Missing timezone database after changing Docker base image from CentOS 7 to Ubuntu 20.04

[fabianonunes]

Summary

• Version: docker.elastic.co/beats/filebeat:7.17.0
• Operating System: Ubuntu 20.04, Docker 20.10.14

After PR #29681, timezone database (/usr/share/zoneinfo) is missing from filebeat image.

Unlike the centos:7 image, the tzdata package is not installed by default in the ubuntu:20.04 image and the package is not installed in the beats Dockerfile.

In this scenario, regardless of the timezone: Local option, parsed date fields that do not contain a time zone are always sent in UTC.

Steps to reproduce

Old images (<=7.16.3), CentOS-based:

$ docker run --rm -t -i docker.elastic.co/beats/filebeat:7.16.3 env TZ=America/Sao_Paulo date
Mon Apr 18 17:18:24 -03 2022

New images (> 7.17.0), Ubuntu-based:

$ docker run --rm -t -i docker.elastic.co/beats/filebeat:7.17.0 env TZ=America/Sao_Paulo date
Mon Apr 18 20:18:24 America 2022

Mounting host's /usr/share/zoneinfo as a container volume fixes the problem:

$ docker run --rm -v /usr/share/zoneinfo:/usr/share/zoneinfo -t -i docker.elastic.co/beats/filebeat:7.17.0 env TZ=America/Sao_Paulo date
Mon Apr 18 17:18:24 -03 2022

[elasticmachine]

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

[botelastic[bot]]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[fabianonunes]

:+1

[botelastic[bot]]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[fabianonunes]

+1

[mauri870]

We had some discussion around this issue in https://github.com/elastic/beats/pull/40326.

The consensus we reached is that it is not worthwhile to install tzdata system-wide, given that our Go-built binaries already handle timezones properly by embedding Go's own copy of the timezone database (https://pkg.go.dev/time/tzdata). Our Beats images are already quite large, and installing tzdata would result in a ~20% increase in image size with no noticeable benefit.

I understand that the old CentOS images had tzdata installed, but that was just a side effect. When we switched to Ubuntu, this was not noticed since we didn't rely on tzdata for anything. This is why it's not considered a breaking change. If you were relying on tzdata installed system-wide in one of the Beats Docker images, I would advise against it, as you would be depending on an internal detail.

Given that, I believe there is nothing further to be done here, and this issue can be closed. Please comment if you disagree.

cc @rdner @cmacknz