diff --git a/container/ubuntu16_04/layers/docker-17.12.0/docker-17.12.0.yaml b/container/common/docker-17.12.0.yaml
similarity index 100%
rename from container/ubuntu16_04/layers/docker-17.12.0/docker-17.12.0.yaml
rename to container/common/docker-17.12.0.yaml
diff --git a/container/debian8/builders/bazel/BUILD b/container/debian8/builders/bazel/BUILD
index 066e7c7..19100f0 100644
--- a/container/debian8/builders/bazel/BUILD
+++ b/container/debian8/builders/bazel/BUILD
@@ -52,6 +52,7 @@
         "//container/debian8/layers/python:python-ltl",
         "//container/debian8/layers/bazel:bazel-tools",
         "//container/debian8/layers/bazel:bazel_%s-ltl" % bazel_version,
+        "//container/debian8/layers/docker-17.12.0:docker-ltl",
     ],
 ) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
 
@@ -72,6 +73,7 @@
     name = "bazel_%s-test" % bazel_version,
     configs = [
         ":container.yaml",
+        "//container/common:docker-17.12.0.yaml",
         "//container/common:java.yaml",
         "//container/common:python2.yaml",
         "//container/common:python3.yaml",
diff --git a/container/debian8/layers/docker-17.12.0/BUILD b/container/debian8/layers/docker-17.12.0/BUILD
new file mode 100644
index 0000000..970991b
--- /dev/null
+++ b/container/debian8/layers/docker-17.12.0/BUILD
@@ -0,0 +1,59 @@
+# Copyright 2017 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+licenses(["notice"])  # Apache 2.0
+
+package(default_visibility = ["//visibility:public"])
+
+load("//rules/container:docker_toolchains.bzl", "language_tool_layer", "toolchain_container")
+load("@base_images_docker//package_managers:apt_key.bzl", "add_apt_key")
+load("@base_images_docker//package_managers:download_pkgs.bzl", "download_pkgs")
+
+# Downloading "docker-ce" requires "apt-transport-https" to be installed
+# in the container. So create a prerequisite container first.
+toolchain_container(
+    name = "docker-prereq",
+    base = "@debian8//image",
+    packages = [
+        "apt-transport-https",
+    ],
+)
+
+add_apt_key(
+    name = "docker-key-image",
+    image = ":docker-prereq.tar",
+    keys = [
+        "@docker_gpg//file",
+    ],
+)
+
+download_pkgs(
+    name = "docker-packages",
+    additional_repos = [
+        "deb [arch=amd64] https://download.docker.com/linux/debian jessie stable edge",
+    ],
+    image_tar = ":docker-key-image.tar",
+    packages = [
+        "apt-transport-https",
+        "ca-certificates",
+        "curl",
+        "docker-ce=17.12.0~ce-0~debian",
+    ],
+)
+
+language_tool_layer(
+    name = "docker-ltl",
+    base = "@debian8//image",
+    installables_tar = ":docker-packages.tar",
+)
diff --git a/container/ubuntu14_04/builders/bazel/BUILD b/container/ubuntu14_04/builders/bazel/BUILD
index e8fc1ce..89aa93c 100644
--- a/container/ubuntu14_04/builders/bazel/BUILD
+++ b/container/ubuntu14_04/builders/bazel/BUILD
@@ -52,6 +52,7 @@
         "//container/ubuntu14_04/layers/python:python-ltl",
         "//container/ubuntu14_04/layers/bazel:bazel-tools",
         "//container/ubuntu14_04/layers/bazel:bazel_%s-ltl" % bazel_version,
+        "//container/ubuntu14_04/layers/docker-17.12.0:docker-ltl",
     ],
 ) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
 
@@ -72,6 +73,7 @@
     name = "bazel_%s-test" % bazel_version,
     configs = [
         ":container.yaml",
+        "//container/common:docker-17.12.0.yaml",
         "//container/common:java.yaml",
         "//container/common:python2.yaml",
         "//container/common:python3.yaml",
diff --git a/container/ubuntu14_04/layers/docker-17.12.0/BUILD b/container/ubuntu14_04/layers/docker-17.12.0/BUILD
new file mode 100644
index 0000000..c29b62e
--- /dev/null
+++ b/container/ubuntu14_04/layers/docker-17.12.0/BUILD
@@ -0,0 +1,59 @@
+# Copyright 2017 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+licenses(["notice"])  # Apache 2.0
+
+package(default_visibility = ["//visibility:public"])
+
+load("//rules/container:docker_toolchains.bzl", "language_tool_layer", "toolchain_container")
+load("@base_images_docker//package_managers:apt_key.bzl", "add_apt_key")
+load("@base_images_docker//package_managers:download_pkgs.bzl", "download_pkgs")
+
+# Downloading "docker-ce" requires "apt-transport-https" to be installed
+# in the container. So create a prerequisite container first.
+toolchain_container(
+    name = "docker-prereq",
+    base = "@trusty//image",
+    packages = [
+        "apt-transport-https",
+        "ca-certificates",
+        "curl",
+    ],
+)
+
+add_apt_key(
+    name = "docker-key-image",
+    image = ":docker-prereq.tar",
+    keys = [
+        "@docker_gpg//file",
+    ],
+)
+
+download_pkgs(
+    name = "docker-packages",
+    additional_repos = [
+        "deb [arch=amd64] https://download.docker.com/linux/ubuntu trusty stable",
+    ],
+    image_tar = ":docker-key-image.tar",
+    packages = [
+        "docker-ce=17.12.0~ce-0~ubuntu",
+        "linux-image-extra-virtual",
+    ],
+)
+
+language_tool_layer(
+    name = "docker-ltl",
+    base = "@trusty//image",
+    installables_tar = ":docker-packages.tar",
+)
diff --git a/container/ubuntu16_04/builders/bazel_docker_gcloud/BUILD b/container/ubuntu16_04/builders/bazel_docker_gcloud/BUILD
index b99c03f..b7aed9e 100644
--- a/container/ubuntu16_04/builders/bazel_docker_gcloud/BUILD
+++ b/container/ubuntu16_04/builders/bazel_docker_gcloud/BUILD
@@ -67,6 +67,7 @@
     name = "bazel_%s_docker_gcloud-test" % bazel_version,
     configs = [
         ":container.yaml",
+        "//container/common:docker-17.12.0.yaml",
         "//container/common:java.yaml",
         "//container/common:python2.yaml",
         "//container/common:python3_rbe.yaml",
@@ -75,7 +76,6 @@
         "//container/common/bazel:bazel_tools.yaml",
         "//container/common/bazel:extra_tools.yaml",
         "//container/ubuntu16_04:ubuntu16_04.yaml",
-        "//container/ubuntu16_04/layers/docker-17.12.0:docker-17.12.0.yaml",
         "//container/ubuntu16_04/layers/gcloud:gcloud.yaml",
     ],
     image = ":bazel_%s_docker_gcloud" % bazel_version,
diff --git a/container/ubuntu16_04/layers/docker-17.12.0/BUILD b/container/ubuntu16_04/layers/docker-17.12.0/BUILD
index 2257222..bb6b286 100644
--- a/container/ubuntu16_04/layers/docker-17.12.0/BUILD
+++ b/container/ubuntu16_04/layers/docker-17.12.0/BUILD
@@ -20,8 +20,6 @@
 load("@base_images_docker//package_managers:apt_key.bzl", "add_apt_key")
 load("@base_images_docker//package_managers:download_pkgs.bzl", "download_pkgs")
 
-exports_files(["docker-17.12.0.yaml"])
-
 # Downloading "docker-ce" requires "apt-transport-https" to be installed
 # in the container. So create a prerequisite container first.
 toolchain_container(
@@ -36,7 +34,7 @@
     name = "docker-key-image",
     image = ":docker-prereq.tar",
     keys = [
-        "@xenial_docker_gpg//file",
+        "@docker_gpg//file",
     ],
 )
 
diff --git a/repositories/repositories.bzl b/repositories/repositories.bzl
index ebb0d7c..2e8a734 100644
--- a/repositories/repositories.bzl
+++ b/repositories/repositories.bzl
@@ -105,17 +105,9 @@
         )
 
     # Docker gpg key necessary to install Docker in the containers.
-    if "debian_docker_gpg" not in excludes:
+    if "docker_gpg" not in excludes:
         http_file(
-            name = "debian_docker_gpg",
-            sha256 = "1500c1f56fa9e26b9b8f42452a553675796ade0807cdce11975eb98170b3a570",
-            urls = ["https://download.docker.com/linux/debian/gpg"],
-        )
-
-    # Docker gpg key necessary to install Docker in the containers.
-    if "xenial_docker_gpg" not in excludes:
-        http_file(
-            name = "xenial_docker_gpg",
+            name = "docker_gpg",
             sha256 = "1500c1f56fa9e26b9b8f42452a553675796ade0807cdce11975eb98170b3a570",
             urls = ["https://download.docker.com/linux/ubuntu/gpg"],
         )