How does a container know the exact time (UTC timezone) from host machine?

[baojingh]

Description

[Exact UTC Time in a Container]

Hello Everyone. I have a question about the container time:

1. If the container default time is UTC, how does the container know the exact UTC time? Does container also have a time sync with my host machine? (my host machine is CST time zone).
   For example, my current local time is Fri Jun 2 11:15:46 CST 2023 and it is real time in CST timezone.
   The real time in container is Fri Jun 2 03:15:46 UTC 2023. And we all know that CST is UTC +8.
   Why the container know exact time in the host machine? I suppose the container must have a time sync with host machine.

I have not got any descriptions in doc.docker.com about the detailed principles in this topic.
Could someone provide some supports?

Thank you all.

Reproduce

I just use busybox to have the test.

docker run -it  --name  busybox -d  busybox

The timezone is CST and time is correct in my host machine.

root@VM-4-2-centos:~# date
Fri Jun  2 11:15:46 CST 2023
root@VM-4-2-centos:~# cat /etc/localtime 
TZif�����y��Y^��        �p�ӽ����|@�;>�Ӌ{��B���E"�L���<��fp���A|��R i�� ~��!I}�"g� #)_�$G� %|&'e &�^(G (�@~�p�CDTCSTTZif2
                                                                                                                        ����~6C)�������������y������Y^������   �p�����ӽ������������|@�����;>�����Ӌ{������B�������E"�����L�������<������fp�����������A|��R i�� ~��!I}�"g� #)_�$G� %|&'e &�^(G (�@q�~�pLMTCDTCST
CST-8
root@VM-4-2-centos:~# 

When I check the time in the container, I have found it is UTC time. Why is it UTC time？

root@VM-4-2-centos:~# docker ps  | grep busy
e36c0cf585e9   busybox   "sh"                     2 days ago   Up 18 hours             busybox
root@VM-4-2-centos:~# docker exec -it e3  sh
/ # 
/ # date
Fri Jun  2 03:15:46 UTC 2023
/ # cat /etc/timezone
cat: can't open '/etc/timezone': No such file or directory
/ # cat /etc/localtime
TZif2UTCTZif2UTC
UTC0
/ # 

Expected behavior

I expect the time in a container should also be CST time.

docker version

Client: Docker Engine - Community
 Version:           24.0.0
 API version:       1.41 (downgraded from 1.43)
 Go version:        go1.20.4
 Git commit:        98fdcd7
 Built:             Mon May 15 18:51:37 2023
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          20.10.1
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.13.15
  Git commit:       f001486
  Built:            Tue Dec 15 04:35:42 2020
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.21
  GitCommit:        3dce8eb055cbb6872793272b4f20ed16117344f8
 runc:
  Version:          1.1.7
  GitCommit:        v1.1.7-0-g860f061
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

docker info

Client: Docker Engine - Community
 Version:    24.0.0
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.10.4
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.17.3
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 2
  Running: 2
  Paused: 0
  Stopped: 0
 Images: 3
 Server Version: 20.10.1
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 io.containerd.runtime.v1.linux runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 3dce8eb055cbb6872793272b4f20ed16117344f8
 runc version: v1.1.7-0-g860f061
 init version: de40ad0
 Security Options:
  seccomp
   Profile: default
 Kernel Version: 3.10.0-1160.88.1.el7.x86_64
 Operating System: CentOS Linux 7 (Core)
 OSType: linux
 Architecture: x86_64
 CPUs: 2
 Total Memory: 3.607GiB
 Name: VM-4-2-centos
 ID: W7CA:BPIF:V2UB:HENA:WZYF:NCFV:Y3SR:BDTX:YQK7:LXAQ:UWUW:EGRW
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Registry Mirrors:
  https://hub-mirror.c.163.com/
  https://mirror.baidubce.com/
 Live Restore Enabled: false

Additional Info

I hope docker developers or someone could provide me more detailed information in the docker source code.
Thank you so much.

[neersighted]

A container is not a VM -- it's just a namespaced slice of resources on the same kernel as your 'host' machine. In this case, timezones are a construct of userspace (more or less); so timezones inside the container are defined by the container rootfs (filesystem) and not the 'host' filesystem.

In the future, we can create a time namespace for the container (https://manpages.ubuntu.com/manpages/impish/man7/time_namespaces.7.html); this namespace defaults to the same time as the root ('host') time namespace.

Note that what is namespaced is a subset of clocks (mostly, time since boot/monotonic clocks); the wall clock is not virtualized by time namespaces.

[baojingh]

OK, Thanks. I am deeping it.
It seems that docker doc lack this explanation as yours.

[neersighted]

https://medium.com/@saschagrunert/demystifying-containers-part-i-kernel-space-2c53d6979504 is linked to from https://docs.docker.com/get-started/, which does a pretty good job, I think.

Since Docker builds on top of established Linux kernel primitives like namespaces and cgroups that we didn't invent, the docs don't go too out of their way to explain the architecture -- they're more focused on the practice than the theory.

[raesene]

@neersighted just to confirm, does moby/docker support creating a new time namespace for containers at the moment? My understanding was that whilst Linux had time namespaces, support for them had not made it's way to Docker yet?

I've seen a runc PR got merged relatively recently for this support, which I guess would be a pre-requisite for moby/docker support.

[thaJeztah]

No we don't support time namespaces yet. I think the runc implementation was merged (not sure if it shipped in a release already), and if we add it, it would also come with minimum kernel requirements, so not supported everywhere (so it may not work, depending on the host)

[thaJeztah]

Also, to prevent confusion (because I often see users confuse them); time namespaces are not needed to change time zones; time zone is effectively just presentation or the time. Changing timezone (presentation) inside a container is already possible.