diff --git a/go/private/sdk.bzl b/go/private/sdk.bzl
index 3d2515294b..b88bfbd922 100644
--- a/go/private/sdk.bzl
+++ b/go/private/sdk.bzl
@@ -177,11 +177,30 @@ def _remote_sdk(ctx, urls, strip_prefix, sha256):
     if len(urls) == 0:
         fail("no urls specified")
     ctx.report_progress("Downloading and extracting Go toolchain")
-    ctx.download_and_extract(
-        url = urls,
-        stripPrefix = strip_prefix,
-        sha256 = sha256,
-    )
+    if urls[0].endswith(".tar.gz"):
+        # BUG(#2771): Use a system tool to extract the archive instead of
+        # Bazel's implementation. With some exotic configurations (macOS +
+        # Docker + some particular file system binding), Bazel's implementation
+        # rejects files with invalid unicode names. Go has at least one test
+        # case with a file like this, but we haven't been able to reproduce
+        # the failure, so instead, we use this workaround.
+        if strip_prefix != "go":
+            fail("strip_prefix not supported")
+        ctx.download(
+            url = urls,
+            sha256 = sha256,
+            output = "go_sdk.tar.gz",
+        )
+        res = ctx.execute(["tar", "-xf", "go_sdk.tar.gz", "--strip-components=1"])
+        if res.return_code:
+            fail("error extracting Go SDK:\n" + res.stdout + res.stderr)
+        ctx.delete("go_sdk.tar.gz")
+    else:
+        ctx.download_and_extract(
+            url = urls,
+            stripPrefix = strip_prefix,
+            sha256 = sha256,
+        )
 
 def _local_sdk(ctx, path):
     for entry in ["src", "pkg", "bin"]: