diff --git a/diskimage_builder/elements/containerfile/root.d/08-containerfile b/diskimage_builder/elements/containerfile/root.d/08-containerfile
index 46d4b4af..c3452580 100755
--- a/diskimage_builder/elements/containerfile/root.d/08-containerfile
+++ b/diskimage_builder/elements/containerfile/root.d/08-containerfile
@@ -60,7 +60,9 @@ fi
 
 ${_sudo} podman build -t dib-work-image -f $DIB_CONTAINERFILE_DOCKERFILE $DIB_CONTAINER_CONTEXT
 container=$(${_sudo} podman run -d dib-work-image /bin/sh)
-${_sudo} podman export $container | ${_sudo} tar -C $TARGET_ROOT --numeric-owner -xf -
+# NOTE(ianw) 2021-11-10 the tar must always be sudo to write out the chroot files
+# as other uids
+${_sudo} podman export $container | sudo tar -C $TARGET_ROOT --numeric-owner -xf -
 ${_sudo} podman rm $container
 ${_sudo} podman rmi dib-work-image
 
diff --git a/releasenotes/notes/containerfile-root-extraction-430148dd669cb3da.yaml b/releasenotes/notes/containerfile-root-extraction-430148dd669cb3da.yaml
new file mode 100644
index 00000000..429de977
--- /dev/null
+++ b/releasenotes/notes/containerfile-root-extraction-430148dd669cb3da.yaml
@@ -0,0 +1,5 @@
+---
+fixes:
+  - |
+    This release fixes an regression in the ``containerfile`` element
+    that prevented it extracting root images correctly.