diff --git a/.bazelci/presubmit.yml b/.bazelci/presubmit.yml
index e28c971..75be538 100644
--- a/.bazelci/presubmit.yml
+++ b/.bazelci/presubmit.yml
@@ -17,7 +17,7 @@
     - "//container/ubuntu16_04/builders/rbe-ubuntu16_04:toolchain-test"
     - "//container/experimental/rbe-debian9:toolchain-test"
     - "//container/ubuntu16_04/builders/bazel:bazel_0.15.0-test"
-    - "//container/ubuntu16_04/builders/bazel:bazel_0.15.0_docker-test"
+    - "//container/ubuntu16_04/builders/bazel_docker_gcloud:bazel_0.15.0_docker_gcloud-test"
     test_flags:
     - "--test_output=errors"
     - "--verbose_failures"
@@ -38,7 +38,7 @@
     - "//container/ubuntu16_04/builders/rbe-ubuntu16_04:toolchain-test"
     - "//container/experimental/rbe-debian9:toolchain-test"
     - "//container/ubuntu16_04/builders/bazel:bazel_0.15.0-test"
-    - "//container/ubuntu16_04/builders/bazel:bazel_0.15.0_docker-test"
+    - "//container/ubuntu16_04/builders/bazel_docker_gcloud:bazel_0.15.0_docker_gcloud-test"
     test_flags:
     - "--test_output=errors"
     - "--verbose_failures"
diff --git a/WORKSPACE b/WORKSPACE
index 514424d..58f453e 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -139,6 +139,12 @@
     urls = ["https://download.docker.com/linux/ubuntu/gpg"],
 )
 
+http_file(
+    name = "gcloud_gpg",
+    sha256 = "226ba1072f20e4ff97ee4f94e87bf45538a900a6d9b25399a7ac3dc5a2f3af87",
+    urls = ["https://packages.cloud.google.com/apt/doc/apt-key.gpg"],
+)
+
 # The Debian snapshot datetime to use.
 # This is kept up-to-date with https://github.com/GoogleCloudPlatform/base-images-docker/blob/master/WORKSPACE.
 DEB_SNAPSHOT = "20180312T052343Z"
diff --git a/container/build.py b/container/build.py
index c77c6a4..615f9e6 100644
--- a/container/build.py
+++ b/container/build.py
@@ -84,7 +84,7 @@
 
 SUPPORTED_TYPES = [
     "rbe-debian8", "rbe-debian9", "rbe-ubuntu16_04", "ubuntu16_04-bazel",
-    "ubuntu16_04-bazel-docker"
+    "ubuntu16_04-bazel-docker-gcloud"
 ]
 
 # File passed in -m must include the following 3 maps
@@ -98,7 +98,8 @@
     "rbe-debian9": "container/experimental/rbe-debian9",
     "rbe-ubuntu16_04": "container/ubuntu16_04/builders/rbe-ubuntu16_04",
     "ubuntu16_04-bazel": "container/ubuntu16_04/builders/bazel",
-    "ubuntu16_04-bazel-docker": "container/ubuntu16_04/builders/bazel",
+    "ubuntu16_04-bazel-docker-gcloud":
+        "container/ubuntu16_04/builders/bazel_docker_gcloud",
 }
 
 # Map to store all supported container type and the name of target to build it.
@@ -107,7 +108,8 @@
     "rbe-debian9": "toolchain",
     "rbe-ubuntu16_04": "toolchain",
     "ubuntu16_04-bazel": "bazel_{}".format(LATEST_BAZEL_VERSION),
-    "ubuntu16_04-bazel-docker": "bazel_{}_docker".format(LATEST_BAZEL_VERSION),
+    "ubuntu16_04-bazel-docker-gcloud":
+        "bazel_{}_docker_gcloud".format(LATEST_BAZEL_VERSION),
 }
 
 # Map to store all supported container type and the name of target to build it.
@@ -120,8 +122,8 @@
         "toolchain-packages.tar",
     "ubuntu16_04-bazel":
         "bazel_{}-packages.tar".format(LATEST_BAZEL_VERSION),
-    "ubuntu16_04-bazel-docker":
-        "bazel_{}_docker-packages.tar".format(LATEST_BAZEL_VERSION),
+    "ubuntu16_04-bazel-docker-gcloud":
+        "bazel_{}_docker_gcloud-packages.tar".format(LATEST_BAZEL_VERSION),
 }
 
 # =========== ENDING HERE ===========
@@ -312,7 +314,7 @@
 git clone https://github.com/bazelbuild/bazel-toolchains.git
 python bazel-toolchains/container/build.py [args]
 
-Note: a file path passed to the -m param must point to a file in the form descibed above 
+Note: a file path passed to the -m param must point to a file in the form descibed above
 (except TYPE_TARBALL_MAP is not required if the -b arg is not used)
 
 To build with Google Cloud Container Builder:
diff --git a/container/cloudbuild.yaml b/container/cloudbuild.yaml
index 4389ce5..de5520b 100644
--- a/container/cloudbuild.yaml
+++ b/container/cloudbuild.yaml
@@ -24,22 +24,22 @@
     args:
     - '--output_base=/workspace'
     - 'run'
-    - '${_BAZEL_TOOLCHAINS_REF}//container/ubuntu16_04/builders/bazel:bazel_${_BAZEL_VERSION}_docker'
+    - '${_BAZEL_TOOLCHAINS_REF}//container/ubuntu16_04/builders/bazel_docker_gcloud:bazel_${_BAZEL_VERSION}_docker_gcloud'
     id: 'builder'
     waitFor:
     - "-" # wait for nothing - start immediately
-    
+
 # Step: print the bazel version for confirmation
-  - name: 'bazel/container/ubuntu16_04/builders/bazel:bazel_${_BAZEL_VERSION}_docker'
+  - name: 'bazel/container/ubuntu16_04/builders/bazel_docker_gcloud:bazel_${_BAZEL_VERSION}_docker_gcloud'
     args:
-    - 'bazel' 
+    - 'bazel'
     - 'version'
     id: 'version'
     waitFor:
     - "builder"
 
 # Step: build the fully loaded container using rules_docker
-  - name: 'bazel/container/ubuntu16_04/builders/bazel:bazel_${_BAZEL_VERSION}_docker'
+  - name: 'bazel/container/ubuntu16_04/builders/bazel_docker_gcloud:bazel_${_BAZEL_VERSION}_docker_gcloud'
     # Set Bazel output_base to /workspace, which is a mounted directory on Google Cloud Builder.
     # This is to make sure Bazel generated files can be accessed by multiple containers.
     args: [
@@ -56,8 +56,8 @@
     - 'version'
 
 # Step: re-tag the image
-  - name: gcr.io/cloud-builders/docker
-    args: ['tag', 'bazel/${_PACKAGE}:${_TARGET}', 'gcr.io/${_PROJECT}/${_CONTAINER}:${_TAG}']
+  - name: 'bazel/container/ubuntu16_04/builders/bazel_docker_gcloud:bazel_${_BAZEL_VERSION}_docker_gcloud'
+    args: ['docker', 'tag', 'bazel/${_PACKAGE}:${_TARGET}', 'gcr.io/${_PROJECT}/${_CONTAINER}:${_TAG}']
     id: 'container-tag'
     waitFor: # wait for all artifacts to be ready
     - 'container-build'
@@ -65,8 +65,9 @@
 # Step: test the image
 # We use container_test rule, which is a Bazel wrapper of container_structure_test.
 # https://github.com/bazelbuild/rules_docker/blob/master/contrib/test.bzl
-  - name: 'gcr.io/cloud-builders/bazel'
+  - name: 'bazel/container/ubuntu16_04/builders/bazel_docker_gcloud:bazel_${_BAZEL_VERSION}_docker_gcloud'
     args: [
+      'bazel',
       '--output_base=/workspace',
       'test',
       '--test_output=all',
@@ -80,8 +81,9 @@
     - 'container-build'
 
 # Step: store the tarball of debian packages in GCS
-  - name: gcr.io/cloud-builders/gsutil
-    args: ['cp',
+  - name: 'bazel/container/ubuntu16_04/builders/bazel_docker_gcloud:bazel_${_BAZEL_VERSION}_docker_gcloud'
+    args: ['gsutil',
+           'cp',
            '/workspace/bazel-out/k8-fastbuild/bin/${_PACKAGE}/${_TARBALL}',
            'gs://${_BUCKET}/${_CONTAINER}-${_TAG}-${BUILD_ID}.tar'
     ]
diff --git a/container/cloudbuild_no_bucket.yaml b/container/cloudbuild_no_bucket.yaml
index fe0c8f6..c08d9bb 100644
--- a/container/cloudbuild_no_bucket.yaml
+++ b/container/cloudbuild_no_bucket.yaml
@@ -24,22 +24,22 @@
     args:
     - '--output_base=/workspace'
     - 'run'
-    - '${_BAZEL_TOOLCHAINS_REF}//container/ubuntu16_04/builders/bazel:bazel_${_BAZEL_VERSION}_docker'
+    - '${_BAZEL_TOOLCHAINS_REF}//container/ubuntu16_04/builders/bazel_docker_gcloud:bazel_${_BAZEL_VERSION}_docker_gcloud'
     id: 'builder'
     waitFor:
     - "-" # wait for nothing - start immediately
-    
+
 # Step: print the bazel version for confirmation
-  - name: 'bazel/container/ubuntu16_04/builders/bazel:bazel_${_BAZEL_VERSION}_docker'
+  - name: 'bazel/container/ubuntu16_04/builders/bazel_docker_gcloud:bazel_${_BAZEL_VERSION}_docker_gcloud'
     args:
-    - 'bazel' 
+    - 'bazel'
     - 'version'
     id: 'version'
     waitFor:
     - "builder"
 
 # Step: build the fully loaded container using rules_docker
-  - name: 'bazel/container/ubuntu16_04/builders/bazel:bazel_${_BAZEL_VERSION}_docker'
+  - name: 'bazel/container/ubuntu16_04/builders/bazel_docker_gcloud:bazel_${_BAZEL_VERSION}_docker_gcloud'
     # Set Bazel output_base to /workspace, which is a mounted directory on Google Cloud Builder.
     # This is to make sure Bazel generated files can be accessed by multiple containers.
     args: [
@@ -56,8 +56,8 @@
     - 'version'
 
 # Step: re-tag the image
-  - name: gcr.io/cloud-builders/docker
-    args: ['tag', 'bazel/${_PACKAGE}:${_TARGET}', 'gcr.io/${_PROJECT}/${_CONTAINER}:${_TAG}']
+  - name: 'bazel/container/ubuntu16_04/builders/bazel_docker_gcloud:bazel_${_BAZEL_VERSION}_docker_gcloud'
+    args: ['docker', 'tag', 'bazel/${_PACKAGE}:${_TARGET}', 'gcr.io/${_PROJECT}/${_CONTAINER}:${_TAG}']
     id: 'container-tag'
     waitFor: # wait for all artifacts to be ready
     - 'container-build'
@@ -65,8 +65,9 @@
 # Step: test the image
 # We use container_test rule, which is a Bazel wrapper of container_structure_test.
 # https://github.com/bazelbuild/rules_docker/blob/master/contrib/test.bzl
-  - name: 'gcr.io/cloud-builders/bazel'
+  - name: 'bazel/container/ubuntu16_04/builders/bazel_docker_gcloud:bazel_${_BAZEL_VERSION}_docker_gcloud'
     args: [
+      'bazel',
       '--output_base=/workspace',
       'test',
       '--test_output=all',
diff --git a/container/ubuntu16_04/builders/bazel/BUILD b/container/ubuntu16_04/builders/bazel/BUILD
index 1354e76..8926dd4 100644
--- a/container/ubuntu16_04/builders/bazel/BUILD
+++ b/container/ubuntu16_04/builders/bazel/BUILD
@@ -62,41 +62,3 @@
     image = ":bazel_%s" % bazel_version,
     verbose = True,
 ) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
-
-# Generate the container with Bazel and Docker for all supported versions of
-# Bazel.
-[toolchain_container(
-    name = "bazel_%s_docker" % bazel_version,
-    base = ":bazel_%s.tar" % bazel_version,
-    cmd = [
-        "/bin/sh",
-        "-c",
-        "/bin/bash",
-    ],
-    # TODO(xingao) Fix this. We should not remove /etc/ssl/certs/java/cacerts
-    # file in the java-ltl, but instead, archive it for future container
-    # reproduction.
-    installation_cleanup_commands = "update-ca-certificates -f",
-    language_layers = [
-        "//container/ubuntu16_04/layers/docker-17.12.0:docker-ltl",
-    ],
-) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
-
-# container_test targets for all supported bazel_docker containers..
-[container_test(
-    name = "bazel_%s_docker-test" % bazel_version,
-    configs = [
-        ":container.yaml",
-        "//container/common:clang.yaml",
-        "//container/common:git.yaml",
-        "//container/common:java.yaml",
-        "//container/common:python2.yaml",
-        "//container/common:wget.yaml",
-        "//container/ubuntu16_04:ubuntu16_04.yaml",
-        "//container/ubuntu16_04/layers/bazel:bazel_%s.yaml" % bazel_version,
-        "//container/ubuntu16_04/layers/bazel:bazel_tools.yaml",
-        "//container/ubuntu16_04/layers/docker-17.12.0:docker-17.12.0.yaml",
-    ],
-    image = ":bazel_%s_docker" % bazel_version,
-    verbose = True,
-) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
diff --git a/container/ubuntu16_04/builders/bazel_docker_gcloud/BUILD b/container/ubuntu16_04/builders/bazel_docker_gcloud/BUILD
new file mode 100644
index 0000000..5120013
--- /dev/null
+++ b/container/ubuntu16_04/builders/bazel_docker_gcloud/BUILD
@@ -0,0 +1,68 @@
+# Copyright 2017 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+licenses(["notice"])  # Apache 2.0
+
+package(default_visibility = ["//visibility:public"])
+
+load("//container/rules:docker_toolchains.bzl", "toolchain_container")
+load("@io_bazel_rules_docker//contrib:test.bzl", "container_test")
+load("//container/ubuntu16_04/layers/bazel:version.bzl", "BAZEL_VERSION_SHA256S")
+
+# Generate the container with Bazel and Docker for all supported versions of
+# Bazel.
+[toolchain_container(
+    name = "bazel_%s_docker_gcloud" % bazel_version,
+    base = "@ubuntu16_04//image",
+    cmd = [
+        "/bin/sh",
+        "-c",
+        "/bin/bash",
+    ],
+    # TODO(xingao) Fix this. We should not remove /etc/ssl/certs/java/cacerts
+    # file in the java-ltl, but instead, archive it for future container
+    # reproduction.
+    installation_cleanup_commands = "update-ca-certificates -f",
+    language_layers = [
+        "//container/ubuntu16_04/layers/clang:clang-ltl",
+        "//container/ubuntu16_04/layers/java:java-ltl",
+        "//container/ubuntu16_04/layers/python:python-ltl",
+        "//container/ubuntu16_04/layers/bazel:bazel-tools",
+        "//container/ubuntu16_04/layers/bazel:bazel_%s-ltl" % bazel_version,
+        "//container/ubuntu16_04/layers/git:git-ltl",
+        "//container/ubuntu16_04/layers/wget:wget-ltl",
+        "//container/ubuntu16_04/layers/docker-17.12.0:docker-ltl",
+        "//container/ubuntu16_04/layers/gcloud:gcloud-ltl",
+    ],
+) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
+
+# container_test targets for all supported bazel_docker containers..
+[container_test(
+    name = "bazel_%s_docker_gcloud-test" % bazel_version,
+    configs = [
+        ":container.yaml",
+        "//container/common:clang.yaml",
+        "//container/common:git.yaml",
+        "//container/common:java.yaml",
+        "//container/common:python2.yaml",
+        "//container/common:wget.yaml",
+        "//container/ubuntu16_04:ubuntu16_04.yaml",
+        "//container/ubuntu16_04/layers/bazel:bazel_%s.yaml" % bazel_version,
+        "//container/ubuntu16_04/layers/bazel:bazel_tools.yaml",
+        "//container/ubuntu16_04/layers/docker-17.12.0:docker-17.12.0.yaml",
+        "//container/ubuntu16_04/layers/gcloud:gcloud.yaml",
+    ],
+    image = ":bazel_%s_docker_gcloud" % bazel_version,
+    verbose = True,
+) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
diff --git a/container/ubuntu16_04/builders/bazel_docker_gcloud/container.yaml b/container/ubuntu16_04/builders/bazel_docker_gcloud/container.yaml
new file mode 100644
index 0000000..c27a43a
--- /dev/null
+++ b/container/ubuntu16_04/builders/bazel_docker_gcloud/container.yaml
@@ -0,0 +1,6 @@
+schemaVersion: "2.0.0"
+
+metadataTest:
+  env:
+    - key: 'PATH'
+      value: '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/python3.6/bin'
diff --git a/container/ubuntu16_04/layers/gcloud/BUILD b/container/ubuntu16_04/layers/gcloud/BUILD
new file mode 100644
index 0000000..3e13fa6
--- /dev/null
+++ b/container/ubuntu16_04/layers/gcloud/BUILD
@@ -0,0 +1,44 @@
+# Copyright 2017 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+licenses(["notice"])  # Apache 2.0
+
+package(default_visibility = ["//visibility:public"])
+
+load("//container/rules:docker_toolchains.bzl", "language_tool_layer")
+load(
+    "//container/ubuntu16_04/layers/gcloud:version.bzl",
+    "GCLOUD_VERSION",
+)
+
+genrule(
+    name = "generate_gcloud_yaml",
+    srcs = ["gcloud.yaml.tpl"],
+    outs = ["gcloud.yaml"],
+    cmd = "sed 's|{_GCLOUD_VERSION}|" + GCLOUD_VERSION.rpartition("-")[0] + "|' <$< >$@",
+)
+
+language_tool_layer(
+    name = "gcloud-ltl",
+    additional_repos = [
+        "deb http://packages.cloud.google.com/apt cloud-sdk-xenial main",
+    ],
+    base = "@ubuntu16_04//image",
+    keys = [
+        "@gcloud_gpg//file",
+    ],
+    packages = [
+        "google-cloud-sdk=%s" % GCLOUD_VERSION,
+    ],
+)
diff --git a/container/ubuntu16_04/layers/gcloud/gcloud.yaml.tpl b/container/ubuntu16_04/layers/gcloud/gcloud.yaml.tpl
new file mode 100644
index 0000000..d1bf41f
--- /dev/null
+++ b/container/ubuntu16_04/layers/gcloud/gcloud.yaml.tpl
@@ -0,0 +1,7 @@
+schemaVersion: "2.0.0"
+
+commandTests:
+- name: 'check-gcloud'
+  command: 'gcloud'
+  args: ['version']
+  expectedOutput: ['Google Cloud SDK {_GCLOUD_VERSION}.*']
diff --git a/container/ubuntu16_04/layers/gcloud/version.bzl b/container/ubuntu16_04/layers/gcloud/version.bzl
new file mode 100644
index 0000000..5a58da2
--- /dev/null
+++ b/container/ubuntu16_04/layers/gcloud/version.bzl
@@ -0,0 +1 @@
+GCLOUD_VERSION = "210.0.0-0"