Fix command/entrypoint mapping to match Docker semantics

command was mapped to ContainerSpec.Command (ENTRYPOINT) instead of
ContainerSpec.Args (CMD). This broke images with entrypoints like
cloudflare/cloudflared where command: ["tunnel", "run", ...] would
try to execute "tunnel" as a binary instead of passing it as args
to the cloudflared entrypoint.

Author: firecow

examples/swarm-app.yml

@@ -21,6 +21,7 @@ service_specs:
   # {% endif %}
 
   nginx:
+    entrypoint: ["/docker-entrypoint.sh"]
     command: ["nginx", "-g", "daemon off;"]
     image: {{ env.NGINX_IMAGE_REF }}
     container_labels:

src/service-spec.ts

@@ -72,7 +72,8 @@ export function initServiceSpec ({appName, serviceName, config, hashedConfigs, c
             ContainerSpec: {
                 Image: serviceConfig.image,
                 Labels: serviceConfig.container_labels,
-                Command: serviceConfig.command,
+                Command: serviceConfig.entrypoint,
+                Args: serviceConfig.command,
                 Env: env,
                 StopSignal: serviceConfig.stop_signal,
                 StopGracePeriod: serviceConfig.stop_grace_period,

tests/service-spec.test.ts

@@ -0,0 +1,60 @@
+import {test, expect} from "@jest/globals";
+import {initServiceSpec} from "../src/service-spec.js";
+import {HashedConfigs} from "../src/hashed-config.js";
+import {SwarmAppConfig} from "../src/swarm-app-config.js";
+import {assertTaskTemplateContainerTaskSpec} from "../src/asserts.js";
+
+test("command maps to Args and entrypoint maps to Command", () => {
+    const config: SwarmAppConfig = {
+        networks: {
+            default: {name: "test-network", external: true},
+        },
+        service_specs: {
+            server: {
+                image: "cloudflare/cloudflared:2026.3.0",
+                entrypoint: ["cloudflared", "--no-autoupdate"],
+                command: ["tunnel", "run", "some-uuid"],
+                service_labels: {"com.docker.stack.namespace": "test"},
+                container_labels: {"com.docker.stack.namespace": "test"},
+            },
+        },
+    };
+
+    const spec = initServiceSpec({
+        appName: "test",
+        serviceName: "server",
+        config,
+        hashedConfigs: new HashedConfigs(),
+    });
+
+    assertTaskTemplateContainerTaskSpec(spec);
+    expect(spec.TaskTemplate.ContainerSpec.Command).toEqual(["cloudflared", "--no-autoupdate"]);
+    expect(spec.TaskTemplate.ContainerSpec.Args).toEqual(["tunnel", "run", "some-uuid"]);
+});
+
+test("command without entrypoint sets Args only", () => {
+    const config: SwarmAppConfig = {
+        networks: {
+            default: {name: "test-network", external: true},
+        },
+        service_specs: {
+            server: {
+                image: "nginx:latest",
+                command: ["nginx", "-g", "daemon off;"],
+                service_labels: {"com.docker.stack.namespace": "test"},
+                container_labels: {"com.docker.stack.namespace": "test"},
+            },
+        },
+    };
+
+    const spec = initServiceSpec({
+        appName: "test",
+        serviceName: "server",
+        config,
+        hashedConfigs: new HashedConfigs(),
+    });
+
+    assertTaskTemplateContainerTaskSpec(spec);
+    expect(spec.TaskTemplate.ContainerSpec.Command).toBeUndefined();
+    expect(spec.TaskTemplate.ContainerSpec.Args).toEqual(["nginx", "-g", "daemon off;"]);
+});