After a tzdata update, timestamps disagree

After an update, timestamps were an hour off, or offsets for a zone changed.

tzdata was updated. Governments move DST boundaries and reassign zones, so the same Asia/Shanghai can resolve differently across tzdata versions — China has no DST, but plenty of zones do.

dpkg -l tzdata | tail -1
zdump -v Asia/Shanghai | tail -5
timedatectl

If a container and its host carry different tzdata versions, the same code computes different local times. Mounting the host's /usr/share/zoneinfo into the container removes that class of bug.

The durable answer is the usual one: keep internals in UTC, convert only at the display layer.