Answers: <p>In order to get single <code>/etc/localtime</code> symlink or file from image, you have to download the whole layer anyway. To deterimine which layer contains latest <code>/etc/localtime</code>, you have to download <strong>all</strong> layers of image.</p>
  <p>When you downloaded all layers, it's really simpler to just run container with an entrypoint changed to <code>date +%z</code>:</p>
  <pre><code>docker run --rm --entrypoint /bin/date &lt;target_image&gt; +%z
  +0000
  </code></pre>
  <p>It will not consume many resources.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-12-30T14:39:32.837Z
Answers: It isn't simpler if a docker sock isn't available to run the container.
Answers: Josiah
Answers: CC BY-SA 4.0
Answers: 2021-12-30T15:13:33.613Z
Answers: How are you pulling images then?
Answers: xy2
Answers: CC BY-SA 4.0
Answers: 2022-09-26T17:12:27.903Z
Answers: kaniko, buildah, etc.
Answers: Josiah
Answers: CC BY-SA 4.0
Answers: 2021-12-30T01:07:47.390Z
Answers: 2021-12-30T01:07:47.390Z
Answers: xy2
Body: <p>I have a requirement to assure that the container image we build runs in UTC only. I'd like to avoid starting it up just to check the link on /etc/localtime. I thought maybe a tool like <code>dive</code> that evaluates the contents of the image would do the trick. Clearly <a href="https://github.com/wagoodman/dive" rel="nofollow noreferrer">dive</a> has that info, but it is outside it's scope to provide it. I also looked at <a href="https://github.com/anchore/syft" rel="nofollow noreferrer">syft</a> and <a href="https://github.com/anchore/grype" rel="nofollow noreferrer">grype</a>, but it seems they focus on packages, not files.</p>
  <p>All those tools are looking at the file system so it seems like this isn't very far from reality. Is there another tool that would list out specific files and corresponding file system links?</p>
  <p>I'm also open to alternative methods of checking the timezone in a container image that doesn't involved needing to create an instance of the image.</p>
  
Comments: CC BY-SA 4.0
Comments: 2022-09-26T17:15:00.190Z
Comments: Anchore will catalog all the files in an image after it does a scan. This allows for checking the symlink on /etc/localtime against the list of files they recorded along with a bunch more detail, but does also require standing up a more robust system to enable it. I'd still like a simpler solution as this seems overkill.
Comments: Josiah
Tags: <docker><continuous-integration><containers>
Title: Check TZ in Container Image without creating instance?
UserDisplayName: Josiah
ThreadText: # Check TZ in Container Image without creating instance?
  
  (Asked by: username_0 on 2021-12-29)
  
  I have a requirement to assure that the container image we build runs in UTC only. I'd like to avoid starting it up just to check the link on /etc/localtime. I thought maybe a tool like `dive` that evaluates the contents of the image would do the trick. Clearly [dive](https://github.com/wagoodman/dive) has that info, but it is outside it's scope to provide it. I also looked at [syft](https://github.com/anchore/syft) and [grype](https://github.com/anchore/grype), but it seems they focus on packages, not files.
  
  All those tools are looking at the file system so it seems like this isn't very far from reality. Is there another tool that would list out specific files and corresponding file system links?
  
  I'm also open to alternative methods of checking the timezone in a container image that doesn't involved needing to create an instance of the image.
  
  **Tags:** docker, continuous-integration, containers
  
  > **Comments:**
  > **username_0**: Anchore will catalog all the files in an image after it does a scan. This allows for checking the symlink on /etc/localtime against the list of files they recorded along with a bunch more detail, but does also require standing up a more robust system to enable it. I'd still like a simpler solution as this seems overkill.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2021-12-30. Score: 1
  
  In order to get single `/etc/localtime` symlink or file from image, you have to download the whole layer anyway. To deterimine which layer contains latest `/etc/localtime`, you have to download **all** layers of image.
  
  When you downloaded all layers, it's really simpler to just run container with an entrypoint changed to `date +%z`:
  
  ```
  docker run --rm --entrypoint /bin/date <target_image> +%z
  +0000
  
  ```
  
  It will not consume many resources.
  
  > **Comments:**
  > **username_0**: It isn't simpler if a docker sock isn't available to run the container.  
  > **username_1**: How are you pulling images then?  
  > **username_0**: kaniko, buildah, etc.  
  
  ---
  
  