Why should you use exec form instead of shell form for ENTRYPOINT/CMD?

Shell form (CMD java -jar app.jar) runs the command via /bin/sh -c "...", making the shell PID 1 and your actual application a child process. Signals like SIGTERM sent by docker stop go to PID 1 (the shell), which often does not forward them to the child, so the app never gets a chance to shut down gracefully and Docker has to wait out the full grace period before SIGKILL. Exec form (CMD ["java","-jar","app.jar"]) runs the binary directly as PID 1, so it receives signals correctly.