code: func ExtractTar(rs io.Reader, dir string, overwrite bool, uidRange *user.UidRange, pwl PathWhitelistMap) error {
  	r, w, err := os.Pipe()
  	if err != nil {
  		return err
  	}
  	defer w.Close()
  	enc := json.NewEncoder(w)
  	cmd := mcEntrypoint.Cmd(dir, strconv.FormatBool(overwrite),
  		strconv.FormatUint(uint64(uidRange.Shift), 10),
  		strconv.FormatUint(uint64(uidRange.Count), 10))
  	cmd.ExtraFiles = []*os.File{r}
  
  	cmd.Stdin = rs
  	encodeCh := make(chan error)
  	go func() {
  		encodeCh <- enc.Encode(pwl)
  	}()
  
  	out, err := cmd.CombinedOutput()
  
  	// read from blocking encodeCh to release the goroutine
  	encodeErr := <-encodeCh
  	if err != nil {
  		return fmt.Errorf("extracttar error: %v, output: %s", err, out)
  	}
  	if encodeErr != nil {
  		return errwrap.Wrap(errors.New("extracttar failed to json encode filemap"), encodeErr)
  	}
  	return nil
  }
docs: // ExtractTar extracts a tarball (from a io.Reader) into the given directory
  // if pwl is not nil, only the paths in the map are extracted.
  // If overwrite is true, existing files will be overwritten.
  // The extraction is executed by fork/exec()ing a new process. The new process
  // needs the CAP_SYS_CHROOT capability.