Build not keeping file capabilities

If you set any file capabilities to a file, they are not preserved.

For example, setting cap_net_raw+ep to a binary:

$ sudo getcap ./ping    
./ping = cap_net_raw+ep
$ xattr -l ./ping
security.capability:
0000   01 00 00 02 00 20 00 00 00 00 00 00 00 00 00 00    ..... ..........
0010   00 00 00 00  

with Dockerfile:

$ cat Dockerfile                           
FROM ubuntu:latest
COPY ./ping /ping

Build process to tar:

$ docker buildx build --output type=tar,dest=out.tar .
[+] Building 0.8s (7/7) FINISHED                                                                          
 => [internal] load build definition from Dockerfile                                                 0.1s
 => => transferring dockerfile: 75B                                                                  0.0s
 => [internal] load .dockerignore                                                                    0.1s
 => => transferring context: 2B                                                                      0.0s
 => [internal] load metadata for docker.io/library/ubuntu:latest                                     0.0s
 => [internal] load build context                                                                    0.1s
 => => transferring context: 64.57kB                                                                 0.0s
 => [1/2] FROM docker.io/library/ubuntu:latest                                                       0.1s
 => [2/2] COPY ./ping /ping                                                                          0.1s
 => exporting to client                                                                              0.4s
 => => sending tarball 

Extracting from the generated tar file (use sudo and xattrs to maintain existing attrs inside the tar) results in empty capabilities:

$ sudo tar -x --xattrs --xattrs-include='*' -f out.tar

$ sudo getcap ./ping                                  

$ xattr -l ./ping

Is there something we could do to maintains capabilities when building images? I know that I could add the cpas afterwards but that seems wrong when we already have the caps set on a file to get them lost.

Thanks!

Start by reproducing the reported case with the shown Dockerfile, a file carrying cap_net_raw+ep, and the docker buildx build --output type=tar command. Compare getcap and xattr results before building and after extracting the tar with xattrs enabled. Done means file capabilities survive the build and tar export without requiring manual reapplication.