Extract an ext2 filesystem image in a Docker build

I am trying to extract an ext2 initrd filesystem image as part of a Dockerfile build.

I have tried these approaches so far:

• Mounting as a loopback device. This can't be done due to permissions. It seems like you can override this with --privileged, but this can only be done for 'docker run', not 'docker build'.
• libguestfs. I couldn't get this to work, and it required a huge Fedora image to run it.
• Extracting using 7z. Unfortunately this does not preserve permissions and symlinks are converted in to regular files. I can't find any options that would preserve them.

I'm almost at the point of trying to boot the initrd using QEMU, creating a rootfs tarball and copying it out using the virtual network, but surely there's an easier way. I'm surprised there are no userland tools to easily extract a filesystem image.

I could manually prepare a tarball using the loopback method, but the point of using Docker is to automate this.

the debugfs command from the official extX-fs support package (e2fsprogs) has an rdump command to recursively extract filesystems in userspace.

/usr/sbin/debugfs -R 'rdump / filesystem_extracted' filesystem.img

(it had this since may 2000: https://git.kernel.org/pub/scm/fs/ext2/e2fsprogs.git/commit/debugfs/dump.c?id=2e8d40d562ec93d68505800a46c5b9dcc229264e )