From 3101ce6b5b3a0308b58d464eef141e0043c3bf5b Mon Sep 17 00:00:00 2001
From: Mason Malone <mason@masonm.org>
Date: Sun, 17 Oct 2021 14:24:59 -0700
Subject: [PATCH 1/3] fix: docker-entrypoint.sh file handling, closes #1456

The docker-entrypoint.sh script added in
https://github.com/nodejs/docker-node/issues/1039 is intended to run the
supplied command with "node" if it contains a "-" or doesn't correspond
to a system command. In Alpine, this doesn't work if the supplied
command corresponds to a regular, non-executable JS file.

The root issue is a bug in ash/dash: its implementation of "command -v"
incorrectly outputs the supplied command_name even for non-executable
files. This is a violation of the POSIX standard and has been reported
to the Debian team in
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264, though there's
been no activity in several years.

As a workaround, this adds an additional check to docker-entrypoint.sh
for regular files that aren't marked as executable.
---
 12/alpine3.11/docker-entrypoint.sh    | 5 ++++-
 12/alpine3.12/docker-entrypoint.sh    | 5 ++++-
 12/alpine3.13/docker-entrypoint.sh    | 5 ++++-
 12/alpine3.14/docker-entrypoint.sh    | 5 ++++-
 12/bullseye-slim/docker-entrypoint.sh | 5 ++++-
 12/bullseye/docker-entrypoint.sh      | 5 ++++-
 12/buster-slim/docker-entrypoint.sh   | 5 ++++-
 12/buster/docker-entrypoint.sh        | 5 ++++-
 12/stretch-slim/docker-entrypoint.sh  | 5 ++++-
 12/stretch/docker-entrypoint.sh       | 5 ++++-
 14/alpine3.11/docker-entrypoint.sh    | 5 ++++-
 14/alpine3.12/docker-entrypoint.sh    | 5 ++++-
 14/alpine3.13/docker-entrypoint.sh    | 5 ++++-
 14/alpine3.14/docker-entrypoint.sh    | 5 ++++-
 14/bullseye-slim/docker-entrypoint.sh | 5 ++++-
 14/bullseye/docker-entrypoint.sh      | 5 ++++-
 14/buster-slim/docker-entrypoint.sh   | 5 ++++-
 14/buster/docker-entrypoint.sh        | 5 ++++-
 14/stretch-slim/docker-entrypoint.sh  | 5 ++++-
 14/stretch/docker-entrypoint.sh       | 5 ++++-
 16/alpine3.11/docker-entrypoint.sh    | 5 ++++-
 16/alpine3.12/docker-entrypoint.sh    | 5 ++++-
 16/alpine3.13/docker-entrypoint.sh    | 5 ++++-
 16/alpine3.14/docker-entrypoint.sh    | 5 ++++-
 16/bullseye-slim/docker-entrypoint.sh | 5 ++++-
 16/bullseye/docker-entrypoint.sh      | 5 ++++-
 16/buster-slim/docker-entrypoint.sh   | 5 ++++-
 16/buster/docker-entrypoint.sh        | 5 ++++-
 16/stretch-slim/docker-entrypoint.sh  | 5 ++++-
 16/stretch/docker-entrypoint.sh       | 5 ++++-
 docker-entrypoint.sh                  | 5 ++++-
 31 files changed, 124 insertions(+), 31 deletions(-)

diff --git a/12/alpine3.11/docker-entrypoint.sh b/12/alpine3.11/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/12/alpine3.11/docker-entrypoint.sh
+++ b/12/alpine3.11/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/12/alpine3.12/docker-entrypoint.sh b/12/alpine3.12/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/12/alpine3.12/docker-entrypoint.sh
+++ b/12/alpine3.12/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/12/alpine3.13/docker-entrypoint.sh b/12/alpine3.13/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/12/alpine3.13/docker-entrypoint.sh
+++ b/12/alpine3.13/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/12/alpine3.14/docker-entrypoint.sh b/12/alpine3.14/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/12/alpine3.14/docker-entrypoint.sh
+++ b/12/alpine3.14/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/12/bullseye-slim/docker-entrypoint.sh b/12/bullseye-slim/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/12/bullseye-slim/docker-entrypoint.sh
+++ b/12/bullseye-slim/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/12/bullseye/docker-entrypoint.sh b/12/bullseye/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/12/bullseye/docker-entrypoint.sh
+++ b/12/bullseye/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/12/buster-slim/docker-entrypoint.sh b/12/buster-slim/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/12/buster-slim/docker-entrypoint.sh
+++ b/12/buster-slim/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/12/buster/docker-entrypoint.sh b/12/buster/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/12/buster/docker-entrypoint.sh
+++ b/12/buster/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/12/stretch-slim/docker-entrypoint.sh b/12/stretch-slim/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/12/stretch-slim/docker-entrypoint.sh
+++ b/12/stretch-slim/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/12/stretch/docker-entrypoint.sh b/12/stretch/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/12/stretch/docker-entrypoint.sh
+++ b/12/stretch/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/14/alpine3.11/docker-entrypoint.sh b/14/alpine3.11/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/14/alpine3.11/docker-entrypoint.sh
+++ b/14/alpine3.11/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/14/alpine3.12/docker-entrypoint.sh b/14/alpine3.12/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/14/alpine3.12/docker-entrypoint.sh
+++ b/14/alpine3.12/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/14/alpine3.13/docker-entrypoint.sh b/14/alpine3.13/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/14/alpine3.13/docker-entrypoint.sh
+++ b/14/alpine3.13/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/14/alpine3.14/docker-entrypoint.sh b/14/alpine3.14/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/14/alpine3.14/docker-entrypoint.sh
+++ b/14/alpine3.14/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/14/bullseye-slim/docker-entrypoint.sh b/14/bullseye-slim/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/14/bullseye-slim/docker-entrypoint.sh
+++ b/14/bullseye-slim/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/14/bullseye/docker-entrypoint.sh b/14/bullseye/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/14/bullseye/docker-entrypoint.sh
+++ b/14/bullseye/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/14/buster-slim/docker-entrypoint.sh b/14/buster-slim/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/14/buster-slim/docker-entrypoint.sh
+++ b/14/buster-slim/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/14/buster/docker-entrypoint.sh b/14/buster/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/14/buster/docker-entrypoint.sh
+++ b/14/buster/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/14/stretch-slim/docker-entrypoint.sh b/14/stretch-slim/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/14/stretch-slim/docker-entrypoint.sh
+++ b/14/stretch-slim/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/14/stretch/docker-entrypoint.sh b/14/stretch/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/14/stretch/docker-entrypoint.sh
+++ b/14/stretch/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/16/alpine3.11/docker-entrypoint.sh b/16/alpine3.11/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/16/alpine3.11/docker-entrypoint.sh
+++ b/16/alpine3.11/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/16/alpine3.12/docker-entrypoint.sh b/16/alpine3.12/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/16/alpine3.12/docker-entrypoint.sh
+++ b/16/alpine3.12/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/16/alpine3.13/docker-entrypoint.sh b/16/alpine3.13/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/16/alpine3.13/docker-entrypoint.sh
+++ b/16/alpine3.13/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/16/alpine3.14/docker-entrypoint.sh b/16/alpine3.14/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/16/alpine3.14/docker-entrypoint.sh
+++ b/16/alpine3.14/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/16/bullseye-slim/docker-entrypoint.sh b/16/bullseye-slim/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/16/bullseye-slim/docker-entrypoint.sh
+++ b/16/bullseye-slim/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/16/bullseye/docker-entrypoint.sh b/16/bullseye/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/16/bullseye/docker-entrypoint.sh
+++ b/16/bullseye/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/16/buster-slim/docker-entrypoint.sh b/16/buster-slim/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/16/buster-slim/docker-entrypoint.sh
+++ b/16/buster-slim/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/16/buster/docker-entrypoint.sh b/16/buster/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/16/buster/docker-entrypoint.sh
+++ b/16/buster/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/16/stretch-slim/docker-entrypoint.sh b/16/stretch-slim/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/16/stretch-slim/docker-entrypoint.sh
+++ b/16/stretch-slim/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/16/stretch/docker-entrypoint.sh b/16/stretch/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/16/stretch/docker-entrypoint.sh
+++ b/16/stretch/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/docker-entrypoint.sh
+++ b/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 

From f89451f17b5f19a2908dedede39434f4f1b1baf0 Mon Sep 17 00:00:00 2001
From: Mason Malone <mason@masonm.org>
Date: Mon, 18 Oct 2021 18:20:24 -0700
Subject: [PATCH 2/3] Add regression test

---
 .github/workflows/build-test.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml
index 308371d633..98a693b116 100644
--- a/.github/workflows/build-test.yml
+++ b/.github/workflows/build-test.yml
@@ -82,6 +82,13 @@ jobs:
           echo "Expected: \"${{ matrix.version }}\", Got: \"${image_node_version}\""
           [ "${image_node_version}" == "${{ matrix.version }}" ]
 
+      - name: Verify entrypoint runs regular, non-executable files with node
+        run: |
+          tmp_file=$(mktemp)
+          echo 'console.log("success")' > "${tmp_file}"
+          output=$(docker run --rm -v "${tmp_file}:/app/index.js" node:${{ matrix.version }}-${{ matrix.variant }} app/index.js)
+          [ "${output}" = 'success' ]
+
       - name: Test for npm
         run: docker run --rm node:${{ matrix.version }}-${{ matrix.variant }} npm --version
 

From be42a31be48999703631ffc818d860d9c814cd98 Mon Sep 17 00:00:00 2001
From: Mason Malone <mason@masonm.org>
Date: Tue, 19 Oct 2021 23:05:32 -0700
Subject: [PATCH 3/3] Update entrypoints for Node 17

---
 17/alpine3.12/docker-entrypoint.sh    | 5 ++++-
 17/alpine3.13/docker-entrypoint.sh    | 5 ++++-
 17/alpine3.14/docker-entrypoint.sh    | 5 ++++-
 17/bullseye-slim/docker-entrypoint.sh | 5 ++++-
 17/bullseye/docker-entrypoint.sh      | 5 ++++-
 17/buster-slim/docker-entrypoint.sh   | 5 ++++-
 17/buster/docker-entrypoint.sh        | 5 ++++-
 17/stretch-slim/docker-entrypoint.sh  | 5 ++++-
 17/stretch/docker-entrypoint.sh       | 5 ++++-
 9 files changed, 36 insertions(+), 9 deletions(-)

diff --git a/17/alpine3.12/docker-entrypoint.sh b/17/alpine3.12/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/17/alpine3.12/docker-entrypoint.sh
+++ b/17/alpine3.12/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/17/alpine3.13/docker-entrypoint.sh b/17/alpine3.13/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/17/alpine3.13/docker-entrypoint.sh
+++ b/17/alpine3.13/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/17/alpine3.14/docker-entrypoint.sh b/17/alpine3.14/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/17/alpine3.14/docker-entrypoint.sh
+++ b/17/alpine3.14/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/17/bullseye-slim/docker-entrypoint.sh b/17/bullseye-slim/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/17/bullseye-slim/docker-entrypoint.sh
+++ b/17/bullseye-slim/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/17/bullseye/docker-entrypoint.sh b/17/bullseye/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/17/bullseye/docker-entrypoint.sh
+++ b/17/bullseye/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/17/buster-slim/docker-entrypoint.sh b/17/buster-slim/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/17/buster-slim/docker-entrypoint.sh
+++ b/17/buster-slim/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/17/buster/docker-entrypoint.sh b/17/buster/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/17/buster/docker-entrypoint.sh
+++ b/17/buster/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/17/stretch-slim/docker-entrypoint.sh b/17/stretch-slim/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/17/stretch-slim/docker-entrypoint.sh
+++ b/17/stretch-slim/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi
 
diff --git a/17/stretch/docker-entrypoint.sh b/17/stretch/docker-entrypoint.sh
index de6fa8a9ad..1b3116e53b 100755
--- a/17/stretch/docker-entrypoint.sh
+++ b/17/stretch/docker-entrypoint.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 
-if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ]; then
+# Run command with node if the first argument contains a "-" or is not a system command. The last
+# part inside the "{}" is a workaround for the following bug in ash/dash:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264
+if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then
   set -- node "$@"
 fi