Description
My Dockerfile

FROM centos:7

CMD "setcap cap_net_admin,cap_net_raw+p /usr/bin/ping"

I have used setcap to change file /usr/bin/ping capability. When I use ctr to pull my image, the file /usr/bin/ping has lost these capabilities, but I use docker pull, it haven't lost.

Steps to reproduce the issue:

1. Use my Dockerfile to build image, and push it into registry
2. ctr pull image

ctr images pull mycentos:7

3. use image to run container, and use getcap /usr/bin/ping to check capabilities.

Describe the results you received:

Describe the results you expected:

Output of containerd --version:

containerd github.com/containerd/containerd v1.2.0-120-g0b0d6e6 0b0d6e6bdd78f02e33e308eb0bc41561d80fc62e