• containerd (0700): https://github.com/containerd/containerd/blob/master/archive/tar.go#L197
• docker (0777): https://github.com/moby/moby/blob/de640c9f4932d851316a0a72470c4d3446f6f5ac/pkg/archive/archive.go#L939.

This causes backward compatibility issues when the image actually doesn't include parent directories, e.g. the image gcr.io/distroless/static:

$ tar tvf layer1.tar.gz | grep "etc/ssl"
-rw-r--r-- 0/0          235192 1969-12-31 16:00 ./etc/ssl/certs/ca-certificates.crt

The behavior in this case is undefined. But it doesn't hurt to change the permission to 0777 to keep consistency with Docker and avoid future issues.