3 files changed, 28 insertions, 9 deletions
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go
index 24319f4b5..94c6c3840 100644
--- a/libpod/container_internal_linux.go
+++ b/libpod/container_internal_linux.go
@@ -1503,16 +1503,24 @@ func (c *Container) makeBindMounts() error {
 	}
 
 	// Make /etc/localtime
-	if c.Timezone() != "" {
+	ctrTimezone := c.Timezone()
+	if ctrTimezone != "" {
+		// validate the format of the timezone specified if it's not "local"
+		if ctrTimezone != "local" {
+			_, err = time.LoadLocation(ctrTimezone)
+			if err != nil {
+				return errors.Wrapf(err, "error finding timezone for container %s", c.ID())
+			}
+		}
 		if _, ok := c.state.BindMounts["/etc/localtime"]; !ok {
 			var zonePath string
-			if c.Timezone() == "local" {
+			if ctrTimezone == "local" {
 				zonePath, err = filepath.EvalSymlinks("/etc/localtime")
 				if err != nil {
 					return errors.Wrapf(err, "error finding local timezone for container %s", c.ID())
 				}
 			} else {
-				zone := filepath.Join("/usr/share/zoneinfo", c.Timezone())
+				zone := filepath.Join("/usr/share/zoneinfo", ctrTimezone)
 				zonePath, err = filepath.EvalSymlinks(zone)
 				if err != nil {
 					return errors.Wrapf(err, "error setting timezone for container %s", c.ID())
diff --git a/libpod/oci_conmon_linux.go b/libpod/oci_conmon_linux.go
index ef5f6fb0c..1c7089e5d 100644
--- a/libpod/oci_conmon_linux.go
+++ b/libpod/oci_conmon_linux.go
@@ -1268,7 +1268,10 @@ func prepareProcessExec(c *Container, options *ExecOptions, env []string, sessio
 		return nil, err
 	}
 
-	allCaps := capabilities.AllCapabilities()
+	allCaps, err := capabilities.BoundingSet()
+	if err != nil {
+		return nil, err
+	}
 	if options.Privileged {
 		pspec.Capabilities.Bounding = allCaps
 	} else {
diff --git a/libpod/runtime_img.go b/libpod/runtime_img.go
index 90b11f8ca..13ac42e7d 100644
--- a/libpod/runtime_img.go
+++ b/libpod/runtime_img.go
@@ -313,15 +313,23 @@ func (r *Runtime) LoadImageFromSingleImageArchive(ctx context.Context, writer io
 		func() (types.ImageReference, error) {
 			return layout.NewReference(inputFile, "")
 		},
+		func() (types.ImageReference, error) {
+			// This item needs to be last to break out of loop and report meaningful error message
+			return nil,
+				errors.New("payload does not match any of the supported image formats (oci-archive, oci-dir, docker-archive, docker-dir)")
+		},
 	} {
 		src, err := referenceFn()
-		if err == nil && src != nil {
-			newImages, err := r.ImageRuntime().LoadFromArchiveReference(ctx, src, signaturePolicy, writer)
-			if err == nil {
-				return getImageNames(newImages), nil
-			}
+		if err != nil {
 			saveErr = err
+			continue
+		}
+
+		newImages, err := r.ImageRuntime().LoadFromArchiveReference(ctx, src, signaturePolicy, writer)
+		if err == nil {
+			return getImageNames(newImages), nil
 		}
+		saveErr = err
 	}
 	return "", errors.Wrapf(saveErr, "error pulling image")
 }