diff --git a/WORKSPACE b/WORKSPACE
index d64214b..4ab0d8f 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -219,3 +219,17 @@
     sha256 = "8b29b525eb928cac53f5a56a9fe63924467deec6eb75844b947c2d59cc20cd5c",
     urls = ["https://storage.googleapis.com/clang-builds-stable/clang-debian8/clang_r318288.tar.gz"],
 )
+
+# LLVM's compiler-rt, used to get sanitizer headers
+# Pinned to CL right after r318288
+# TODO(yiyu): make changing this pin part of the container release process
+# TODO(ngiraldo): remove this once the clang-debian8 gcs package comes with the headers pre-installed
+new_http_archive(
+    name = "compiler_rt",
+    urls = [
+        "https://github.com/llvm-mirror/compiler-rt/archive/0066b15e48e7b40e43051c9241760e7066582a96.tar.gz",
+    ],
+    sha256 = "a31b513c7b81168e88f530ace58bec53766870c22f949d2a91f767a291d682a9",
+    strip_prefix = "compiler-rt-0066b15e48e7b40e43051c9241760e7066582a96",
+    build_file = "//third_party/compiler_rt:compiler_rt.BUILD",
+)
diff --git a/third_party/clang/BUILD b/third_party/clang/BUILD
index ad80f56..c81856c 100644
--- a/third_party/clang/BUILD
+++ b/third_party/clang/BUILD
@@ -30,5 +30,8 @@
     package_dir = "/usr/local/",
     strip_prefix = ".",
     tags = ["manual"],
-    deps = ["@clang_release//file"],
+    deps = [
+      "@clang_release//file",
+      "@compiler_rt//:sanitizers"
+    ],
 )
diff --git a/third_party/compiler_rt/BUILD b/third_party/compiler_rt/BUILD
new file mode 100644
index 0000000..3f995dc
--- /dev/null
+++ b/third_party/compiler_rt/BUILD
@@ -0,0 +1,23 @@
+# Copyright 2017 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This BUILD file is used for installing clang.tar.gz into /usr/local
+# of debian8-clang-fully-loaded container. The clang.tar.gz file was
+# downloaded by gsutil_cp rule in the WORKSPACE file, and contains
+# the same compiled clang binary as in
+# https://console.cloud.google.com/launcher/details/google/clang-debian8
+
+licenses(["notice"])  # Apache 2.0
+
+package(default_visibility = ["//visibility:public"])
diff --git a/third_party/compiler_rt/compiler_rt.BUILD b/third_party/compiler_rt/compiler_rt.BUILD
new file mode 100644
index 0000000..b21eecd
--- /dev/null
+++ b/third_party/compiler_rt/compiler_rt.BUILD
@@ -0,0 +1,33 @@
+# Copyright 2017 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This BUILD file is used for installing clang.tar.gz into /usr/local
+# of debian8-clang-fully-loaded container. The clang.tar.gz file was
+# downloaded by gsutil_cp rule in the WORKSPACE file, and contains
+# the same compiled clang binary as in
+# https://console.cloud.google.com/launcher/details/google/clang-debian8
+
+licenses(["notice"])  # Apache 2.0
+
+package(default_visibility = ["//visibility:public"])
+
+load("@bazel_tools//tools/build_defs/pkg:pkg.bzl", "pkg_tar")
+
+pkg_tar(
+    name = "sanitizers",
+    srcs = glob(["include/sanitizer/*"]),
+    package_dir = "/lib/clang/6.0.0",
+    strip_prefix = ".",
+    tags = ["manual"],
+)