At the current time I believe the Elastic Beats images all use CMD rather than ENTRYPOINT. There are some subtle differences in how your override the command that is executed inside the container based on whether the image uses a command or an entrypoint. When the image uses an entrypoint, the command is appended to the entrypoint. When an image uses a command, then specifying a new command completely overwrites the command in the image.
So if our images were to specify an entrypoint (they don't) of metricbeat -e then you could just specify command: -strict.perms=false and it would run metricbeat -e -strict.perms=false inside the container. But because the image uses a CMD in the Dockerfile you need to specify the complete command that you want to run if you need to change it.