CyberNative

Forecast · 1 November 2026 · Frozen

532 of 1,000 popular Docker Hub images will still carry a time-zone copy that our scan finds wrong for at least one Canadian zone at 08:00 UTC on 1 November. The 77 we cannot scan are not counted.

Counted the 181 official images and the 819 most-pulled community repositories our searches of Docker Hub find (each with at least 57.9 million pulls). Scanned 24 October 2026: 923; not scanned: 77.

Our range 515–543 90% interval

Pushed since 16 Jul, fix routes only 272 range 255–281; 291 when we froze it Counts only images leaving through a published fix route. Images leaving through changes outside the route table (including images at the floor) and images becoming wrong are simulated for the whole frame but not split by maintained status, so the full maintained outcome can fall outside this range.

If nothing changes 557 the count when we froze it

Latest scan 557 wrong on 24 Oct, of 923 scanned; 77 not scanned

Fixed since our census 45 45 named below

To go 8 days to 1 November 2026

The count, day by day

Images our scan judges wrong for Canadian zones on 1 November, by day 557 were wrong on 24 October 2026, of 923 scanned. The forecast for 1 November 2026 is 532, range 515 to 543; with no change it would be 557. It turns on 2 cases: Debian accepts the 2026e update but no Debian base image rebuild happens before 1 November; the official Eclipse Temurin images do not publish the October Java update before 1 November, 57%, 537; Debian accepts the 2026e update but no Debian base image rebuild happens before 1 November; the official Eclipse Temurin images publish the October Java update before 1 November, 43%, 523. 374 had no published fix when we froze the forecast. The table below has every day. 374 had no published fix when we froze the forecast30047565019 Oct21 Oct23 Oct25 Oct27 Oct29 Oct1 NovFreeze-day count: 55719 October 2026: 602 wrong of 923 scanned, 77 not scanned20 October 2026: 597 wrong of 923 scanned, 77 not scanned21 October 2026: 595 wrong of 923 scanned, 77 not scanned22 October 2026: 580 wrong of 923 scanned, 77 not scanned23 October 2026: 566 wrong of 923 scanned, 77 not scanned24 October 2026: 557 wrong of 923 scanned, 77 not scanned557 on 24 OctForecast for 1 November 2026: 532 (range 515–543)57%: 537Forecast 53243%: 523range 515–543 Images our scan judges wrong for Canadian zones on 1 November, by day 557 were wrong on 24 October 2026, of 923 scanned. The forecast for 1 November 2026 is 532, range 515 to 543; with no change it would be 557. It turns on 2 cases: Debian accepts the 2026e update but no Debian base image rebuild happens before 1 November; the official Eclipse Temurin images do not publish the October Java update before 1 November, 57%, 537; Debian accepts the 2026e update but no Debian base image rebuild happens before 1 November; the official Eclipse Temurin images publish the October Java update before 1 November, 43%, 523. 374 had no published fix when we froze the forecast. The table below has every day. 374 had no published fix when we frozethe forecast30047565019 Oct23 Oct27 Oct1 NovFreeze-daycount: 55719 October 2026: 602 wrong of 923 scanned, 77 not scanned20 October 2026: 597 wrong of 923 scanned, 77 not scanned21 October 2026: 595 wrong of 923 scanned, 77 not scanned22 October 2026: 580 wrong of 923 scanned, 77 not scanned23 October 2026: 566 wrong of 923 scanned, 77 not scanned24 October 2026: 557 wrong of 923 scanned, 77 not scanned557 on 24 OctForecast for 1 November 2026: 532 (range 515–543)57%: 537Forecast 53243%: 523range 515–543
Each point is one daily read of the 1,000 repositories at the tag current that day; an image is scanned again only when its tag points to a new image. The 77 we could not scan are not counted: 55 have no linux/amd64 tag, and for 22 the pull or scan failed. The shaded band is the range we gave a 90% chance, frozen on 24 October. The marks on it are our cases, each with the chance we give it; they are explained under “What the number turns on”. The dashed line is the freeze-day count: the forecast is only worth something if it ends closer to the real count than that line does. Pull counts are lifetime totals, so the 1,000 include old, unmaintained repositories. Beside the range is a separate forecast for images whose tag was pushed since 16 July; the note under it says what it leaves out.

Check your own images

361 of 557 have a wrong copy outside the operating system's package

  • 174 have no wrong copy where the OS package keeps its time-zone files, so a check of that package finds nothing wrong
  • 187 have one wrong copy where the OS package keeps its files and another elsewhere, so updating the package leaves the other behind
  • 196 have every wrong copy where the OS package keeps its time-zone files

The usual check, dpkg -s tzdata (or apk or rpm), reads only the operating system's package. In at least 361 of the 557 images that were wrong on 24 October, a wrong copy sits outside that package, in a JDK, Node.js, PHP, ICU or a copied zoneinfo folder, so updating the package the check reports does not fix them. tzscan finds every copy it recognises in an image without running it, private images included. If it finds a wrong copy, the tested fixes are in our runtimes and databases guides.

What the number turns on

One question is still open: will the official eclipse-temurin images publish the October Java update before 1 November? Eclipse Temurin released those builds on 22 October, but when we froze the forecast the official images had not picked them up. These are our cases, frozen with the forecast.

  1. 57%Debian accepts the 2026e update but no Debian base image rebuild happens before 1 November; the official Eclipse Temurin images do not publish the October Java update before 1 NovemberCount: 537
  2. 43%Debian accepts the 2026e update but no Debian base image rebuild happens before 1 November; the official Eclipse Temurin images publish the October Java update before 1 NovemberCount: 523

Who fixed it

Images fixed since our census of 18 October, meaning our scan now judges no default time-zone copy it recognises in them wrong. Each row links the fixed image on Docker Hub or, where Docker Hub no longer shows the image we scanned, says so; our record of every scan is in the forecast's data file. A deliberate fix means the publisher's own public commits around that time changed time-zone data. A rebuild means a scheduled or base-image rebuild picked up fixed data without such a commit.

A rebuild is not always a fix. Some images copy their time-zone files from a base image that is itself rebuilt on a schedule; if that base still carries 2026c or older, the image is rebuilt, its date changes, and it still gives the wrong time.

Deliberate fix 1

  1. library/sapmachineSAP (SapMachine)

    SapMachine took in the OpenJDK change “(tz) Update Timezone Data to 2026e” (JDK-8393337, committed 3 October) for its Java 27 build; the 23 October image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /usr/lib/jvm/sapmachine-27/lib/tzdb.dat 2026b to 2026e or later (judged from its tz release label)

    Evidence for library/sapmachine

Rebuild 44

  1. caprover/caproverCapRover
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/local/bin/node 2026a to 2026e or later (judged from its tz release label)

    Evidence for caprover/caprover
  2. grafana/grafana-image-rendererGrafana Labs
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/lib/chromium/icudtl.dat 2026c to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for grafana/grafana-image-renderer
  3. homeassistant/home-assistantHome Assistant
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/share/zoneinfo 2026b to 2026e or later (offsets measured)

    Evidence for homeassistant/home-assistant
  4. library/amazoncorrettoAmazon Corretto (Amazon Web Services)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Amazon Linux 2023.12.20261021): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/amazoncorretto
  5. library/eclipse-mosquittoEclipse Mosquitto
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.23): /usr/share/zoneinfo 2026d to 2026e or later (offsets measured)

    Evidence for library/eclipse-mosquitto
  6. linuxserver/code-serverLinuxServer.io
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /app/code-server/lib/node 2026c to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for linuxserver/code-server
  7. requarks/wikiWiki.js (Requarks)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/local/bin/node 2026c to 2026e or later (judged from its tz release label)

    Evidence for requarks/wiki
  8. sonarsoftware/customerportalSonar Software
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 22.04.1 LTS): /usr/share/zoneinfo-icu/44/be/zoneinfo64.res 2026a to 2026e or later (judged from its tz release label); /usr/share/zoneinfo-icu/44/le/zoneinfo64.res 2026a to 2026e or later (judged from its tz release label); /usr/share/zoneinfo older than 2026b to 2026e or later (offsets measured); release not determined, so not judged: /usr/lib/x86_64-linux-gnu/libicudata.so.70.1

    Evidence for sonarsoftware/customerportal
36 earlier rebuilds
  1. zammad/zammad-docker-composeZammad
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for zammad/zammad-docker-compose
  2. bitnami/minidebBitnami (Broadcom)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for bitnami/minideb
  3. cimg/pythonCircleCI
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 26.04.1 LTS): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for cimg/python
  4. cimg/redisCircleCI
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 22.04.5 LTS): /usr/share/zoneinfo-icu/44/be/zoneinfo64.res 2026c to 2026e or later (judged from its tz release label); /usr/share/zoneinfo-icu/44/le/zoneinfo64.res 2026c to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured); release not determined, so not judged: /usr/lib/x86_64-linux-gnu/libicudata.so.70.1

    Evidence for cimg/redis
  5. concourse/s3-resourceConcourse
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Wolfi): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for concourse/s3-resource
  6. concourse/semver-resourceConcourse
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Wolfi): /usr/share/zoneinfo 2026d to 2026e or later (offsets measured)

    Evidence for concourse/semver-resource
  7. gitlab/gitlab-runnerGitLab
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for gitlab/gitlab-runner
  8. hashicorp/consulHashiCorp
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for hashicorp/consul
  9. hashicorp/consul-enterpriseHashiCorp
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for hashicorp/consul-enterprise
  10. library/amazonlinuxAmazon Linux (Amazon Web Services)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Amazon Linux 2023.12.20261021): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/amazonlinux
  11. library/redmineRedmine Docker Official Image maintainers
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for library/redmine
  12. linuxserver/lazylibrarianLinuxServer.io
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for linuxserver/lazylibrarian

    Docker Hub's page for the latest tag now shows a later push (2026-10-24), not the digest we scanned; Docker Hub's registry still served that digest on 2026-10-24T18:19Z (docker buildx imagetools inspect linuxserver/lazylibrarian@sha256:dcd5f06c3b3969ffe9c3594de7e13e7f37daf94f99c187f31f16fa9ec791026b). scanReceipt is our own record of the scan.

  13. n8nio/n8nn8n
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Docker Hardened Images/Alpine Linux v3.24): /usr/bin/node 2026c to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for n8nio/n8n
  14. netdata/netdataNetdata
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Debian GNU/Linux 13 (trixie)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for netdata/netdata
  15. verdaccio/verdaccioVerdaccio
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/local/bin/node 2026a to 2026e or later (judged from its tz release label)

    Evidence for verdaccio/verdaccio
  16. bitnami/wordpressBitnami (Broadcom)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (VMware Photon OS/Linux): /opt/bitnami/apache/modules/libphp.so 2026c to 2026e or later (offsets measured); /opt/bitnami/php/bin/php 2026c to 2026e or later (offsets measured); /opt/bitnami/php/bin/php-cgi 2026c to 2026e or later (offsets measured); /opt/bitnami/php/bin/phpdbg 2026c to 2026e or later (offsets measured); /opt/bitnami/php/sbin/php-fpm 2026c to 2026e or later (offsets measured); /usr/lib/libicudata.so.76.1 2024b, removed

    Evidence for bitnami/wordpress
  17. cimg/rubyCircleCI
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 22.04.5 LTS): /usr/share/zoneinfo-icu/44/be/zoneinfo64.res 2026c to 2026e or later (judged from its tz release label); /usr/share/zoneinfo-icu/44/le/zoneinfo64.res 2026c to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured); release not determined, so not judged: /usr/lib/x86_64-linux-gnu/libicudata.so.70.1

    Evidence for cimg/ruby
  18. cockroachdb/cockroachCockroach Labs
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Red Hat Enterprise Linux 10.2 (Coughlan)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for cockroachdb/cockroach
  19. concourse/registry-image-resourceConcourse
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Wolfi): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for concourse/registry-image-resource
  20. gremlin/gremlinGremlin
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Wolfi): /usr/share/zoneinfo 2026d to 2026e or later (offsets measured)

    Evidence for gremlin/gremlin
  21. hashicorp/tfc-agentHashiCorp
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for hashicorp/tfc-agent
  22. library/adminerAdminer Docker Official Image maintainers
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/local/bin/php 2026c to 2026e or later (offsets measured); /usr/local/bin/php-cgi 2026c to 2026e or later (offsets measured); /usr/local/bin/phpdbg 2026c to 2026e or later (offsets measured)

    Evidence for library/adminer
  23. library/composerComposer
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/local/bin/php 2026c to 2026e or later (offsets measured); /usr/local/bin/php-cgi 2026c to 2026e or later (offsets measured); /usr/local/bin/phpdbg 2026c to 2026e or later (offsets measured)

    Evidence for library/composer
  24. library/eggdropEggheads (Eggdrop)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.23): /usr/share/zoneinfo 2026d to 2026e or later (offsets measured)

    Evidence for library/eggdrop
  25. linuxserver/nzbhydra2LinuxServer.io
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for linuxserver/nzbhydra2
  26. nodered/node-redNode-RED
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/local/bin/node 2026c to 2026e or later (judged from its tz release label)

    Evidence for nodered/node-red
  27. organizr/organizrOrganizr
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/bin/php81 older than 2026b, removed; /usr/sbin/php-fpm81 older than 2026b, removed; /usr/share/zoneinfo older than 2026b to 2026e or later (offsets measured)

    Evidence for organizr/organizr
  28. syncthing/syncthingSyncthing
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.24): /usr/share/zoneinfo 2026d to 2026e or later (offsets measured)

    Evidence for syncthing/syncthing
  29. sysdig/agentSysdig
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Red Hat Enterprise Linux 9.8 (Plow)): /usr/share/javazi-1.8/tzdb.dat 2026c to 2026e or later (judged from its tz release label); /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for sysdig/agent
  30. linuxserver/ddclientLinuxServer.io
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.22): /usr/share/zoneinfo 2026d to 2026e or later (offsets measured)

    Evidence for linuxserver/ddclient
  31. linuxserver/smokepingLinuxServer.io
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Alpine Linux v3.22): /usr/share/zoneinfo 2026d to 2026e or later (offsets measured)

    Evidence for linuxserver/smokeping
  32. amazon/aws-for-fluent-bitAmazon Web Services (AWS for Fluent Bit)
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Amazon Linux 2): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for amazon/aws-for-fluent-bit
  33. datadog/agentDatadog
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for datadog/agent

    Docker Hub's page for the latest tag now shows a later push (2026-10-24), not the digest we scanned; Docker Hub's registry still served that digest on 2026-10-24T18:18Z (docker buildx imagetools inspect datadog/agent@sha256:58e91b8dd1beff34715103896962cc18664b3c9e360e403c05068d3a822bf0ac). scanReceipt is our own record of the scan.

  34. datadog/cluster-agentDatadog
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for datadog/cluster-agent

    Docker Hub's page for the latest tag now shows a later push (2026-10-24), not the digest we scanned; Docker Hub's registry still served that digest on 2026-10-24T18:18Z (docker buildx imagetools inspect datadog/cluster-agent@sha256:bf33972d58738f3a8584b4d16ef8f01619549d1185391c3768ccab5a13f9bf8b). scanReceipt is our own record of the scan.

  35. grafana/alloyGrafana Labs
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Ubuntu 24.04.5 LTS): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for grafana/alloy
  36. splunk/universalforwarderSplunk
    What changed

    rebuilt image has no default copy the scanner recognises judged wrong (Red Hat Enterprise Linux 8.10 (Ootpa)): /usr/share/zoneinfo 2026c to 2026e or later (offsets measured)

    Evidence for splunk/universalforwarder

Our fix calls

The chance we gave each image that our scan finds none of its default copies wrong on 1 November, set when we froze the forecast and not changed since. A chance of 50% or more counts as a call of fixed. On 2 November we score every call we can read, name any we cannot, and score the whole forecast against the freeze-day count.

ImageOur chance it is fixed in timeOur callNow
cloudcustodian/c7n90%FixedNot yet
cloudcustodian/c7n-org90%FixedNot yet
altinity/metrics-exporter82%FixedNot yet
altinity/clickhouse-operator82%FixedNot yet
getwud/wud74%FixedNot yet
stakater/reloader44%Not fixedNot yet
fluent/fluent-bit41%Not fixedNot yet
library/redis40%Not fixedNot yet
library/sonarqube40%Not fixedNot yet
grafana/loki26%Not fixedNot yet
bitnami/sealed-secrets-controller17%Not fixedNot yet
kong/kong-gateway17%Not fixedNot yet
amazon/aws-xray-daemon17%Not fixedNot yet
kiwigrid/k8s-sidecar12%Not fixedNot yet
library/mongo6%Not fixedNot yet
jenkins/jenkins0%Not fixedNot yet
library/docker0%Not fixedNot yet
library/golang0%Not fixedNot yet
library/httpd0%Not fixedNot yet
library/memcached0%Not fixedNot yet
library/nginx0%Not fixedNot yet
library/node0%Not fixedNot yet
library/postgres0%Not fixedNot yet
library/python0%Not fixedNot yet
linuxserver/radarr0%Not fixedNot yet
linuxserver/sonarr0%Not fixedNot yet
newrelic/infrastructure-bundle0%Not fixedNot yet
openpolicyagent/gatekeeper0%Not fixedNot yet
timberio/vector0%Not fixedNot yet

Every day

DayScanned of 1,000WrongWrong, main­tainedFixed since census
92355729145
92356629936
92358031322
9235953277
9235973295
9236023340

How we forecast

Each repository's main tag is scanned for the time-zone copies our scanner recognises (OS zoneinfo, Java, ICU, PHP, Go and others). An image counts as wrong if any copy it uses by default is judged to give a wrong offset for Vancouver, Edmonton, Inuvik or Winnipeg: offsets are measured for zoneinfo-format copies and inferred from the tz release label for Java and ICU copies. Each wrong copy is given its published fix route; an image leaves the count only when its slowest copy is fixed and its tag is rebuilt after that. Shared events (Debian's update, base image rebuilds) are simulated once per run for all their children. The frozen method.

Every date on the Breakage Calendar