Comment 8 for bug 1498162

I've seen this pretty consistently too across a few hundred containers. My guess so far was that it had to do with filesystem capabilities or something similar.

So things are set properly when the image is unpacked by real root on the host, but the extended attribute then can't be modified from within the container, leading to the failure. It's just a guess though.