Docker image tarballs have wrong created time when imported to Docker

[jimmidyson]

Docker image tarballs have wrong created time when imported to Docker

[mattmoor]

This is all by design (which sounds horrible), let me explain.

The former is because we omit timestamps in the config files, and Docker picks some random time (not the Unix epoch) out of thin air.

Both are in pursuit of reproducible builds. I believe you'd also see the latter if you looked inside of a JAR file Bazel produces.

Ultimately the decision comes down to a trade-off between something largely cosmetic (timestamp) and something that fundamentally improves numerous things, including:

1. Repeatable builds are the holy grail of provenance
2. Same input => same layer means better distributed caching
3. Same input => same layer means better push / pull incrementality

I could go on, but these are some of the highlights.

I think our best case would be for Docker to do something more sensible when this is omitted.

[mattmoor]

With stamping, we could allow timestamps to creep in, but Skylark doesn't yet support this well. What we have with stamp = true is essentially a workaround.

[jimmidyson]

Your explanation re reproducible builds makes total sense - thank you again.

[Globegitter]

@mattmoor I now have an issue where I want to create a docker image with bazel installed. I now get it to install as discussed here: bazelbuild/bazel#4492

But now the problem is bazel itself checks the creation dates of those files and errors out with: Error: corrupt installation: file '/opt/bazel/_embedded_binaries/A-server.jar' modified. Please remove '/opt/bazel' and try again. I can run touch -m -t 202801010101 $(find /opt/bazel -type f) as a first command but that takes 6-8s, making it again less suitable for CI.

Seems like this issue could also be fixed with the stamping feature, by allowing a separate timestamp for tar extraction.

[rbtcollins]

So, Docker are punting on this because OCI mandates it; and pointing at https://github.com/opencontainers/image-spec/issues as the place to push this forward.