Currently the diff tars produced by the archive package do not include the parent directories with a file has changed. When these tars are imported into AUFS or overlay2 in Docker, the parent directories end up with the default permissions due to direct extraction not allowing copy up of the parent to the occur.

The OCI specification is incomplete in defining this behavior https://github.com/opencontainers/image-spec/blob/master/layer.md

See moby/buildkit#154