CMD is not recognising VM environment variable in Dockerfile - docker

Question

We have a dockerfile that uses both ENTRYPOINT and CMD to execute a script and start our java application respectively. It contains other information, but essentially looks like this:
ENTRYPOINT ["/home/config/wait-for-elastic.sh", "http://localhost:9200", "home/config/createElasticIndex.sh"]
CMD java -Xdebug -Xrunjdwp:transport=dt_socket,address=0.0.0.0:9700,server=y,suspend=n -jar -Dlog4j.configurationFile=/home/config/log4j2.yaml application.jar --spring.config.name=application,kafka --spring.config.location=/home/config
This have been working fine, until today when I went to add some encryption libraries (Jasypt) to our project to secure our passwords. Having setup the application to use Jasypt, I now have to add the following arguement to my CMD command to provide the application the master password like so -Djasypt.encryptor.password=password. I've tested that using this, the container can run fine without issue. However this is obviously not very secure providing the password in plaintext through the command. So I've added the password as an environment variable called JASYPT_ENCRYPTOR_PASSWORD into the container via my Kubernetes deployment.yaml file. I've also verified this exists within the container by using printenv.
CMD java -Xdebug -Xrunjdwp:transport=dt_socket,address=0.0.0.0:9700,server=y,suspend=n -jar -Djasypt.encryptor.password=$JASYPT_ENCRYPTOR_PASSWORD -Dlog4j.configurationFile=/home/config/log4j2.yaml application.jar --spring.config.name=application,kafka --spring.config.location=/home/config
But this then results in the container crashing with an EncryptionOperationNotPossibleExeception. It looks like the command is using the the word $JASYPT_ENCRYPTOR_PASSWORD as opposed the value of the environment variable itself. I do not understand why this is happening. I have tried a number of different approaches, such as using CMD with an array of arguments like
CMD ["java", "-Xdebug", "-Xrunjdwp:transport=dt_socket,address=0.0.0.0:9700,server=y,suspend=n", "-jar", "-Djasypt.encryptor.password=$JASYPT_ENCRYPTOR_PASSWORD", "-Dlog4j.configurationFile=/home/config/log4j2.yaml", "application.jar", "--spring.config.name=application,kafka", "--spring.config.location=/home/config"]
But that seems to crash with other errors about the formatting being incorrect. So I am stuck as to how to resolve this.
I was able to get it to work by switching from using CMD to ENTRYPOINT with the above command like so
ENTRYPOINT ["java", "-Xdebug", "-Xrunjdwp:transport=dt_socket,address=0.0.0.0:9700,server=y,suspend=n", "-jar", "-Djasypt.encryptor.password=${JASYPT_ENCRYPTOR_PASSWORD}", "-Dlog4j.configurationFile=/home/config/log4j2.yaml", "application.jar", "--spring.config.name=application,kafka", "--spring.config.location=/home/config"]
But this then creates a problem where I can't have 2 ENTRYPOINT commands in the same Dockerfile.
Can anyone help with why the CMD command doesn't recognise the VM environment variable?
EDIT: Also if it's important, this container is being deployed to a Minikube environment via a normal Kubernetes deployment yaml file with the kubectl apply command.
EDIT 2: How I set the env variable in the deployment.yaml file:
---
apiVersion: v1
kind: Deployment
metadata:
name: my-app
lables:
app: my-app
spec:
replicas: 1
template:
spec:
containers:
- name: my-app
image: my-image
imagePullPolicy: IfNotPresent
volumeMounts:
- name: my-app-logs
mountPath: /home/logs
env:
- name: JASYPT_ENCRYPTOR_PASSWORD
value: "password"
EDIT 3:
I've found something unusual. If I change my CMD command to be
CMD ["/bin/sh", "-c", "java -Xdebug -Xrunjdwp:transport=dt_socket,address=0.0.0.0:9700,server=y,suspend=n, -jar -Djasypt.encryptor.password=$JASYPT_ENCRYPTOR_PASSWORD -Dlog4j.configurationFile=/home/config/log4j2.yaml application.jar --spring.config.name=application,kafka --spring.config.location=/home/config"]
and remove the ENTRYPOINT line, everything works fine, because the environment variable is being read correctly. I've verified this by simply running CMD ["/bin/sh", "echo $JASYPT_ENCRYPTOR_PASSWORD"] which prints "password", which is the correct value. However if I add the ENTRYPOINT line back in, then everything crashes again since the env var is being read in as an empty string. I have no idea why changing the CMD command the one above works different the one I had before.
EDIT 4: I believe I've narrowed this down to being an issue with how I'm using the CMD and ENTRYPOINT commands, due to not understanding how they interact with one another when run in the same way. I've found this link in the docker documentation, but still don't fully understand how to use it in my case after reading it.