How to Fix Docker Exec Format Error

Docker reports exec format error when the Linux kernel cannot execute the configured entrypoint or command. The most common causes are an image built for the wrong CPU architecture, a script with an invalid shebang, Windows line endings, or an entrypoint that is not a valid executable for the container.

Capture the failing command

Inspect the container state and logs:

docker ps -a --no-trunc
docker logs CONTAINER
docker inspect CONTAINER --format '{{json .Config.Entrypoint}} {{json .Config.Cmd}}'
docker inspect CONTAINER --format 'image={{.Image}} error={{.State.Error}} exit={{.State.ExitCode}}'

Determine whether the error occurs while starting the container or only when running docker exec. A startup failure points to the image entrypoint or command; an exec failure may concern only the binary supplied to that command.

Compare image and host architecture

Check the Docker host and image metadata:

docker info --format '{{.Architecture}}'
docker image inspect IMAGE --format '{{.Os}}/{{.Architecture}} {{.Variant}}'
docker buildx imagetools inspect IMAGE

A Linux arm64 image does not run natively on an amd64 host, and the reverse is also true. Docker Desktop may provide emulation, but a Linux server may not have the required binfmt_misc handlers.

If the registry image is multi-platform, confirm that its manifest includes the deployment platform. Avoid forcing --platform merely to silence the error: selecting an incompatible image without available emulation still fails, and emulation can change performance and behavior.

Inspect the entrypoint file

If the entrypoint is a script, extract or inspect it without starting the container:

container_id=$(docker create IMAGE)
docker cp "$container_id:/path/to/entrypoint" /tmp/entrypoint
docker rm "$container_id"
file /tmp/entrypoint
head -n 1 /tmp/entrypoint

The first line should contain a valid interpreter path, such as:

#!/bin/sh

The interpreter must exist inside the image. A script using #!/bin/bash fails in a minimal image that contains only /bin/sh.

Check line endings and encoding

Windows CRLF line endings can turn the interpreter path into something like /bin/sh\r, which does not exist:

file /tmp/entrypoint
sed -n '1l' /tmp/entrypoint

Normalize the source file to LF before building the image. Also check for a byte-order mark before #!, because the shebang must begin at the first bytes of the file.

Configure the repository to preserve Unix line endings for shell scripts rather than converting files manually after every checkout.

Verify executable type and permissions

file /tmp/entrypoint
ls -l /tmp/entrypoint

An architecture-specific binary should match both the container OS and CPU architecture. A text file needs a valid interpreter. Missing execute permission usually produces permission denied, but should still be corrected explicitly in the Dockerfile:

COPY --chmod=755 entrypoint.sh /usr/local/bin/entrypoint

If your builder does not support COPY --chmod, use a deliberate RUN chmod layer.

Review Dockerfile command form

Prefer the exec form when the program does not require shell expansion:

ENTRYPOINT ["/usr/local/bin/entrypoint"]
CMD ["serve"]

JSON-array syntax passes arguments directly. Shell form invokes a shell, which can conceal quoting mistakes and affects signal delivery. Confirm that Compose or the deployment platform does not override the image’s entrypoint with a malformed command.

Rebuild for the intended platform

Build and publish the platform you actually deploy:

docker buildx build --platform linux/amd64 -t IMAGE .

For a multi-platform release, specify each supported platform and push a manifest list only after testing the architecture-specific images. Pin base images and verify that build stages do not copy a host-compiled binary into a different target architecture.

Diagnose it with Rumus

Diagnose this Docker exec format error. Identify the exact failing entrypoint or
command; compare host, image, manifest and binary architectures; inspect the
entrypoint shebang, interpreter availability, line endings, encoding, executable
type and permissions, plus Dockerfile and Compose overrides. Start read-only and
do not rebuild, publish, recreate, or change platform settings without approval.

Confirm the fix

Inspect the rebuilt image before deploying it:

docker image inspect IMAGE --format '{{.Os}}/{{.Architecture}}'
docker run --rm IMAGE

Confirm the container starts on the same architecture used in production, remains running as expected, handles signals correctly, and does not depend on accidental emulation available only on a developer machine.