diff --git a/WORKSPACE b/WORKSPACE
index 58f453e..ebc9119 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -32,6 +32,13 @@
 
 container_repositories()
 
+load(
+    "//repositories:images.bzl",
+    bazel_toolchains_images = "images",
+)
+
+bazel_toolchains_images()
+
 load("@io_bazel_rules_go//go:def.bzl", "go_register_toolchains", "go_rules_dependencies")
 
 go_rules_dependencies()
@@ -48,71 +55,6 @@
 # This is only needed by the old package manager.
 package_manager_repositories()
 
-load("//rules:toolchain_containers.bzl", "toolchain_container_sha256s")
-
-# TODO(xingao) Switch to use "marketplace.gcr.io" registry once Buildkite support proper auth.
-container_pull(
-    name = "debian8",
-    digest = toolchain_container_sha256s()["debian8"],
-    registry = "l.gcr.io",
-    repository = "google/debian8",
-)
-
-# TODO(xingao) Switch to use "marketplace.gcr.io" registry once Buildkite support proper auth.
-container_pull(
-    name = "debian9",
-    digest = toolchain_container_sha256s()["debian9"],
-    registry = "l.gcr.io",
-    repository = "google/debian9",
-)
-
-# TODO(xingao) Switch to use "marketplace.gcr.io" registry once Buildkite support proper auth.
-container_pull(
-    name = "ubuntu16_04",
-    digest = toolchain_container_sha256s()["ubuntu16_04"],
-    registry = "l.gcr.io",
-    repository = "google/ubuntu16_04",
-)
-
-# TODO(xingao) Switch to use "marketplace.gcr.io" registry once Buildkite support proper auth.
-# Get debian8-built python3 interpreter from l.gcr.io/google/python:latest.
-# Base image: gcr.io/google-appengine/debian8:latest
-# Base image ref: https://github.com/GoogleCloudPlatform/python-runtime/blob/a8a3e8b2d3239c184843db818e34a06f12dc1190/build.sh#L155
-container_pull(
-    name = "debian8_python3",
-    digest = toolchain_container_sha256s()["debian8_python3"],
-    registry = "l.gcr.io",
-    repository = "google/python",
-)
-
-# Get ubuntu16_04-built python3 interpreter from gcr.io/google-appengine/python:latest.
-# Base image: gcr.io/gcp-runtimes/ubuntu_16_0_4:latest
-# Base image ref: https://github.com/GoogleCloudPlatform/python-runtime/blob/a8a3e8b2d3239c184843db818e34a06f12dc1190/build.sh#L153
-container_pull(
-    name = "ubuntu16_04_python3",
-    digest = toolchain_container_sha256s()["ubuntu16_04_python3"],
-    registry = "gcr.io",
-    repository = "google-appengine/python",
-)
-
-# TODO(xingao) Switch to use "marketplace.gcr.io" registry once Buildkite support proper auth.
-# l.gcr.io/google/clang-debian8:r328903
-container_pull(
-    name = "debian8-clang",
-    digest = toolchain_container_sha256s()["debian8_clang"],
-    registry = "l.gcr.io",
-    repository = "google/clang-debian8",
-)
-
-# TODO(xingao) Switch to use "marketplace.gcr.io" registry once Buildkite support proper auth.
-# l.gcr.io/google/clang-ubuntu:r328903
-container_pull(
-    name = "ubuntu16_04-clang",
-    digest = toolchain_container_sha256s()["ubuntu16_04_clang"],
-    registry = "l.gcr.io",
-    repository = "google/clang-ubuntu",
-)
-
 container_pull(
     name = "official_jessie",
     registry = "index.docker.io",
@@ -127,24 +69,6 @@
     tag = "16.04",
 )
 
-http_file(
-    name = "debian_docker_gpg",
-    sha256 = "1500c1f56fa9e26b9b8f42452a553675796ade0807cdce11975eb98170b3a570",
-    urls = ["https://download.docker.com/linux/debian/gpg"],
-)
-
-http_file(
-    name = "xenial_docker_gpg",
-    sha256 = "1500c1f56fa9e26b9b8f42452a553675796ade0807cdce11975eb98170b3a570",
-    urls = ["https://download.docker.com/linux/ubuntu/gpg"],
-)
-
-http_file(
-    name = "gcloud_gpg",
-    sha256 = "226ba1072f20e4ff97ee4f94e87bf45538a900a6d9b25399a7ac3dc5a2f3af87",
-    urls = ["https://packages.cloud.google.com/apt/doc/apt-key.gpg"],
-)
-
 # The Debian snapshot datetime to use.
 # This is kept up-to-date with https://github.com/GoogleCloudPlatform/base-images-docker/blob/master/WORKSPACE.
 DEB_SNAPSHOT = "20180312T052343Z"
@@ -193,73 +117,6 @@
     ],
 )
 
-load(
-    "//third_party/golang:revision.bzl",
-    "GOLANG_REVISION",
-    "GOLANG_SHA256",
-)
-
-# Golang
-http_file(
-    name = "golang_release",
-    sha256 = GOLANG_SHA256,
-    urls = ["https://storage.googleapis.com/golang/go" + GOLANG_REVISION + ".linux-amd64.tar.gz"],
-)
-
-load(
-    "//third_party/clang:revision.bzl",
-    "CLANG_REVISION",
-    "DEBIAN8_CLANG_SHA256",
-    "DEBIAN9_CLANG_SHA256",
-    "UBUNTU16_04_CLANG_SHA256",
-)
-
-# Clang
-http_file(
-    name = "debian8_clang_release",
-    sha256 = DEBIAN8_CLANG_SHA256,
-    urls = ["https://storage.googleapis.com/clang-builds-stable/clang-debian8/clang_" + CLANG_REVISION + ".tar.gz"],
-)
-
-http_file(
-    name = "debian9_clang_release",
-    sha256 = DEBIAN9_CLANG_SHA256,
-    urls = ["https://storage.googleapis.com/clang-builds-stable/clang-debian9/clang_" + CLANG_REVISION + ".tar.gz"],
-)
-
-http_file(
-    name = "ubuntu16_04_clang_release",
-    sha256 = UBUNTU16_04_CLANG_SHA256,
-    urls = ["https://storage.googleapis.com/clang-builds-stable/clang-ubuntu16_04/clang_" + CLANG_REVISION + ".tar.gz"],
-)
-
-load(
-    "//third_party/libcxx:revision.bzl",
-    "DEBIAN8_LIBCXX_SHA256",
-    "DEBIAN9_LIBCXX_SHA256",
-    "LIBCXX_REVISION",
-    "UBUNTU16_04_LIBCXX_SHA256",
-)
-
-# libcxx
-http_file(
-    name = "debian8_libcxx_release",
-    sha256 = DEBIAN8_LIBCXX_SHA256,
-    urls = ["https://storage.googleapis.com/clang-builds-stable/clang-debian8/libcxx-msan_" + LIBCXX_REVISION + ".tar.gz"],
-)
-
-http_file(
-    name = "debian9_libcxx_release",
-    sha256 = DEBIAN9_LIBCXX_SHA256,
-    urls = ["https://storage.googleapis.com/clang-builds-stable/clang-debian9/libcxx-msan_" + LIBCXX_REVISION + ".tar.gz"],
-)
-
-http_file(
-    name = "ubuntu16_04_libcxx_release",
-    sha256 = UBUNTU16_04_LIBCXX_SHA256,
-    urls = ["https://storage.googleapis.com/clang-builds-stable/clang-ubuntu16_04/libcxx-msan_" + LIBCXX_REVISION + ".tar.gz"],
-)
-
 # Test purpose only. bazel-toolchains repo at release for Bazel 0.10.0.
 # https://github.com/bazelbuild/bazel-toolchains/releases/tag/acffd62
 http_file(
@@ -270,18 +127,3 @@
         "https://github.com/bazelbuild/bazel-toolchains/archive/44200e0c026d86c53470d107b3697a3e46469c43.tar.gz",
     ],
 )
-
-load(
-    "//container/ubuntu16_04/layers/bazel:version.bzl",
-    "BAZEL_VERSION_SHA256S",
-)
-
-# Download the Bazel installer.sh for all supported versions.
-[http_file(
-    name = "bazel_%s_installer" % (bazel_version.replace(".", "")),
-    sha256 = bazel_sha256,
-    urls = [
-        "https://releases.bazel.build/" + bazel_version + "/release/bazel-" + bazel_version + "-installer-linux-x86_64.sh",
-        "https://github.com/bazelbuild/bazel/releases/download/" + bazel_version + "/bazel-" + bazel_version + "-installer-linux-x86_64.sh",
-    ],
-) for bazel_version, bazel_sha256 in BAZEL_VERSION_SHA256S.items()]
diff --git a/repositories/images.bzl b/repositories/images.bzl
new file mode 100644
index 0000000..66183fe
--- /dev/null
+++ b/repositories/images.bzl
@@ -0,0 +1,140 @@
+# Copyright 2016 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Once recursive workspace is implemented in Bazel, this file should cease
+# to exist.
+
+load("//rules:toolchain_containers.bzl", "toolchain_container_sha256s")
+load(
+    "@io_bazel_rules_docker//container:container.bzl",
+    "container_pull",
+)
+
+def images():
+    """Pull containers used in bazel-toolchains.
+
+    container_pull() rule depends on
+
+    load(
+        "@io_bazel_rules_docker//container:container.bzl",
+        "container_pull",
+    )
+
+    which then depends on:
+
+    load(
+        "//repositories:repositories.bzl",
+        bazel_toolchains_repositories = "repositories",
+    )
+
+    bazel_toolchains_repositories()
+
+    Therefore, in the WORKSPACE, the right order to load the dependencies is:
+
+        load(
+            "//repositories:repositories.bzl",
+            bazel_toolchains_repositories = "repositories",
+        )
+
+        bazel_toolchains_repositories()
+
+        load(
+            "@io_bazel_rules_docker//container:container.bzl",
+            "container_pull",
+            container_repositories = "repositories",
+        )
+
+        container_repositories()
+
+        load(
+            "//repositories:repositories.bzl",
+            bazel_toolchains_images = "images",
+        )
+
+        bazel_toolchains_images()
+
+        ...
+
+    """
+    excludes = native.existing_rules().keys()
+
+    if "debian8" not in excludes:
+        # TODO(xingao) Switch to use "marketplace.gcr.io" registry once Buildkite support proper auth.
+        container_pull(
+            name = "debian8",
+            digest = toolchain_container_sha256s()["debian8"],
+            registry = "l.gcr.io",
+            repository = "google/debian8",
+        )
+
+    if "debian9" not in excludes:
+        # TODO(xingao) Switch to use "marketplace.gcr.io" registry once Buildkite support proper auth.
+        container_pull(
+            name = "debian9",
+            digest = toolchain_container_sha256s()["debian9"],
+            registry = "l.gcr.io",
+            repository = "google/debian9",
+        )
+
+    if "ubuntu16_04" not in excludes:
+        # TODO(xingao) Switch to use "marketplace.gcr.io" registry once Buildkite support proper auth.
+        container_pull(
+            name = "ubuntu16_04",
+            digest = toolchain_container_sha256s()["ubuntu16_04"],
+            registry = "l.gcr.io",
+            repository = "google/ubuntu16_04",
+        )
+
+    if "debian8_python3" not in excludes:
+        # TODO(xingao) Switch to use "marketplace.gcr.io" registry once Buildkite support proper auth.
+        # Get debian8-built python3 interpreter from l.gcr.io/google/python:latest.
+        # Base image: gcr.io/google-appengine/debian8:latest
+        # Base image ref: https://github.com/GoogleCloudPlatform/python-runtime/blob/a8a3e8b2d3239c184843db818e34a06f12dc1190/build.sh#L155
+        container_pull(
+            name = "debian8_python3",
+            digest = toolchain_container_sha256s()["debian8_python3"],
+            registry = "l.gcr.io",
+            repository = "google/python",
+        )
+
+    if "ubuntu16_04_python3" not in excludes:
+        # Get ubuntu16_04-built python3 interpreter from gcr.io/google-appengine/python:latest.
+        # Base image: gcr.io/gcp-runtimes/ubuntu_16_0_4:latest
+        # Base image ref: https://github.com/GoogleCloudPlatform/python-runtime/blob/a8a3e8b2d3239c184843db818e34a06f12dc1190/build.sh#L153
+        container_pull(
+            name = "ubuntu16_04_python3",
+            digest = toolchain_container_sha256s()["ubuntu16_04_python3"],
+            registry = "gcr.io",
+            repository = "google-appengine/python",
+        )
+
+    if "debian8-clang" not in excludes:
+        # TODO(xingao) Switch to use "marketplace.gcr.io" registry once Buildkite support proper auth.
+        # l.gcr.io/google/clang-debian8:r328903
+        container_pull(
+            name = "debian8-clang",
+            digest = toolchain_container_sha256s()["debian8_clang"],
+            registry = "l.gcr.io",
+            repository = "google/clang-debian8",
+        )
+
+    if "ubuntu16_04-clang" not in excludes:
+        # TODO(xingao) Switch to use "marketplace.gcr.io" registry once Buildkite support proper auth.
+        # l.gcr.io/google/clang-ubuntu:r328903
+        container_pull(
+            name = "ubuntu16_04-clang",
+            digest = toolchain_container_sha256s()["ubuntu16_04_clang"],
+            registry = "l.gcr.io",
+            repository = "google/clang-ubuntu",
+        )
diff --git a/repositories/repositories.bzl b/repositories/repositories.bzl
index c623ac1..0aaa122 100644
--- a/repositories/repositories.bzl
+++ b/repositories/repositories.bzl
@@ -15,12 +15,36 @@
 # Once recursive workspace is implemented in Bazel, this file should cease
 # to exist.
 
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive", "http_file")
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load(
+    "//third_party/golang:revision.bzl",
+    "GOLANG_REVISION",
+    "GOLANG_SHA256",
+)
+load(
+    "//third_party/clang:revision.bzl",
+    "CLANG_REVISION",
+    "DEBIAN8_CLANG_SHA256",
+    "DEBIAN9_CLANG_SHA256",
+    "UBUNTU16_04_CLANG_SHA256",
+)
+load(
+    "//third_party/libcxx:revision.bzl",
+    "DEBIAN8_LIBCXX_SHA256",
+    "DEBIAN9_LIBCXX_SHA256",
+    "LIBCXX_REVISION",
+    "UBUNTU16_04_LIBCXX_SHA256",
+)
+load(
+    "//container/ubuntu16_04/layers/bazel:version.bzl",
+    "BAZEL_VERSION_SHA256S",
+)
 
 def repositories():
     """Download dependencies of bazel-toolchains."""
     excludes = native.existing_rules().keys()
 
+    # ============================== Repositories ==============================
     if "io_bazel_rules_docker" not in excludes:
         http_archive(
             name = "io_bazel_rules_docker",
@@ -53,10 +77,102 @@
             urls = ["https://github.com/GoogleCloudPlatform/distroless/archive/10f0810b962145e4636282005226c4eb72519182.tar.gz"],
         )
 
+    # ================================ GPG Keys ================================
     # Bazel gpg key necessary to install Bazel in the containers.
     if "bazel_gpg" not in excludes:
-        http_file(
+        native.http_file(
             name = "bazel_gpg",
             sha256 = "30af2ca7abfb65987cd61802ca6e352aadc6129dfb5bfc9c81f16617bc3a4416",
             urls = ["https://bazel.build/bazel-release.pub.gpg"],
         )
+
+    # Docker gpg key necessary to install Docker in the containers.
+    if "debian_docker_gpg" not in excludes:
+        native.http_file(
+            name = "debian_docker_gpg",
+            sha256 = "1500c1f56fa9e26b9b8f42452a553675796ade0807cdce11975eb98170b3a570",
+            urls = ["https://download.docker.com/linux/debian/gpg"],
+        )
+
+    # Docker gpg key necessary to install Docker in the containers.
+    if "xenial_docker_gpg" not in excludes:
+        native.http_file(
+            name = "xenial_docker_gpg",
+            sha256 = "1500c1f56fa9e26b9b8f42452a553675796ade0807cdce11975eb98170b3a570",
+            urls = ["https://download.docker.com/linux/ubuntu/gpg"],
+        )
+
+    # GCloud gpg key necessary to install GCloud in the containers.
+    if "gcloud_gpg" not in excludes:
+        native.http_file(
+            name = "gcloud_gpg",
+            sha256 = "226ba1072f20e4ff97ee4f94e87bf45538a900a6d9b25399a7ac3dc5a2f3af87",
+            urls = ["https://packages.cloud.google.com/apt/doc/apt-key.gpg"],
+        )
+
+    # =============================== Toolchains ===============================
+    # Golang
+    if "golang_release" not in excludes:
+        native.http_file(
+            name = "golang_release",
+            sha256 = GOLANG_SHA256,
+            urls = ["https://storage.googleapis.com/golang/go" + GOLANG_REVISION + ".linux-amd64.tar.gz"],
+        )
+
+    # Clang
+    if "debian8_clang_release" not in excludes:
+        native.http_file(
+            name = "debian8_clang_release",
+            sha256 = DEBIAN8_CLANG_SHA256,
+            urls = ["https://storage.googleapis.com/clang-builds-stable/clang-debian8/clang_" + CLANG_REVISION + ".tar.gz"],
+        )
+
+    if "debian9_clang_release" not in excludes:
+        native.http_file(
+            name = "debian9_clang_release",
+            sha256 = DEBIAN9_CLANG_SHA256,
+            urls = ["https://storage.googleapis.com/clang-builds-stable/clang-debian9/clang_" + CLANG_REVISION + ".tar.gz"],
+        )
+
+    if "ubuntu16_04_clang_release" not in excludes:
+        native.http_file(
+            name = "ubuntu16_04_clang_release",
+            sha256 = UBUNTU16_04_CLANG_SHA256,
+            urls = ["https://storage.googleapis.com/clang-builds-stable/clang-ubuntu16_04/clang_" + CLANG_REVISION + ".tar.gz"],
+        )
+
+    # libcxx
+    if "debian8_libcxx_release" not in excludes:
+        native.http_file(
+            name = "debian8_libcxx_release",
+            sha256 = DEBIAN8_LIBCXX_SHA256,
+            urls = ["https://storage.googleapis.com/clang-builds-stable/clang-debian8/libcxx-msan_" + LIBCXX_REVISION + ".tar.gz"],
+        )
+
+    if "debian9_libcxx_release" not in excludes:
+        native.http_file(
+            name = "debian9_libcxx_release",
+            sha256 = DEBIAN9_LIBCXX_SHA256,
+            urls = ["https://storage.googleapis.com/clang-builds-stable/clang-debian9/libcxx-msan_" + LIBCXX_REVISION + ".tar.gz"],
+        )
+
+    if "ubuntu16_04_libcxx_release" not in excludes:
+        native.http_file(
+            name = "ubuntu16_04_libcxx_release",
+            sha256 = UBUNTU16_04_LIBCXX_SHA256,
+            urls = ["https://storage.googleapis.com/clang-builds-stable/clang-ubuntu16_04/libcxx-msan_" + LIBCXX_REVISION + ".tar.gz"],
+        )
+
+    # ============================ Bazel installers ============================
+    # Official Bazel installer.sh for all supported versions.
+    for bazel_version, bazel_sha256 in BAZEL_VERSION_SHA256S.items():
+        name = "bazel_%s_installer" % (bazel_version.replace(".", ""))
+        if name not in excludes:
+            native.http_file(
+                name = name,
+                sha256 = bazel_sha256,
+                urls = [
+                    "https://releases.bazel.build/" + bazel_version + "/release/bazel-" + bazel_version + "-installer-linux-x86_64.sh",
+                    "https://github.com/bazelbuild/bazel/releases/download/" + bazel_version + "/bazel-" + bazel_version + "-installer-linux-x86_64.sh",
+                ],
+            )