fix(cli): explicitly clear entrypoint when spawning sandbox container

This explicitly passes `--entrypoint=''` to the `docker run` command.

Fixes #26964.

packages/cli/src/utils/sandbox.test.ts

@@ -336,7 +336,14 @@ describe('sandbox', () => {
       await expect(promise).resolves.toBe(0);
       expect(spawn).toHaveBeenCalledWith(
         'docker',
-        expect.arrayContaining(['run', '-i', '--rm', '--init']),
+        expect.arrayContaining([
+          'run',
+          '-i',
+          '--rm',
+          '--init',
+          '--entrypoint',
+          '',
+        ]),
         expect.objectContaining({ stdio: 'inherit' }),
       );
 

packages/cli/src/utils/sandbox.ts

@@ -314,6 +314,10 @@ export async function start_sandbox(
     // run init binary inside container to forward signals & reap zombies
     const args = ['run', '-i', '--rm', '--init', '--workdir', containerWorkdir];
 
+    // explicitly clear the entrypoint to prevent the container's default
+    // entrypoint from interfering with the CLI's spawn command.
+    args.push('--entrypoint', '');
+
     // add runsc runtime if using runsc
     if (config.command === 'runsc') {
       args.push('--runtime=runsc');
@@ -716,6 +720,8 @@ export async function start_sandbox(
         'run',
         '--rm',
         '--init',
+        '--entrypoint',
+        '',
         ...(userFlag ? userFlag.split(' ') : []),
         '--name',
         SANDBOX_PROXY_NAME,