Cleanup cmd on entrypoint setting

Fixes #5147
I think this one is so that we can do `docker run --entrypoint bash some-image` and actually get bash without further hand-waving.