Image from "scratch" has no shell, but passing the --health-cmd to docker run uses CMD-SHELL

Description

An image that is being based on "scratch", has no shell in it. When using the HEALTHCHECK instruction in a Dockerfile, one can instruct that the healthcheck should run with CMD, not CMD-SHELL. However, when passing the --health-cmd flag to a docker run command, it will always prefix the command with CMD-SHELL. There is no way (afaik) to tell Docker to use CMD, and neither the ENTRYPOINT nor the SHELL instruction seem to influence this.

Is this a bug? Is there a known workaround? Is the solution to this missing from the documentation?

Steps to reproduce the issue:

Build an image from SCRATCH, and try to pass it a --health-cmd on docker run.

Describe the results you received:

It fails with an error, describing that the CMD-SHELL prefixed command will not run.

Describe the results you expected:

It should be possible to tell the cli that it would have to use the CMD prefixed command, so it runs in the same way as a CMD prefixed HEALTHCHECK in the Dockerfile or a healthcheck in the compose.yaml file would run.

Additional information you deem important (e.g. issue happens only occasionally):

I reported this issue https://github.com/moby/moby/issues/43843, but got redirected to this repository. The issue came up when trying to add an optional healthcheck in the Dozzle container, as mentioned in https://github.com/amir20/dozzle/pull/1814

Output of docker version:

Client:
 Version:           20.10.7
 API version:       1.41
 Go version:        go1.16.8
 Git commit:        v20.10.7
 Built:             Thu Jan  1 00:00:00 1970
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server:
 Engine:
  Version:          20.10.7
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.16.8
  Git commit:       v20.10.7
  Built:            Tue Jan  1 00:00:00 1980
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          v1.5.7
  GitCommit:        v1.5.7
 runc:
  Version:          1.0.0-rc95
  GitCommit:        
 docker-init:
  Version:          0.18.0
  GitCommit:

Output of docker info:

Client:
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Build with BuildKit (Docker Inc., 0.0.0+unknown)

Server:
 Containers: 22
  Running: 3
  Paused: 0
  Stopped: 19
 Images: 1619
 Server Version: 20.10.7
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: journald
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runtime.v1.linux runc io.containerd.runc.v2
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: v1.5.7
 runc version: 
 init version: 
 Security Options:
  seccomp
   Profile: default
  cgroupns
 Kernel Version: 5.10.88
 Operating System: NixOS 21.05 (Okapi)
 OSType: linux
 Architecture: x86_64
 CPUs: 8
 Total Memory: 15.31GiB
 Name: nixos
 ID: JMBO:UXHB:WA6C:HFWI:6W5O:I5PW:L3NR:TEZN:TNZQ:7VRJ:NFXS:4CYG
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: true

Additional environment details (AWS, VirtualBox, physical, etc.):

NixOS

Start by tracing how the Docker CLI handles --health-cmd for docker run, then compare that behavior with CMD and CMD-SHELL healthchecks defined in a Dockerfile or compose.yaml. Done means a scratch-based image can use the CLI to request the non-shell healthcheck form, with regression coverage for the command construction and resulting behavior.