tarball is the mandatory parameter to the preceding -f and can’t be used to inject commands