---
layout: docs
page_title: Disable the Entrypoint
description: |-
  The entrypoint can be disabled by disabling build-time injection or by setting a runtime variable in already-built artifacts.
---

# Disable the Waypoint Entrypoint

The entrypoint can be disabled by disabling build-time injection or
by setting a runtime variable in already-built artifacts. The former can
be used to prevent the Waypoint from ever being used by a deployment. The
latter can be used to disable the entrypoint in deployments that already
have it installed.

If the entrypoint is disabled, all
[functionality that requires the entrypoint](/docs/entrypoint#functionality)
will stop functioning for that deployment. If other deployments, apps, etc.
use the entrypoint, the entrypoint functionality will work for those
deployments and apps.

## Disable at Runtime

You can disable the entrypoint at runtime by setting the `WAYPOINT_CEB_DISABLE`
environment variable to a truthy value (e.g. "1").

This environment variable is checked immediately on entrypoint startup. If
the value is true, then the entrypoint will immediately execute the
child process. The entrypoint **will not** attempt to even connect to the
server and will not use any network or disk resources.

This approach allows you to always inject the entrypoint in case you
want to use it in the future, but to disable it completely until then.

## Disable at Build

The entrypoint can be disabled by preventing it from being installed or
injected in the first place.

For builders that support automatic injection, they should offer some
configuration to disable this behavior. For example, if you're using the
"docker" builder you can set the `disable_entrypoint` configuration:

```hcl
app "my-app" {
  build {
    use "docker" {
      disable_entrypoint = true
    }
  }

  # ...
}
```

For builders that do not support automatic injection, you must manually
alter your build scripts to prevent entrypoint installation.

## Disabling Specific Features

### Exec

You can disable only the [`waypoint exec`](/docs/exec) functionality by
setting the `WAYPOINT_CEB_DISABLE_EXEC` environment variable to a truthy
value (e.g. "1"). Other entrypoint features such as logs, application config,
etc. will continue to work.

This environment variable must be set _before_ the entrypoint starts.
Therefore, it cannot be set with [application configuration](/docs/app-config).
It must be set at build time or by using functionality of your deployment
plugin.

The example below shows how to set this using the [Kubernetes plugin](/plugins/kubernetes):

```hcl
deploy {
  use "kubernetes" {
    static_environment = {
      "WAYPOINT_CEB_DISABLE_EXEC" = "1"
    }
  }
}
```

When exec is disabled, the entrypoint will not allow `waypoint exec` to
target _that specific instance_. If there are other instances running without
the environment variable set (such as from a previous deployment), those may
still be targeted.

This environment variable only disables _entrypoint-based exec_. For some
plugins, `waypoint exec` works without the Waypoint entrypoint. For example,
the AWS Lambda plugin launches a just-in-time instance for `exec` that
doesn't use the entrypoint. This environment variable will have no effect
on this functionality.
