Docker uses xattrs for file linux capabilities. For example, ping has CAP_NET_RAW to enable non-root users to ping.
The tar command has the ability to preserve xattrs, but there is a bug in libguestfs that prevents the xattrs from being used by the tar-in command of guestfish.
Related: