory for you application.

If you accidentally publish a credential(s), Delete the public image and update the credentials on whatever system(s) it has compromised

Data in a Docker volume is preserved as part of the docker commit operation so dont store credentials in volumes such as external api access keys

If a Docker image is deleted from the Docker Index then any sensitive data exposed will be safe

If a Docker image is deleted from the Docker Hub then any sensitive data exposed will be safe