I have a requirement to assure that the container image we build runs in UTC only. I'd like to avoid starting it up just to check the link on /etc/localtime. I thought maybe a tool like dive that evaluates the contents of the image would do the trick. Clearly dive has that info, but it is outside it's scope to provide it. I also looked at syft and grype, but it seems they focus on packages, not files.

All those tools are looking at the file system so it seems like this isn't very far from reality. Is there another tool that would list out specific files and corresponding file system links?

I'm also open to alternative methods of checking the timezone in a container image that doesn't involved needing to create an instance of the image.

  • Anchore will catalog all the files in an image after it does a scan. This allows for checking the symlink on /etc/localtime against the list of files they recorded along with a bunch more detail, but does also require standing up a more robust system to enable it. I'd still like a simpler solution as this seems overkill.
    – Josiah
    Sep 26, 2022 at 17:15

1 Answer 1


In order to get single /etc/localtime symlink or file from image, you have to download the whole layer anyway. To deterimine which layer contains latest /etc/localtime, you have to download all layers of image.

When you downloaded all layers, it's really simpler to just run container with an entrypoint changed to date +%z:

docker run --rm --entrypoint /bin/date <target_image> +%z

It will not consume many resources.

  • It isn't simpler if a docker sock isn't available to run the container.
    – Josiah
    Dec 30, 2021 at 14:39
  • How are you pulling images then?
    – xy2
    Dec 30, 2021 at 15:13
  • kaniko, buildah, etc.
    – Josiah
    Sep 26, 2022 at 17:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.