The coredns version included with Kubernetes 1.29.0, that is coredns v1.11.1, now requires capabilities:

-ADD coredns /coredns
+COPY coredns /coredns
+RUN setcap cap_net_bind_service=+ep /coredns

So when you run coredns from that image (in the preload), it does not have the capability to listen below 1024:

Listen: listen tcp :53: bind: permission denied

coredns/coredns@d21537f

We need to make sure to include the extended attributes in the tarball, and to extract them again (requires root)

--xattrs --xattrs-include=security.capability

Then the capabilities gets included in the tarball, under a special header called "SCHILY.xattr.security.capability"

It requires a reasonable new tar version, like 1.27+