A server is hosting a rootfs-wrapper.tar.xz file which instead of having this structure:

/bin
/sbin
/usr
...

is having a wrapper directory

/wrapper/bin
/wrapper/sbin
/wraper/usr
...

With regular shell we can do:

curl -O http://site/rootfs-wrapper.tar.xz
tar -xf rootfs.tar.xz --strip-components=1 -C .

How do we do that with scratch docker where we don't have access to tar and curl and viable option is to use ADD command

FROM scratch
ADD http://site/rootfs-wrapper.tar.xz /
CMD ["/bin/sh"]

it builds fine with docker build -t simple-build ., but fails to run docker run -it simple-build gives:

Error response from daemon: OCI runtime create failed: container_linux.go:296: starting container process caused "exec: \"/bin/sh\": stat /bin/sh: no such file or directory": unknown.

If we use rootfs.tar.xz without wrapper/ then docker run works without modifying the docker.
I tried setting CMD ["/wrapper/bin/sh"] in docker as well but same result.

Is there a way to make ADD command strip components of tar?