Passing environment variables into graphql-engine:vX.X.X.cli-migrations-v2 images is onerous, not documented

I'm deploying `hasura/graphql-engine:v1.3.1.cli-migrations-v2` with a [Dockerfile](https://github.com/cuddlefish-app/cuddlefish/blob/main/hasura/Dockerfile) (environment variables are getting filled in [here](https://github.com/cuddlefish-app/cuddlefish/blob/main/render.yaml)). When deploying, the migrations and metadata application seem to be going through successfully, but the container just keeps going through the same update loop: https://gist.github.com/samuela/5cdc74d4777c8f605c303bcbd3e23f5a.

I am doing a little bit of trickery with `ENTRYPOINT` and `CMD` to inject the right values in the right places:
```
ENTRYPOINT API_GRAPHQL_ENDPOINT=http://$API_HOST:10000/graphql docker-entrypoint.sh
# The ENTRYPOINT ends up getting run first and then it hands off control to CMD.
CMD graphql-engine serve \
--auth-hook "http://$API_HOST:10000/hasura_auth_webhook"
```
but I believe I followed the original Dockerfile quite closely: https://github.com/hasura/graphql-engine/blob/master/scripts/cli-migrations/v2/Dockerfile

What could be going wrong to produce this restart loop?