To explain what's going on: When building, Docker will keep track of the files added with each build step in it's cache. It's storing checksums for each file to skip build steps when they probably don't need to be repeated. E.g. if you would add a python package to the requirements.txt, Docker would notice the invalidated cache because of that checksum and start building again beginning from step 3 (COPY requirements.txt /usr/src/paperless/). Checkout Dockers best practices section for further details.

A side effect of this is, that only your local files are considered. E.g. Docker would not notice a newly uploaded package to PyPI which would be accepted by an cached requirements.txt. (you can use docker build --no-cache=true to force rebuild)

ENTRYPOINT or CMD can be placed anywhere in the Dockerfile, the last occurrence wins for each of them. Since it takes around 2 seconds on my machine to process each of these instructions, I've put them a bit up, so we can profit from another speedup there.