Dockerfile:1.5: SOURCE_DATE_EPOCH not setting mtime of directories created by ADD

[philandstuff]

I'm trying to reproducibly install tini into a container, so I'm using the ADD command:

ADD --chmod=700 https://github.com/krallin/tini/releases/download/v0.19.0/tini-amd64 /sbin/tini

ADD will ensure the mtime of the /sbin/tini file matches the Last-modified-by header.

However the layer also contains the /sbin directory, and the /sbin directory's mtime is set to the current time during the build. This means this step isn't reproducible, because the different mtime will result in a different layer tarball.

I'm running Docker Desktop 4.19.0, which I know is running an older buildkit without SOURCE_DATE_EPOCH support. But the SOURCE_DATE_EPOCH docs say that "Minimal support is also available on older BuildKit when using Dockerfile 1.5 frontend." so I thought I could use SOURCE_DATE_EPOCH to set the mtime of the /sbin directory. But this seems to have no effect - when I try to build with SOURCE_DATE_EPOCH=0, the /sbin directory's mtime in the ADD layer is still the current time, not the unix epoch.

Minimal dockerfile:

# syntax = docker/dockerfile:1.5

FROM scratch

ADD --chmod=700 https://github.com/krallin/tini/releases/download/v0.19.0/tini-amd64 /sbin/tini

ENTRYPOINT ["/sbin/tini"]

Built using:

docker build --build-arg SOURCE_DATE_EPOCH=0 .

To discover the mtime, I used docker save and manually inspected the layer.tar file.

More environment details:

docker version
Client:
 Cloud integration: v1.0.31
 Version:           23.0.5
 API version:       1.42
 Go version:        go1.19.8
 Git commit:        bc4487a
 Built:             Wed Apr 26 16:12:52 2023
 OS/Arch:           darwin/arm64
 Context:           default

Server: Docker Desktop 4.19.0 (106363)
 Engine:
  Version:          23.0.5
  API version:      1.42 (minimum version 1.12)
  Go version:       go1.19.8
  Git commit:       94d3ad6
  Built:            Wed Apr 26 16:17:14 2023
  OS/Arch:          linux/arm64
  Experimental:     false
 containerd:
  Version:          1.6.20
  GitCommit:        2806fc1057397dbaeefbea0e4e17bddfbd388f38
 runc:
  Version:          1.1.5
  GitCommit:        v1.1.5-0-gf19387a
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

[AkihiroSuda]

File timestamps still have to be touch-ed explicitly. https://github.com/moby/buildkit/blob/v0.11.6/docs/build-repro.md#timestamps-of-the-files-inside-the-image

Will be fixed in:

• [Moved to #4057] Apply SOURCE_DATE_EPOCH to the files and the whiteouts inside OCI tar layers #3560

[philandstuff]

Thank you 👍 I wasn't clear on whether that PR affected this.