@@ -305,6 +305,22 @@ func extractLayer(tarWriter *tar.Writer, fileMap map[string]bool, layer v1.Layer
 		// name, we may have duplicate entries, which angers tar-split.
 		header.Name = filepath.Clean(header.Name)
 
+		// Reject relative symlinks and hardlinks whose targets escape the
+		// image rootfs. Relative targets are resolved against the symlink's
+		// own directory: if the clean result starts with ".." the link would
+		// leave the rootfs. Relative symlinks that stay within the rootfs
+		// (common for glibc, C toolchains, etc.) are preserved unchanged.
+		// Absolute targets are left as-is; see #2238 for ongoing discussion
+		// on whether they should be pruned.
+		if header.Typeflag == tar.TypeSymlink || header.Typeflag == tar.TypeLink {
+			if !filepath.IsAbs(header.Linkname) {
+				resolved := filepath.Clean(filepath.Join(filepath.Dir(header.Name), header.Linkname)) //nolint:gosec // G305: path is only used for validation, not file I/O
+				if strings.HasPrefix(resolved, "..") {
+					continue
+				}
+			}
+		}
+
 		// force PAX format to remove Name/Linkname length limit of 100 characters
 		// required by USTAR and to not depend on internal tar package guess which
 		// prefers USTAR over PAX
 
@@ -686,6 +686,79 @@ func TestAppendStreamableLayer(t *testing.T) {
 	}
 }
 
+// TestExtractSymlinkFiltering verifies that Extract preserves relative symlinks
+// that stay within the rootfs and absolute symlinks (left for callers to handle),
+// while dropping relative symlinks whose resolved path escapes the rootfs boundary.
+func TestExtractSymlinkFiltering(t *testing.T) {
+	// Build a tar layer with several symlink entries.
+	var buf bytes.Buffer
+	tw := tar.NewWriter(&buf)
+	entries := []struct {
+		name     string
+		typeflag byte
+		linkname string
+	}{
+		// Safe relative symlink: usr/local/bin/ld.so -> ../lib/ld-linux.so.2
+		// resolves to usr/local/lib/ld-linux.so.2, inside rootfs.
+		{name: "usr/local/bin/ld.so", typeflag: tar.TypeSymlink, linkname: "../lib/ld-linux.so.2"},
+		// Safe relative symlink: var/lock -> ../run/lock (tailscale/glibc pattern).
+		{name: "usr/local/lib/containers/app/var/lock", typeflag: tar.TypeSymlink, linkname: "../run/lock"},
+		// Absolute target: preserved (see #2238 for ongoing discussion).
+		{name: "usr/local/bin/abs-link", typeflag: tar.TypeSymlink, linkname: "/etc/passwd"},
+		// Unsafe: relative target resolves outside rootfs.
+		{name: "etc/foo", typeflag: tar.TypeSymlink, linkname: "../../../tmp/evil"},
+	}
+	for _, e := range entries {
+		if err := tw.WriteHeader(&tar.Header{
+			Typeflag: e.typeflag,
+			Name:     e.name,
+			Linkname: e.linkname,
+		}); err != nil {
+			t.Fatalf("WriteHeader: %v", err)
+		}
+	}
+	tw.Close()
+
+	layer, err := tarball.LayerFromOpener(func() (io.ReadCloser, error) {
+		return io.NopCloser(bytes.NewReader(buf.Bytes())), nil
+	})
+	if err != nil {
+		t.Fatalf("LayerFromOpener: %v", err)
+	}
+	img, err := mutate.AppendLayers(empty.Image, layer)
+	if err != nil {
+		t.Fatalf("AppendLayers: %v", err)
+	}
+
+	extracted := map[string]string{}
+	tr := tar.NewReader(mutate.Extract(img))
+	for {
+		hdr, err := tr.Next()
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		if err != nil {
+			t.Fatalf("reading extracted tar: %v", err)
+		}
+		if hdr.Typeflag == tar.TypeSymlink || hdr.Typeflag == tar.TypeLink {
+			extracted[hdr.Name] = hdr.Linkname
+		}
+	}
+
+	// These symlinks must be preserved: safe relative ones and absolute ones.
+	for _, name := range []string{"usr/local/bin/ld.so", "usr/local/lib/containers/app/var/lock", "usr/local/bin/abs-link"} {
+		if _, ok := extracted[name]; !ok {
+			t.Errorf("symlink %q was incorrectly dropped", name)
+		}
+	}
+	// Relative targets that escape the rootfs must be filtered out.
+	for _, name := range []string{"etc/foo"} {
+		if target, ok := extracted[name]; ok {
+			t.Errorf("unsafe symlink %q -> %q was not dropped", name, target)
+		}
+	}
+}
+
 func TestCanonical(t *testing.T) {
 	source := sourceImage(t)
 	img, err := mutate.Canonical(source)