diff --git a/Project.toml b/Project.toml
index 7bc55d9..16539da 100644
--- a/Project.toml
+++ b/Project.toml
@@ -12,10 +12,12 @@ SHA = "ea8e919c-243c-51af-8825-aaa63cd721ce"
 Scratch = "6c6a2e73-6563-6170-7368-637461726353"
 TOML = "fa267f1f-6049-4f14-aa54-33bafae1ed76"
 Tar = "a4e569a6-e804-4fa4-b0f3-eef7a1d5b13e"
+Tar_jll = "9b64493d-8859-5bf3-93d7-7c32dd38186f"
 UserNSSandbox_jll = "b88861f7-1d72-59dd-91e7-a8cc876a4984"
 
 [compat]
 Preferences = "1.2.1"
 Scratch = "1"
+Tar_jll = "=1.32.0"
 UserNSSandbox_jll = "2021.8.18"
 julia = "1.6"
diff --git a/src/Docker.jl b/src/Docker.jl
index d2a080b..27bba48 100644
--- a/src/Docker.jl
+++ b/src/Docker.jl
@@ -1,4 +1,5 @@
 using Random, Tar
+import Tar_jll
 
 Base.@kwdef struct DockerExecutor <: SandboxExecutor
     label::String = Random.randstring(10)
@@ -91,9 +92,17 @@ function build_docker_image(root_path::String, uid::Cint, gid::Cint; verbose::Bo
 
         # Build the docker image
         open(`docker import - $(image_name)`, "w", verbose ? stdout : devnull) do io
-            # we need to record permisions, so can't use Tar.jl
+            # We need to record permissions, and therefore we cannot use Tar.jl.
+            # Some systems (e.g. macOS) ship with a BSD tar that does not support the
+            # `--owner` and `--group` command-line options. Therefore, if Tar_jll is
+            # available, we use the GNU tar provided by Tar_jll. If Tar_jll is not available,
+            # we fall back to the system tar.
             cd(root_path) do
-                run(pipeline(`tar -c --owner=$(uid) --group=$(gid) .`, stdout=io))
+            # tar = Tar_jll.is_available() ? Tar_jll.tar() : `tar`
+            # run(pipeline(`$(tar) -c --owner=$(uid) --group=$(gid) .`, stdout=io))
+            Tar_jll.tar() do tar
+                run(pipeline(`$(tar) -c --owner=$(uid) --group=$(gid) .`, stdout=io))
+            end
             end
         end