{"record":{"id":"a317192ea2068814","repo":"argoproj/argo-workflows","slug":"failed-to-look-up-entrypoint-cmd-for-image-q-you","errorCode":null,"errorMessage":"failed to look-up entrypoint/cmd for image %q, you must either explicitly specify the command, or list the image's command in the index: https://argo-workflows.readthedocs.io/en/latest/workflow-executors/#emissary-emissary: %w","messagePattern":"failed to look-up entrypoint/cmd for image %q, you must either explicitly specify the command, or list the image's command in the index: https://argo-workflows\\.readthedocs\\.io/en/latest/workflow-executors/#emissary-emissary: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/controller/workflowpod.go","lineNumber":762,"sourceCode":"\t\t\treturn nil, errors.Wrap(err, \"\", \"Error applying PodSpecPatch\")\n\t\t}\n\t\tpod.Spec = *patchedPodSpec\n\t}\n\n\t// In init-less mode the emissary binary is mounted at /argo-bin via the\n\t// argoexec-bin image volume, not copied to /var/run/argo by an init container.\n\t// K8s image volumes expose the image's root filesystem as-is.\n\targoexecBinaryPath := pb.layout.argoexecBinaryPath()\n\tfor i, c := range pod.Spec.Containers {\n\t\tif !common.IsArgoSidecar(c.Name) {\n\t\t\t// https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#notes\n\t\t\tif len(c.Command) == 0 {\n\t\t\t\tvar x *entrypoint.Image\n\t\t\t\tx, err = pb.deps.lookupImage(ctx, c.Image, entrypoint.Options{\n\t\t\t\t\tNamespace: pb.in.namespace, ServiceAccountName: pb.in.execWfSpec.ServiceAccountName, ImagePullSecrets: pb.in.execWfSpec.ImagePullSecrets,\n\t\t\t\t})\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"failed to look-up entrypoint/cmd for image %q, you must either explicitly specify the command, or list the image's command in the index: https://argo-workflows.readthedocs.io/en/latest/workflow-executors/#emissary-emissary: %w\", c.Image, err)\n\t\t\t\t}\n\t\t\t\tc.Command = x.Entrypoint\n\t\t\t\tif c.Args == nil { // check nil rather than length, as zero-length is valid args\n\t\t\t\t\tc.Args = x.Cmd\n\t\t\t\t}\n\t\t\t}\n\t\t\texecCmd := append(append([]string{argoexecBinaryPath, \"emissary\"}, pb.deps.getExecutorLogOpts(ctx)...), \"--\")\n\t\t\tc.Command = append(execCmd, c.Command...)\n\t\t\t// PER USER CONTAINER: for ContainerSet templates with N members the\n\t\t\t// init-less argoexec-bin mount and WAIT_FOR_READY must land on every\n\t\t\t// member, so this stays inside the per-container loop.\n\t\t\tpb.layout.decorateUserContainer(&c, hasAuxCtr)\n\t\t}\n\t\tif c.Image == pb.in.executorImage {\n\t\t\t// mount tmp dir to the executor container (wait, or supervisor in init-less mode)\n\t\t\tc.VolumeMounts = append(c.VolumeMounts, apiv1.VolumeMount{\n\t\t\t\tName:      volumeTmpDir.Name,\n\t\t\t\tMountPath: \"/tmp\",","sourceCodeStart":744,"sourceCodeEnd":780,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/controller/workflowpod.go#L744-L780","documentation":"When building a workflow pod under the emissary executor, if a container specifies no command, the controller looks up the image's entrypoint/cmd in an index (docker hub or a configured registry index). This error means the lookup failed — either the index query errored or the image has no discoverable entrypoint — so the emissary pod cannot be constructed.","triggerScenarios":"A template container (or a container in a containerSet) omits `command` and entrypoint.LookupImage fails: image not found in the index, private registry auth failure, network error reaching the index, or the image genuinely declares no entrypoint.","commonSituations":"Scratch/distroless images with no ENTRYPOINT; private images not in the configured index; air-gapped clusters with no registry index access; typos in image names; switching executors to emissary where implicit entrypoint resolution is required.","solutions":["Explicitly set `command:` (and `args:`) on the container in the template so no lookup is needed","Verify the image exists and is pullable, and check the inner error for index/registry failures","Configure `containerRuntimeExecutor` index options / imagesPullSecrets or a custom entrypoint index for private registries","Add the image's command to a local index per the linked emissary docs"],"exampleFix":"// before\ncontainer:\n  image: myrepo/distroless-tool\n  args: [\"--flag\"]\n// after\ncontainer:\n  image: myrepo/distroless-tool\n  command: [\"/usr/bin/tool\"]\n  args: [\"--flag\"]","handlingStrategy":"validation","validationCode":"// in the Workflow template, always set command when the image may lack an ENTRYPOINT\n// argo lint my-wf.yaml  # validate before submit","typeGuard":null,"tryCatchPattern":"// controller-side\nx, err := pb.deps.lookupImage(ctx, c.Image, opts)\nif err != nil {\n    return nil, fmt.Errorf(\"failed to look-up entrypoint/cmd for image %q ...: %w\", c.Image, err)\n}","preventionTips":["Always specify `command:` for scratch/distroless/private images","Verify image pull secrets and registry connectivity","Test new images with a trivial workflow before production use","Read the emissary executor docs when migrating executors"],"tags":["emissary","container","image-entrypoint","registry"],"backgroundTag":"image-entrypoint-lookup-failed","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}