Why tar keeps the leading slash

Creating an archive from an absolute path strips the leading slash and prints a warning about it. That is deliberate: an archive of /etc that unpacks into /etc wherever it lands is a footgun, so the default is to make the paths relative and let you decide where they go at extraction time.

Pass -P and it keeps the slash, on both sides — writing the archive and reading it back. Worth knowing before you restore a backup on a machine you did not make it on.

Sorting is not sorting

The same sort on two machines can disagree, because collation order comes from the locale rather than from the bytes. Under en_US.UTF-8 punctuation and case are largely ignored; under C every byte counts and uppercase sorts before lowercase.

If a script compares sorted output — a diff of two listings, say — pin it with LC_ALL=C. Otherwise the test passes on your laptop and fails on the build machine, and nothing in the diff explains why.

Three kinds of file timestamp

Every file carries three: mtime, when the contents last changed; atime, when it was last read; and ctime, when the inode itself last changed — a rename, a permission change, a new hard link.

There is no creation time in the traditional set, which is why a tool that claims to sort by "date created" is really sorting by one of these. Most pick mtime. That is usually what you wanted anyway, right up until the moment you copy a tree without preserving it.