Add Bazel 0.17.1 to supported version list. (#186)

* Add Bazel 0.17.1 to supported version list.

* Simplify config to build with sanitizers

* Not set entrypoint to Bazel in bazel-docker-gcloud container.

* Fix legacy gcloud command.

* Add GCOV env var to all cc layers

See https://github.com/bazelbuild/bazel/pull/5946
diff --git a/.bazelci/presubmit.yml b/.bazelci/presubmit.yml
index 2c840a3..499b27d 100644
--- a/.bazelci/presubmit.yml
+++ b/.bazelci/presubmit.yml
@@ -28,10 +28,10 @@
     - "//container/debian8/builders/rbe-debian8:toolchain-test"
     - "//container/ubuntu16_04/builders/rbe-ubuntu16_04:toolchain-test"
     - "//container/experimental/rbe-debian9:toolchain-test"
-    - "//container/ubuntu16_04/builders/bazel:bazel_0.16.1-test"
-    - "//container/ubuntu16_04/builders/bazel_docker_gcloud:bazel_0.16.1_docker_gcloud-test"
-    - "//container/debian8/builders/bazel:bazel_0.16.1-test"
-    - "//container/ubuntu14_04/builders/bazel:bazel_0.16.1-test"
+    - "//container/ubuntu16_04/builders/bazel:bazel_0.17.1-test"
+    - "//container/ubuntu16_04/builders/bazel_docker_gcloud:bazel_0.17.1_docker_gcloud-test"
+    - "//container/debian8/builders/bazel:bazel_0.17.1-test"
+    - "//container/ubuntu14_04/builders/bazel:bazel_0.17.1-test"
     test_flags:
     - "--test_output=errors"
     - "--verbose_failures"
diff --git a/configs/debian8_clang/0.3.0/toolchain.bazelrc b/configs/debian8_clang/0.3.0/toolchain.bazelrc
index af63d57..2a5688c 100644
--- a/configs/debian8_clang/0.3.0/toolchain.bazelrc
+++ b/configs/debian8_clang/0.3.0/toolchain.bazelrc
@@ -21,17 +21,20 @@
 build:remote --host_platform=@bazel_toolchains//configs/debian8_clang/0.3.0:rbe_debian8
 build:remote --platforms=@bazel_toolchains//configs/debian8_clang/0.3.0:rbe_debian8
 
-# Experimental configs for sanitizers, use --config=remote --config=remote-xxsan --config=remote-<asan/tsan/msan> (in that order)
+# Experimental configs for sanitizers, use --config=remote --config=remote-<asan/tsan/msan> (in that order)
 # See https://github.com/bazelbuild/bazel/issues/5291.
 build:remote-xxsan --copt=-gmlt
 build:remote-xxsan --strip=never
 
+build:remote-asan --config=remote-xxsan
 build:remote-asan --copt=-fsanitize=address
 build:remote-asan --linkopt=-fsanitize=address
 
+build:remote-tsan --config=remote-xxsan
 build:remote-tsan --copt=-fsanitize=thread
 build:remote-tsan --linkopt=-fsanitize=thread
 
+build:remote-msan --config=remote-xxsan
 build:remote-msan --copt=-fsanitize=memory
 build:remote-msan --linkopt=-fsanitize=memory
 build:remote-msan --cxxopt=--stdlib=libc++
diff --git a/configs/debian8_clang/0.4.0/toolchain.bazelrc b/configs/debian8_clang/0.4.0/toolchain.bazelrc
index 4bde93e..996d511 100644
--- a/configs/debian8_clang/0.4.0/toolchain.bazelrc
+++ b/configs/debian8_clang/0.4.0/toolchain.bazelrc
@@ -21,17 +21,20 @@
 build:remote --host_platform=@bazel_toolchains//configs/debian8_clang/0.4.0:rbe_debian8
 build:remote --platforms=@bazel_toolchains//configs/debian8_clang/0.4.0:rbe_debian8
 
-# Experimental configs for sanitizers, use --config=remote --config=remote-xxsan --config=remote-<asan/tsan/msan> (in that order)
+# Experimental configs for sanitizers, use --config=remote --config=remote-<asan/tsan/msan> (in that order)
 # See https://github.com/bazelbuild/bazel/issues/5291.
 build:remote-xxsan --copt=-gmlt
 build:remote-xxsan --strip=never
 
+build:remote-asan --config=remote-xxsan
 build:remote-asan --copt=-fsanitize=address
 build:remote-asan --linkopt=-fsanitize=address
 
+build:remote-tsan --config=remote-xxsan
 build:remote-tsan --copt=-fsanitize=thread
 build:remote-tsan --linkopt=-fsanitize=thread
 
+build:remote-msan --config=remote-xxsan
 build:remote-msan --copt=-fsanitize=memory
 build:remote-msan --linkopt=-fsanitize=memory
 build:remote-msan --cxxopt=--stdlib=libc++
diff --git a/configs/ubuntu16_04_clang/1.0/toolchain.bazelrc b/configs/ubuntu16_04_clang/1.0/toolchain.bazelrc
index 0afcd52..d3f6b6c 100644
--- a/configs/ubuntu16_04_clang/1.0/toolchain.bazelrc
+++ b/configs/ubuntu16_04_clang/1.0/toolchain.bazelrc
@@ -21,17 +21,20 @@
 build:remote --host_platform=@bazel_toolchains//configs/ubuntu16_04_clang/1.0:rbe_ubuntu1604
 build:remote --platforms=@bazel_toolchains//configs/ubuntu16_04_clang/1.0:rbe_ubuntu1604
 
-# Experimental configs for sanitizers, use --config=remote --config=remote-xxsan --config=remote-<asan/tsan/msan> (in that order)
+# Experimental configs for sanitizers, use --config=remote --config=remote-<asan/tsan/msan> (in that order)
 # See https://github.com/bazelbuild/bazel/issues/5291.
 build:remote-xxsan --copt=-gmlt
 build:remote-xxsan --strip=never
 
+build:remote-asan --config=remote-xxsan
 build:remote-asan --copt=-fsanitize=address
 build:remote-asan --linkopt=-fsanitize=address
 
+build:remote-tsan --config=remote-xxsan
 build:remote-tsan --copt=-fsanitize=thread
 build:remote-tsan --linkopt=-fsanitize=thread
 
+build:remote-msan --config=remote-xxsan
 build:remote-msan --copt=-fsanitize=memory
 build:remote-msan --linkopt=-fsanitize=memory
 build:remote-msan --cxxopt=--stdlib=libc++
diff --git a/configs/ubuntu16_04_clang/1.1/toolchain.bazelrc b/configs/ubuntu16_04_clang/1.1/toolchain.bazelrc
index 0b2bba1..0da78df 100644
--- a/configs/ubuntu16_04_clang/1.1/toolchain.bazelrc
+++ b/configs/ubuntu16_04_clang/1.1/toolchain.bazelrc
@@ -21,17 +21,20 @@
 build:remote --host_platform=@bazel_toolchains//configs/ubuntu16_04_clang/1.1:rbe_ubuntu1604
 build:remote --platforms=@bazel_toolchains//configs/ubuntu16_04_clang/1.1:rbe_ubuntu1604
 
-# Experimental configs for sanitizers, use --config=remote --config=remote-xxsan --config=remote-<asan/tsan/msan> (in that order)
+# Experimental configs for sanitizers, use --config=remote --config=remote-<asan/tsan/msan> (in that order)
 # See https://github.com/bazelbuild/bazel/issues/5291.
 build:remote-xxsan --copt=-gmlt
 build:remote-xxsan --strip=never
 
+build:remote-asan --config=remote-xxsan
 build:remote-asan --copt=-fsanitize=address
 build:remote-asan --linkopt=-fsanitize=address
 
+build:remote-tsan --config=remote-xxsan
 build:remote-tsan --copt=-fsanitize=thread
 build:remote-tsan --linkopt=-fsanitize=thread
 
+build:remote-msan --config=remote-xxsan
 build:remote-msan --copt=-fsanitize=memory
 build:remote-msan --linkopt=-fsanitize=memory
 build:remote-msan --cxxopt=--stdlib=libc++
diff --git a/container/build.py b/container/build.py
index 490cf92..fb5aa4e 100644
--- a/container/build.py
+++ b/container/build.py
@@ -80,7 +80,7 @@
 import subprocess
 import sys
 
-LATEST_BAZEL_VERSION = "0.16.1"
+LATEST_BAZEL_VERSION = "0.17.1"
 
 SUPPORTED_TYPES = [
     "rbe-debian8", "rbe-debian9", "rbe-ubuntu16_04", "ubuntu16_04-bazel",
@@ -275,7 +275,7 @@
     async_arg = "--async"
   subprocess.check_call(
       shlex.split(
-          ("gcloud container builds submit . "
+          ("gcloud builds submit . "
            "--config={CONFIG} "
            "--substitutions _PROJECT={PROJECT},_CONTAINER={CONTAINER},"
            "_BAZEL_VERSION={BAZEL_VERSION},"
diff --git a/container/common/BUILD b/container/common/BUILD
index badda5a..c19ce8b 100644
--- a/container/common/BUILD
+++ b/container/common/BUILD
@@ -19,10 +19,6 @@
 exports_files(glob(["*.yaml"]))
 
 load(
-    "//third_party/clang:revision.bzl",
-    "CLANG_REVISION",
-)
-load(
     "//third_party/golang:revision.bzl",
     "GOLANG_REVISION",
 )
@@ -33,13 +29,6 @@
 )
 
 genrule(
-    name = "generate_clang_yaml",
-    srcs = ["clang.yaml.tpl"],
-    outs = ["clang.yaml"],
-    cmd = "sed 's|{_CLANG_REVISION}|" + CLANG_REVISION.lstrip("r") + "|' <$< >$@",
-)
-
-genrule(
     name = "generate_go_yaml",
     srcs = ["go.yaml.tpl"],
     outs = ["go.yaml"],
diff --git a/container/common/bazel/BUILD b/container/common/bazel/BUILD
index 263db40..caa7089 100644
--- a/container/common/bazel/BUILD
+++ b/container/common/bazel/BUILD
@@ -16,4 +16,14 @@
 
 package(default_visibility = ["//visibility:public"])
 
+load("//container/common/bazel:version.bzl", "BAZEL_VERSION_SHA256S")
+
 exports_files(glob(["**"]))
+
+# Generate Bazel container testing yaml files with all supported Bazel versions.
+[genrule(
+    name = "generate_bazel_%s_yaml" % bazel_version,
+    srcs = [":bazel.yaml.tpl"],
+    outs = ["bazel_%s.yaml" % bazel_version],
+    cmd = "sed 's|{_BAZEL_VERSION}|" + bazel_version + "|' <$< >$@",
+) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
diff --git a/container/common/bazel/bazel.bazelrc.tpl b/container/common/bazel/bazel.bazelrc
similarity index 75%
rename from container/common/bazel/bazel.bazelrc.tpl
rename to container/common/bazel/bazel.bazelrc
index 76ba7f6..f0b41e6 100644
--- a/container/common/bazel/bazel.bazelrc.tpl
+++ b/container/common/bazel/bazel.bazelrc
@@ -12,20 +12,22 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# Experimental configs for sanitizers, use --config=xxsan --config=<asan/tsan/msan> (in that order)
+# Experimental configs for sanitizers, use --config=<asan/tsan/msan>
 # See https://github.com/bazelbuild/bazel/issues/5291.
 build:xxsan --copt=-gmlt
 build:xxsan --strip=never
 
+build:asan --config=xxsan
 build:asan --copt=-fsanitize=address
 build:asan --linkopt=-fsanitize=address
 
+build:tsan --config=xxsan
 build:tsan --copt=-fsanitize=thread
 build:tsan --linkopt=-fsanitize=thread
 
+build:msan --config=xxsan
 build:msan --copt=-fsanitize=memory
 build:msan --linkopt=-fsanitize=memory
 build:msan --cxxopt=--stdlib=libc++
 build:msan --copt=-fsanitize-memory-track-origins
-build:msan --host_crosstool_top=@bazel_toolchains//configs/{_CONFIG_BASE}/bazel_{_BAZEL_CONFIG_VERSION}/default:toolchain
-build:msan --crosstool_top=@bazel_toolchains//configs/{_CONFIG_BASE}/bazel_{_BAZEL_CONFIG_VERSION}/msan:toolchain
+build:msan --action_env=BAZEL_LINKOPTS=-lc++:-lc++abi:-lm
diff --git a/container/common/bazel/bazel.yaml.tpl b/container/common/bazel/bazel.yaml.tpl
index c64ae0e..ccac4b4 100644
--- a/container/common/bazel/bazel.yaml.tpl
+++ b/container/common/bazel/bazel.yaml.tpl
@@ -10,8 +10,3 @@
 - name: 'bazelrc'
   path: '/etc/bazel.bazelrc'
   shouldExist: true
-
-fileContentTests:
-- name: 'bazelrc-content'
-  path: '/etc/bazel.bazelrc'
-  expectedContents: ['.*--host_crosstool_top=@bazel_toolchains//configs/{_CONFIG_BASE}/bazel_{_BAZEL_CONFIG_VERSION}/default:toolchain.*']
diff --git a/container/common/bazel/version.bzl b/container/common/bazel/version.bzl
index 8508798..c874d95 100644
--- a/container/common/bazel/version.bzl
+++ b/container/common/bazel/version.bzl
@@ -3,17 +3,5 @@
     "0.15.0": "7f6748b48a7ea6bdf00b0e1967909ce2181ebe6f377638aa454a7d09a0e3ea7b",
     "0.15.2": "13eae0f09565cf17fc1c9ce1053b9eac14c11e726a2215a79ebaf5bdbf435241",
     "0.16.1": "17ab70344645359fd4178002f367885e9019ae7507c9c1ade8220f3628383444",
-}
-
-# This is the map from supported Bazel versions to the Bazel version used to
-# generate the published toolchain configs that the former should be used with.
-# This is needed because, in most cases, patch updates in Bazel do not result in
-# changes in toolchain configs, so we do not publish duplicated toolchain
-# configs. So, for example, Bazel 0.15.2 should still use published toolchain
-# configs generated with Bazel 0.15.0.
-BAZEL_VERSION_TO_CONFIG_VERSION = {
-    "0.14.1": "0.14.1",
-    "0.15.0": "0.15.0",
-    "0.15.2": "0.15.0",
-    "0.16.1": "0.16.1",
+    "0.17.1": "feedbe02c81142ed95ef8d380472f0a0d88e1b9a4b1fb6e21728701032b68e02",
 }
diff --git a/container/common/clang/BUILD b/container/common/clang/BUILD
new file mode 100644
index 0000000..5fce108
--- /dev/null
+++ b/container/common/clang/BUILD
@@ -0,0 +1,29 @@
+# Copyright 2016 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+licenses(["notice"])  # Apache 2.0
+
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "//third_party/clang:revision.bzl",
+    "CLANG_REVISION",
+)
+
+genrule(
+    name = "generate_clang_yaml",
+    srcs = ["clang.yaml.tpl"],
+    outs = ["clang.yaml"],
+    cmd = "sed 's|{_CLANG_REVISION}|" + CLANG_REVISION.lstrip("r") + "|' <$< >$@",
+)
diff --git a/container/common/clang/clang.bzl b/container/common/clang/clang.bzl
new file mode 100644
index 0000000..afca39e
--- /dev/null
+++ b/container/common/clang/clang.bzl
@@ -0,0 +1,6 @@
+clang_env = {
+    "CC": "/usr/local/bin/clang",
+    "GCOV": "/dev/null",
+    "ASAN_SYMBOLIZER_PATH": "/usr/local/bin/llvm-symbolizer",
+    "MSAN_SYMBOLIZER_PATH": "/usr/local/bin/llvm-symbolizer",
+}
diff --git a/container/common/clang.yaml.tpl b/container/common/clang/clang.yaml.tpl
similarity index 100%
rename from container/common/clang.yaml.tpl
rename to container/common/clang/clang.yaml.tpl
diff --git a/container/debian8/builders/bazel/BUILD b/container/debian8/builders/bazel/BUILD
index 20b3b98..1c88765 100644
--- a/container/debian8/builders/bazel/BUILD
+++ b/container/debian8/builders/bazel/BUILD
@@ -72,13 +72,13 @@
     name = "bazel_%s-test" % bazel_version,
     configs = [
         ":container.yaml",
-        "//container/common:clang.yaml",
         "//container/common:java.yaml",
         "//container/common:python2.yaml",
+        "//container/common/clang:clang.yaml",
+        "//container/common/bazel:bazel_%s.yaml" % bazel_version,
         "//container/common/bazel:bazel_tools.yaml",
         "//container/common/bazel:extra_tools.yaml",
         "//container/debian8:debian8.yaml",
-        "//container/debian8/layers/bazel:bazel_%s.yaml" % bazel_version,
     ],
     image = ":bazel_%s" % bazel_version,
     verbose = True,
diff --git a/container/debian8/builders/rbe-debian8/BUILD b/container/debian8/builders/rbe-debian8/BUILD
index 1c76b34..02d0f96 100644
--- a/container/debian8/builders/rbe-debian8/BUILD
+++ b/container/debian8/builders/rbe-debian8/BUILD
@@ -73,11 +73,11 @@
     name = "toolchain-test",
     configs = [
         ":rbe-debian8.yaml",
-        "//container/common:clang.yaml",
         "//container/common:go.yaml",
         "//container/common:java.yaml",
         "//container/common:python2.yaml",
         "//container/common:rbe-base.yaml",
+        "//container/common/clang:clang.yaml",
         "//container/debian8:debian8.yaml",
     ],
     image = ":toolchain",
diff --git a/container/debian8/debian8.bzl b/container/debian8/debian8.bzl
deleted file mode 100644
index 54aef89..0000000
--- a/container/debian8/debian8.bzl
+++ /dev/null
@@ -1,3 +0,0 @@
-# <config_type>/<config_version>
-# Used in substitution in bazel.yaml.tpl and bazel.bazelrc.tpl
-CONFIG_BASE = "debian8_clang/0.3.0"
diff --git a/container/debian8/layers/bazel/BUILD b/container/debian8/layers/bazel/BUILD
index 1d9dc57..03aaa9c 100644
--- a/container/debian8/layers/bazel/BUILD
+++ b/container/debian8/layers/bazel/BUILD
@@ -19,14 +19,7 @@
 load("//container/rules:docker_toolchains.bzl", "language_tool_layer")
 load("//container/rules:docker_toolchains.bzl", "toolchain_container")
 load("@base_images_docker//util:run.bzl", "container_run_and_extract")
-load(
-    "//container/common/bazel:version.bzl",
-    "BAZEL_VERSION_SHA256S",
-    "BAZEL_VERSION_TO_CONFIG_VERSION",
-)
-load("//container/debian8:debian8.bzl", "CONFIG_BASE")
-
-exports_files(glob(["*.yaml"]))
+load("//container/common/bazel:version.bzl", "BAZEL_VERSION_SHA256S")
 
 # Tools required by Bazel. Note that we do not add a CC complier here as we
 # will include that in the final container.
@@ -42,22 +35,13 @@
     ],
 )
 
-# Generate bazel.bazelrc files for all supported versions.
-[genrule(
-    name = "generate_bazel_%s_bazelrc" % bazel_version,
-    srcs = ["//container/common/bazel:bazel.bazelrc.tpl"],
-    outs = ["bazel-%s.bazelrc" % bazel_version],
-    cmd = "sed 's|{_BAZEL_CONFIG_VERSION}|" + BAZEL_VERSION_TO_CONFIG_VERSION.get(bazel_version) + "|; " +
-          "s|{_CONFIG_BASE}|" + CONFIG_BASE + "|' <$< >$@",
-) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
-
 # Create image with Bazel installer for all supported versions.
 [toolchain_container(
     name = "bazel_%s_installer_image" % bazel_version,
     base = "@debian8//image",
     files = [
         "@bazel_%s_installer//file" % bazel_version.replace(".", ""),
-        ":bazel-%s.bazelrc" % bazel_version,
+        "//container/common/bazel:bazel.bazelrc",
     ],
     packages = [
         "unzip",
@@ -68,7 +52,7 @@
 [container_run_and_extract(
     name = "bazel_%s_tar" % bazel_version,
     commands = [
-        "mv /bazel-%s.bazelrc /etc/bazel.bazelrc" % bazel_version,
+        "mv /bazel.bazelrc /etc/bazel.bazelrc",
         "chmod +x /bazel-%s-installer-linux-x86_64.sh" % bazel_version,
         "/bazel-%s-installer-linux-x86_64.sh" % bazel_version,
         "tar cvf /bazel.tar --mtime='1970-01-01' /usr/local/bin/bazel /usr/local/lib/bazel/* /etc/bazel.bazelrc",
@@ -83,13 +67,3 @@
     base = "@debian8//image",
     tars = [":bazel_%s_tar" % bazel_version],
 ) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
-
-# Generate Bazel container testing yaml files with all supported Bazel versions.
-[genrule(
-    name = "generate_bazel_%s_yaml" % bazel_version,
-    srcs = ["//container/common/bazel:bazel.yaml.tpl"],
-    outs = ["bazel_%s.yaml" % bazel_version],
-    cmd = "sed 's|{_BAZEL_VERSION}|" + bazel_version + "|; " +
-          "s|{_BAZEL_CONFIG_VERSION}|" + BAZEL_VERSION_TO_CONFIG_VERSION.get(bazel_version) + "|; " +
-          "s|{_CONFIG_BASE}|" + CONFIG_BASE + "|' <$< >$@",
-) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
diff --git a/container/debian8/layers/clang/BUILD b/container/debian8/layers/clang/BUILD
index d58d051..dc60ff1 100644
--- a/container/debian8/layers/clang/BUILD
+++ b/container/debian8/layers/clang/BUILD
@@ -20,15 +20,12 @@
     "//container/rules:docker_toolchains.bzl",
     "language_tool_layer",
 )
+load("//container/common/clang:clang.bzl", "clang_env")
 
 language_tool_layer(
     name = "clang-ltl",
     base = "@debian8//image",
-    env = {
-        "CC": "/usr/local/bin/clang",
-        "ASAN_SYMBOLIZER_PATH": "/usr/local/bin/llvm-symbolizer",
-        "MSAN_SYMBOLIZER_PATH": "/usr/local/bin/llvm-symbolizer",
-    },
+    env = clang_env,
     packages = [
         "libstdc++-4.9-dev",
     ],
diff --git a/container/experimental/rbe-debian8/BUILD b/container/experimental/rbe-debian8/BUILD
index 635cacb..fae54f3 100644
--- a/container/experimental/rbe-debian8/BUILD
+++ b/container/experimental/rbe-debian8/BUILD
@@ -31,6 +31,7 @@
     "container_image",
     "container_layer",
 )
+load("//container/common/clang:clang.bzl", "clang_env")
 
 cacerts(
     name = "cacerts",
@@ -72,11 +73,7 @@
 container_layer(
     name = "clang-ltl",
     debs = clang_layer_packages(),
-    env = {
-        "CC": "/usr/local/bin/clang",
-        "ASAN_SYMBOLIZER_PATH": "/usr/local/bin/llvm-symbolizer",
-        "MSAN_SYMBOLIZER_PATH": "/usr/local/bin/llvm-symbolizer",
-    },
+    env = clang_env,
     tags = ["manual"],
     tars = [
         "//third_party/clang:debian8_tar",
@@ -126,11 +123,11 @@
 container_test(
     name = "toolchain-test",
     configs = [
-        "//container/common:clang.yaml",
         "//container/common:go.yaml",
         "//container/common:java.yaml",
         "//container/common:python2.yaml",
         "//container/common:rbe-base.yaml",
+        "//container/common/clang:clang.yaml",
         "//container/debian8:debian8.yaml",
         "//container/debian8/builders/rbe-debian8:rbe-debian8.yaml",
     ],
diff --git a/container/experimental/rbe-debian9/BUILD b/container/experimental/rbe-debian9/BUILD
index cf819e1..9d3ea2c 100644
--- a/container/experimental/rbe-debian9/BUILD
+++ b/container/experimental/rbe-debian9/BUILD
@@ -22,6 +22,7 @@
     "toolchain_container",
 )
 load("@io_bazel_rules_docker//contrib:test.bzl", "container_test")
+load("//container/common/clang:clang.bzl", "clang_env")
 
 JAVA_CLEANUP_COMMANDS = (
     "rm -rf " +
@@ -83,11 +84,7 @@
 language_tool_layer(
     name = "clang-ltl",
     base = "@debian9//image",
-    env = {
-        "CC": "/usr/local/bin/clang",
-        "ASAN_SYMBOLIZER_PATH": "/usr/local/bin/llvm-symbolizer",
-        "MSAN_SYMBOLIZER_PATH": "/usr/local/bin/llvm-symbolizer",
-    },
+    env = clang_env,
     packages = [
         "libstdc++-6-dev",
     ],
@@ -163,11 +160,11 @@
     name = "toolchain-test",
     configs = [
         ":rbe-debian9.yaml",
-        "//container/common:clang.yaml",
         "//container/common:go.yaml",
         "//container/common:java.yaml",
         "//container/common:python2.yaml",
         "//container/common:rbe-base.yaml",
+        "//container/common/clang:clang.yaml",
     ],
     image = ":toolchain",
     verbose = True,
diff --git a/container/ubuntu14_04/builders/bazel/BUILD b/container/ubuntu14_04/builders/bazel/BUILD
index 7d53c93..07c09b9 100644
--- a/container/ubuntu14_04/builders/bazel/BUILD
+++ b/container/ubuntu14_04/builders/bazel/BUILD
@@ -74,10 +74,10 @@
         ":container.yaml",
         "//container/common:java.yaml",
         "//container/common:python2.yaml",
+        "//container/common/bazel:bazel_%s.yaml" % bazel_version,
         "//container/common/bazel:bazel_tools.yaml",
         "//container/common/bazel:extra_tools.yaml",
         "//container/ubuntu14_04:ubuntu14_04.yaml",
-        "//container/ubuntu14_04/layers/bazel:bazel_%s.yaml" % bazel_version,
         "//container/ubuntu14_04/layers/gcc:gcc.yaml",
     ],
     image = ":bazel_%s" % bazel_version,
diff --git a/container/ubuntu14_04/layers/bazel/BUILD b/container/ubuntu14_04/layers/bazel/BUILD
index 3495b53..42fc2b9 100644
--- a/container/ubuntu14_04/layers/bazel/BUILD
+++ b/container/ubuntu14_04/layers/bazel/BUILD
@@ -19,12 +19,7 @@
 load("//container/rules:docker_toolchains.bzl", "language_tool_layer")
 load("//container/rules:docker_toolchains.bzl", "toolchain_container")
 load("@base_images_docker//util:run.bzl", "container_run_and_extract")
-load(
-    "//container/common/bazel:version.bzl",
-    "BAZEL_VERSION_SHA256S",
-)
-
-exports_files(glob(["*.yaml"]))
+load("//container/common/bazel:version.bzl", "BAZEL_VERSION_SHA256S")
 
 # Tools required by Bazel. Note that we do not add a CC complier here as we
 # will include that in the final container.
@@ -46,6 +41,7 @@
     base = "@trusty//image",
     files = [
         "@bazel_%s_installer//file" % bazel_version.replace(".", ""),
+        "//container/common/bazel:bazel.bazelrc",
     ],
     packages = [
         "unzip",
@@ -56,9 +52,10 @@
 [container_run_and_extract(
     name = "bazel_%s_tar" % bazel_version,
     commands = [
+        "mv /bazel.bazelrc /etc/bazel.bazelrc",
         "chmod +x /bazel-%s-installer-linux-x86_64.sh" % bazel_version,
         "/bazel-%s-installer-linux-x86_64.sh" % bazel_version,
-        "tar cvf /bazel.tar --mtime='1970-01-01' /usr/local/bin/bazel /usr/local/lib/bazel/*",
+        "tar cvf /bazel.tar --mtime='1970-01-01' /usr/local/bin/bazel /usr/local/lib/bazel/* /etc/bazel.bazelrc",
     ],
     extract_file = "/bazel.tar",
     image = ":bazel_%s_installer_image.tar" % bazel_version,
@@ -70,11 +67,3 @@
     base = "@trusty//image",
     tars = [":bazel_%s_tar" % bazel_version],
 ) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
-
-# Generate Bazel container testing yaml files with all supported Bazel versions.
-[genrule(
-    name = "generate_bazel_%s_yaml" % bazel_version,
-    srcs = [":bazel.yaml.tpl"],
-    outs = ["bazel_%s.yaml" % bazel_version],
-    cmd = "sed 's|{_BAZEL_VERSION}|" + bazel_version + "|' <$< >$@ ",
-) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
diff --git a/container/ubuntu14_04/layers/bazel/bazel.yaml.tpl b/container/ubuntu14_04/layers/bazel/bazel.yaml.tpl
deleted file mode 100644
index e391955..0000000
--- a/container/ubuntu14_04/layers/bazel/bazel.yaml.tpl
+++ /dev/null
@@ -1,7 +0,0 @@
-schemaVersion: "2.0.0"
-
-commandTests:
-- name: 'check-bazel'
-  command: 'bazel'
-  args: ['version']
-  expectedOutput: ['Build label: {_BAZEL_VERSION}']
diff --git a/container/ubuntu14_04/layers/gcc/BUILD b/container/ubuntu14_04/layers/gcc/BUILD
index 4d6ab68..da99ed0 100644
--- a/container/ubuntu14_04/layers/gcc/BUILD
+++ b/container/ubuntu14_04/layers/gcc/BUILD
@@ -26,6 +26,9 @@
 language_tool_layer(
     name = "gcc-ltl",
     base = "@trusty//image",
+    env = {
+        "GCOV": "/dev/null",
+    },
     packages = [
         "g++",
     ],
diff --git a/container/ubuntu16_04/builders/bazel/BUILD b/container/ubuntu16_04/builders/bazel/BUILD
index 618a9ea..940b9e8 100644
--- a/container/ubuntu16_04/builders/bazel/BUILD
+++ b/container/ubuntu16_04/builders/bazel/BUILD
@@ -72,13 +72,13 @@
     name = "bazel_%s-test" % bazel_version,
     configs = [
         ":container.yaml",
-        "//container/common:clang.yaml",
         "//container/common:java.yaml",
         "//container/common:python2.yaml",
+        "//container/common/clang:clang.yaml",
+        "//container/common/bazel:bazel_%s.yaml" % bazel_version,
         "//container/common/bazel:bazel_tools.yaml",
         "//container/common/bazel:extra_tools.yaml",
         "//container/ubuntu16_04:ubuntu16_04.yaml",
-        "//container/ubuntu16_04/layers/bazel:bazel_%s.yaml" % bazel_version,
     ],
     image = ":bazel_%s" % bazel_version,
     verbose = True,
diff --git a/container/ubuntu16_04/builders/bazel_docker_gcloud/BUILD b/container/ubuntu16_04/builders/bazel_docker_gcloud/BUILD
index 24f9781..a13b5da 100644
--- a/container/ubuntu16_04/builders/bazel_docker_gcloud/BUILD
+++ b/container/ubuntu16_04/builders/bazel_docker_gcloud/BUILD
@@ -38,8 +38,13 @@
 # Generate the container with Bazel and Docker for all supported versions of
 # Bazel.
 [toolchain_container(
-    name = "bazel_%s_docker_gcloud_intermediate" % bazel_version,
+    name = "bazel_%s_docker_gcloud" % bazel_version,
     base = "@ubuntu16_04//image",
+    cmd = [
+        "/bin/sh",
+        "-c",
+        "/bin/bash",
+    ],
     # TODO(xingao) Fix this. We should not remove /etc/ssl/certs/java/cacerts
     # file in the java-ltl, but instead, archive it for future container
     # reproduction.
@@ -57,30 +62,18 @@
     ],
 ) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
 
-# Set up `entrypoint` and cmd in the container. These cannot be down in the
-# `toolchain_container` rule as they would be consumed by intermediate
-# `container_image` rule in its implementation.
-# TODO(xingao): enable setting things like `entrypoint` and `cmd` in
-# `toolchain_container`.
-[container_image(
-    name = "bazel_%s_docker_gcloud" % bazel_version,
-    base = ":bazel_%s_docker_gcloud_intermediate" % bazel_version,
-    cmd = None,
-    entrypoint = ["/usr/local/bin/bazel"],
-) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
-
 # container_test targets for all supported bazel_docker containers..
 [container_test(
     name = "bazel_%s_docker_gcloud-test" % bazel_version,
     configs = [
         ":container.yaml",
-        "//container/common:clang.yaml",
         "//container/common:java.yaml",
         "//container/common:python2.yaml",
+        "//container/common/clang:clang.yaml",
+        "//container/common/bazel:bazel_%s.yaml" % bazel_version,
         "//container/common/bazel:bazel_tools.yaml",
         "//container/common/bazel:extra_tools.yaml",
         "//container/ubuntu16_04:ubuntu16_04.yaml",
-        "//container/ubuntu16_04/layers/bazel:bazel_%s.yaml" % bazel_version,
         "//container/ubuntu16_04/layers/docker-17.12.0:docker-17.12.0.yaml",
         "//container/ubuntu16_04/layers/gcloud:gcloud.yaml",
     ],
diff --git a/container/ubuntu16_04/builders/bazel_docker_gcloud/container.yaml b/container/ubuntu16_04/builders/bazel_docker_gcloud/container.yaml
index 082ae57..c27a43a 100644
--- a/container/ubuntu16_04/builders/bazel_docker_gcloud/container.yaml
+++ b/container/ubuntu16_04/builders/bazel_docker_gcloud/container.yaml
@@ -4,5 +4,3 @@
   env:
     - key: 'PATH'
       value: '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/python3.6/bin'
-  entrypoint: ["/usr/local/bin/bazel"]
-  cmd: []
diff --git a/container/ubuntu16_04/builders/rbe-ubuntu16_04/BUILD b/container/ubuntu16_04/builders/rbe-ubuntu16_04/BUILD
index 23e7cb5..c92a435 100644
--- a/container/ubuntu16_04/builders/rbe-ubuntu16_04/BUILD
+++ b/container/ubuntu16_04/builders/rbe-ubuntu16_04/BUILD
@@ -75,11 +75,11 @@
     name = "toolchain-test",
     configs = [
         ":rbe-ubuntu16_04.yaml",
-        "//container/common:clang.yaml",
         "//container/common:go.yaml",
         "//container/common:java.yaml",
         "//container/common:python2.yaml",
         "//container/common:rbe-base.yaml",
+        "//container/common/clang:clang.yaml",
         "//container/ubuntu16_04:ubuntu16_04.yaml",
     ],
     image = ":toolchain",
diff --git a/container/ubuntu16_04/layers/bazel/BUILD b/container/ubuntu16_04/layers/bazel/BUILD
index 70c4a29..644c7b4 100644
--- a/container/ubuntu16_04/layers/bazel/BUILD
+++ b/container/ubuntu16_04/layers/bazel/BUILD
@@ -19,14 +19,7 @@
 load("//container/rules:docker_toolchains.bzl", "language_tool_layer")
 load("//container/rules:docker_toolchains.bzl", "toolchain_container")
 load("@base_images_docker//util:run.bzl", "container_run_and_extract")
-load(
-    "//container/common/bazel:version.bzl",
-    "BAZEL_VERSION_SHA256S",
-    "BAZEL_VERSION_TO_CONFIG_VERSION",
-)
-load("//container/ubuntu16_04:ubuntu16_04.bzl", "CONFIG_BASE")
-
-exports_files(glob(["*.yaml"]))
+load("//container/common/bazel:version.bzl", "BAZEL_VERSION_SHA256S")
 
 # Tools required by Bazel. Note that we do not add a CC complier here as we
 # will include that in the final container.
@@ -42,22 +35,13 @@
     ],
 )
 
-# Generate bazel.bazelrc files for all supported versions.
-[genrule(
-    name = "generate_bazel_%s_bazelrc" % bazel_version,
-    srcs = ["//container/common/bazel:bazel.bazelrc.tpl"],
-    outs = ["bazel-%s.bazelrc" % bazel_version],
-    cmd = "sed 's|{_BAZEL_CONFIG_VERSION}|" + BAZEL_VERSION_TO_CONFIG_VERSION.get(bazel_version) + "|; " +
-          "s|{_CONFIG_BASE}|" + CONFIG_BASE + "|' <$< >$@",
-) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
-
 # Create image with Bazel installer for all supported versions.
 [toolchain_container(
     name = "bazel_%s_installer_image" % bazel_version,
     base = "@ubuntu16_04//image",
     files = [
         "@bazel_%s_installer//file" % bazel_version.replace(".", ""),
-        ":bazel-%s.bazelrc" % bazel_version,
+        "//container/common/bazel:bazel.bazelrc",
     ],
     packages = [
         "unzip",
@@ -68,7 +52,7 @@
 [container_run_and_extract(
     name = "bazel_%s_tar" % bazel_version,
     commands = [
-        "mv /bazel-%s.bazelrc /etc/bazel.bazelrc" % bazel_version,
+        "mv /bazel.bazelrc /etc/bazel.bazelrc",
         "chmod +x /bazel-%s-installer-linux-x86_64.sh" % bazel_version,
         "/bazel-%s-installer-linux-x86_64.sh" % bazel_version,
         "tar cvf /bazel.tar --mtime='1970-01-01' /usr/local/bin/bazel /usr/local/lib/bazel/* /etc/bazel.bazelrc",
@@ -83,13 +67,3 @@
     base = "@ubuntu16_04//image",
     tars = [":bazel_%s_tar" % bazel_version],
 ) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
-
-# Generate Bazel container testing yaml files with all supported Bazel versions.
-[genrule(
-    name = "generate_bazel_%s_yaml" % bazel_version,
-    srcs = ["//container/common/bazel:bazel.yaml.tpl"],
-    outs = ["bazel_%s.yaml" % bazel_version],
-    cmd = "sed 's|{_BAZEL_VERSION}|" + bazel_version + "|; " +
-          "s|{_BAZEL_CONFIG_VERSION}|" + BAZEL_VERSION_TO_CONFIG_VERSION.get(bazel_version) + "|; " +
-          "s|{_CONFIG_BASE}|" + CONFIG_BASE + "|' <$< >$@",
-) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
diff --git a/container/ubuntu16_04/layers/clang/BUILD b/container/ubuntu16_04/layers/clang/BUILD
index 819dc3a..b65dc27 100644
--- a/container/ubuntu16_04/layers/clang/BUILD
+++ b/container/ubuntu16_04/layers/clang/BUILD
@@ -20,15 +20,12 @@
     "//container/rules:docker_toolchains.bzl",
     "language_tool_layer",
 )
+load("//container/common/clang:clang.bzl", "clang_env")
 
 language_tool_layer(
     name = "clang-ltl",
     base = "@ubuntu16_04//image",
-    env = {
-        "CC": "/usr/local/bin/clang",
-        "ASAN_SYMBOLIZER_PATH": "/usr/local/bin/llvm-symbolizer",
-        "MSAN_SYMBOLIZER_PATH": "/usr/local/bin/llvm-symbolizer",
-    },
+    env = clang_env,
     packages = [
         "libstdc++-4.9-dev",
     ],
diff --git a/container/ubuntu16_04/ubuntu16_04.bzl b/container/ubuntu16_04/ubuntu16_04.bzl
deleted file mode 100644
index f72864b..0000000
--- a/container/ubuntu16_04/ubuntu16_04.bzl
+++ /dev/null
@@ -1,3 +0,0 @@
-# <config_type>/<config_version>
-# Used in substitution in bazel.yaml.tpl and bazel.bazelrc.tpl
-CONFIG_BASE = "ubuntu16_04_clang/1.0"
diff --git a/release/toolchain.bazelrc.tpl b/release/toolchain.bazelrc.tpl
index c255d16..bbc7198 100644
--- a/release/toolchain.bazelrc.tpl
+++ b/release/toolchain.bazelrc.tpl
@@ -21,17 +21,20 @@
 build:remote --host_platform=@bazel_toolchains//${PACKAGE}/${CONFIG_VERSION}:${PLATFORM}
 build:remote --platforms=@bazel_toolchains//${PACKAGE}/${CONFIG_VERSION}:${PLATFORM}
 
-# Experimental configs for sanitizers, use --config=remote --config=remote-xxsan --config=remote-<asan/tsan/msan> (in that order)
+# Experimental configs for sanitizers, use --config=remote --config=remote-<asan/tsan/msan> (in that order)
 # See https://github.com/bazelbuild/bazel/issues/5291.
 build:remote-xxsan --copt=-gmlt
 build:remote-xxsan --strip=never
 
+build:remote-asan --config=remote-xxsan
 build:remote-asan --copt=-fsanitize=address
 build:remote-asan --linkopt=-fsanitize=address
 
+build:remote-tsan --config=remote-xxsan
 build:remote-tsan --copt=-fsanitize=thread
 build:remote-tsan --linkopt=-fsanitize=thread
 
+build:remote-msan --config=remote-xxsan
 build:remote-msan --copt=-fsanitize=memory
 build:remote-msan --linkopt=-fsanitize=memory
 build:remote-msan --cxxopt=--stdlib=libc++