diff --git a/WORKSPACE b/WORKSPACE
index 29344231b6a54..4b36229bd89a0 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -114,6 +114,10 @@ http_archive(
 # Container rules
 http_archive(
     name = "rules_oci",
+    patch_args = ["-p1"],
+    patches = [
+        "//third_party/rules_oci:no_xattr.patch",
+    ],
     sha256 = "d41d0ba7855f029ad0e5ee35025f882cbe45b0d5d570842c52704f7a47ba8668",
     strip_prefix = "rules_oci-1.4.3",
     url = "https://github.com/bazel-contrib/rules_oci/releases/download/v1.4.3/rules_oci-v1.4.3.tar.gz",
diff --git a/third_party/rules_oci/BUILD.bazel b/third_party/rules_oci/BUILD.bazel
new file mode 100644
index 0000000000000..d518110449e66
--- /dev/null
+++ b/third_party/rules_oci/BUILD.bazel
@@ -0,0 +1 @@
+exports_files(glob(["*.patch"]))
diff --git a/third_party/rules_oci/no_xattr.patch b/third_party/rules_oci/no_xattr.patch
new file mode 100644
index 0000000000000..c047f1867eabd
--- /dev/null
+++ b/third_party/rules_oci/no_xattr.patch
@@ -0,0 +1,10 @@
+diff --git a/oci/private/tarball.sh.tpl b/oci/private/tarball.sh.tpl
+index 2b5052f..d22fef3 100644
+--- a/oci/private/tarball.sh.tpl
++++ b/oci/private/tarball.sh.tpl
+@@ -137,4 +137,4 @@ layers="${LAYERS}" \
+         --output-format json > "${STAGING_DIR}/manifest.json"
+
+ # TODO: https://github.com/bazel-contrib/rules_oci/issues/217
+-tar -C "${STAGING_DIR}" -cf "${TARBALL_PATH}" manifest.json blobs
++tar --no-xattrs -C "${STAGING_DIR}" -cf "${TARBALL_PATH}" manifest.json blobs