diff --git a/pkg/universe.dagger.io/docker/run.cue b/pkg/universe.dagger.io/docker/run.cue
index 493ea53d..0d4cf23b 100644
--- a/pkg/universe.dagger.io/docker/run.cue
+++ b/pkg/universe.dagger.io/docker/run.cue
@@ -26,6 +26,9 @@ import (
 		}
 	}
 
+	// Entrypoint to prepend to command
+	entrypoint?: [...string]
+
 	// Command to execute
 	command?: {
 		// Name of the command to execute
@@ -65,6 +68,37 @@ import (
 	// Examples: "root", "0", "1002"
 	user: string
 
+	// Add defaults to image config
+	// This ensures these values are present
+	_defaults: dagger.#Set & {
+		"input": {
+			entrypoint: []
+			cmd: []
+			workdir: "/"
+			user:    "root"
+		}
+		config: input.config
+	}
+
+	// Override with user config
+	_config: dagger.#Set & {
+		input: _defaults.output
+		config: {
+			if entrypoint != _|_ {
+				"entrypoint": entrypoint
+			}
+			if command != _|_ {
+				cmd: [command.name] + command._flatFlags + command.args
+			}
+			if workdir != _|_ {
+				"workdir": workdir
+			}
+			if user != _|_ {
+				"user": user
+			}
+		}
+	}
+
 	// Output fields
 	{
 		// Has the command completed?
@@ -129,21 +163,11 @@ import (
 		"input":  input.rootfs
 		"always": always
 		"mounts": mounts
-
-		if command != _|_ {
-			args: [command.name] + command._flatFlags + command.args
-		}
-		if command == _|_ {
-			args: list.Concat([
-				if input.config.entrypoint != _|_ {
-					input.config.entrypoint
-				},
-				if input.config.cmd != _|_ {
-					input.config.cmd
-				},
-			])
-		}
-		"env": env
+		args:     _config.output.entrypoint + _config.output.cmd
+		workdir:  _config.output.workdir
+		user:     _config.output.user
+		"env":    env
+		// env may contain secrets so we can't use dagger.#Set
 		if input.config.env != _|_ {
 			for key, val in input.config.env {
 				if env[key] == _|_ {
@@ -151,14 +175,6 @@ import (
 				}
 			}
 		}
-		"workdir": workdir
-		if workdir == _|_ && input.config.workdir != _|_ {
-			workdir: input.config.workdir
-		}
-		"user": user
-		if user == _|_ && input.config.user != _|_ {
-			user: input.config.user
-		}
 	}
 
 	// Command exit code
diff --git a/pkg/universe.dagger.io/docker/test/run.cue b/pkg/universe.dagger.io/docker/test/run.cue
index 82b97275..435d6d9e 100644
--- a/pkg/universe.dagger.io/docker/test/run.cue
+++ b/pkg/universe.dagger.io/docker/test/run.cue
@@ -9,13 +9,13 @@ import (
 
 dagger.#Plan & {
 	actions: test: run: {
-		_build: alpine.#Build
+		_build: alpine.#Build & {
+			packages: bash: _
+		}
 		_image: _build.output
 
 		// Test: run a simple shell command
 		simpleShell: {
-			image: alpine.#Build
-
 			run: docker.#Run & {
 				input: _image
 				command: {
@@ -65,5 +65,43 @@ dagger.#Plan & {
 			}
 			verify: contents: "hello world"
 		}
+
+		// Test: configs overriding image defaults
+		configs: {
+			_base: docker.#Set & {
+				input: _image
+				config: {
+					user:    "nobody"
+					workdir: "/sbin"
+					entrypoint: ["sh"]
+					cmd: ["-c", "echo -n $0 $PWD $(whoami) > /tmp/output.txt"]
+				}
+			}
+
+			// check defaults not overriden by image config
+			runDefaults: docker.#Run & {
+				input: _image
+				command: {
+					name: "sh"
+					flags: "-c": "echo -n $PWD $(whoami) > /output.txt"
+				}
+				export: files: "/output.txt": "/ root"
+			}
+
+			// check image defaults
+			imageDefaults: docker.#Run & {
+				input: _base.output
+				export: files: "/tmp/output.txt": "sh /sbin nobody"
+			}
+
+			// check overrides by user
+			overrides: docker.#Run & {
+				input: _base.output
+				entrypoint: ["bash"]
+				workdir: "/root"
+				user:    "root"
+				export: files: "/tmp/output.txt": "bash /root root"
+			}
+		}
 	}
 }