In order to find added/modified files in docker images you can also use the dive (download it from releases) utility:
#First you need to load the image in your docker repo
sudodocker load < image.tar 1 ⨯
Loaded image: flask:latest
#And then open it with dive:
sudo dive flask:latest
This allow you to navigate through the different blobs of docker images and check which files were modified/added. Red means added and yellow means modified. Use tab to move to the other view and space to to collapse/open folders.
With die you won't be able to access the content of the different stages of the image. To do so you will need to decompress each layer and access it.
You can decompress all the layers from an image from the directory where the image was decompressed executing: