t also adds complexity to the Dockerfile language when there are clear workarounds. Don't push so much config in the parent Dockerfile and leave if for the inheriting images instead. (aka: stop sourcing random images on docker hub :D)

Since docker 17.05 there is also a new way to do multi-stage builds that removes most of the need for this issue (this is a single Dockerfile):

First import the original image

FROM nginx AS source-image

Second step of the build, start with an empty image

FROM scratch

Copy the data from the original image

COPY --from=source-image / /

Re-define all the config

EXPOSE 80
STOPSIGNAL SIGTERM
CMD ["nginx", "-g", "daemon off;"]

EDIT: Forgot to say, the second solution squashes all previous layers. I don't think it's a big deal but it's good to know.