diff --git a/.travis.yml b/.travis.yml
new file mode 100644
index 0000000..e5bafee
--- /dev/null
+++ b/.travis.yml
@@ -0,0 +1,40 @@
+dist: trusty
+sudo: required
+
+os:
+  - linux
+
+python:
+  - "2.7"
+
+jdk:
+  - oraclejdk8  # Building Bazel requires JDK8.
+
+language: go
+go: 1.10.x
+install: true
+
+services:
+  - docker
+
+addons:
+  apt:
+    sources:
+      - sourceline: 'deb [arch=amd64] http://storage.googleapis.com/bazel-apt stable jdk1.8'
+        key_url: 'https://storage.googleapis.com/bazel-apt/doc/apt-key.pub.gpg'
+    packages:
+      - bazel
+
+install:
+  - go get -u github.com/bazelbuild/buildifier/buildifier
+
+  script:
+  # Check that our direct testing passes.
+  # The tests takes long to finish and currently we cover bazel tests in Bazel CI
+  # TODO: add tests cannot be run by bazel here
+  # - bazel clean && bazel test --test_output=errors //...
+
+  # Check for issues with the format of our bazel config files.
+  - buildifier -mode=check $(find . -name BUILD -type f)
+  - buildifier -mode=check $(find . -name WORKSPACE -type f)
+  - buildifier -mode=check $(find . -name '*.bzl' -type f)
diff --git a/WORKSPACE b/WORKSPACE
index 537219a..1f06430 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -30,8 +30,8 @@
 
 load(
     "@io_bazel_rules_docker//container:container.bzl",
-    container_repositories = "repositories",
     "container_pull",
+    container_repositories = "repositories",
 )
 
 container_repositories()
@@ -92,7 +92,7 @@
     url = "https://github.com/bazelbuild/rules_go/releases/download/0.10.1/rules_go-0.10.1.tar.gz",
 )
 
-load("@io_bazel_rules_go//go:def.bzl", "go_rules_dependencies", "go_register_toolchains")
+load("@io_bazel_rules_go//go:def.bzl", "go_register_toolchains", "go_rules_dependencies")
 
 go_rules_dependencies()
 
@@ -128,9 +128,9 @@
 
 load(
     "@distroless//package_manager:package_manager.bzl",
-    "package_manager_repositories",
-    "dpkg_src",
     "dpkg_list",
+    "dpkg_src",
+    "package_manager_repositories",
 )
 
 package_manager_repositories()
@@ -225,9 +225,9 @@
 
 load(
     "//third_party/libcxx:revision.bzl",
-    "LIBCXX_REVISION",
     "DEBIAN8_LIBCXX_SHA256",
     "DEBIAN9_LIBCXX_SHA256",
+    "LIBCXX_REVISION",
     "UBUNTU16_04_LIBCXX_SHA256",
 )
 
diff --git a/configs/debian8_clang/0.1.0/bazel_0.5.2/BUILD b/configs/debian8_clang/0.1.0/bazel_0.5.2/BUILD
index ae0d85f..ba3bfcd 100755
--- a/configs/debian8_clang/0.1.0/bazel_0.5.2/BUILD
+++ b/configs/debian8_clang/0.1.0/bazel_0.5.2/BUILD
@@ -60,7 +60,6 @@
     supports_param_files = 1,
 )
 
-
 # Android tooling requires a default toolchain for the armeabi-v7a cpu.
 cc_toolchain(
     name = "cc-compiler-armeabi-v7a",
diff --git a/configs/debian8_clang/0.1.0/bazel_0.5.4/BUILD b/configs/debian8_clang/0.1.0/bazel_0.5.4/BUILD
index ae0d85f..ba3bfcd 100755
--- a/configs/debian8_clang/0.1.0/bazel_0.5.4/BUILD
+++ b/configs/debian8_clang/0.1.0/bazel_0.5.4/BUILD
@@ -60,7 +60,6 @@
     supports_param_files = 1,
 )
 
-
 # Android tooling requires a default toolchain for the armeabi-v7a cpu.
 cc_toolchain(
     name = "cc-compiler-armeabi-v7a",
diff --git a/configs/debian8_clang/0.1.0/bazel_0.6.0/BUILD b/configs/debian8_clang/0.1.0/bazel_0.6.0/BUILD
index ba8e4e0..5f639d1 100755
--- a/configs/debian8_clang/0.1.0/bazel_0.6.0/BUILD
+++ b/configs/debian8_clang/0.1.0/bazel_0.6.0/BUILD
@@ -60,7 +60,6 @@
     supports_param_files = 1,
 )
 
-
 # Android tooling requires a default toolchain for the armeabi-v7a cpu.
 cc_toolchain(
     name = "cc-compiler-armeabi-v7a",
diff --git a/configs/debian8_clang/0.1.0/bazel_0.6.0/dummy_toolchain.bzl b/configs/debian8_clang/0.1.0/bazel_0.6.0/dummy_toolchain.bzl
index c787f73..45c0285 100755
--- a/configs/debian8_clang/0.1.0/bazel_0.6.0/dummy_toolchain.bzl
+++ b/configs/debian8_clang/0.1.0/bazel_0.6.0/dummy_toolchain.bzl
@@ -14,10 +14,10 @@
 # limitations under the License.
 
 """Skylark rule that stubs a toolchain."""
+
 def _dummy_toolchain_impl(ctx):
-  ctx = ctx  # unused argument
-  toolchain = platform_common.ToolchainInfo()
-  return [toolchain]
+    ctx = ctx  # unused argument
+    toolchain = platform_common.ToolchainInfo()
+    return [toolchain]
 
 dummy_toolchain = rule(_dummy_toolchain_impl, attrs = {})
-
diff --git a/configs/debian8_clang/0.2.0/bazel_0.10.0/BUILD b/configs/debian8_clang/0.2.0/bazel_0.10.0/BUILD
index bc64924..0efd037 100755
--- a/configs/debian8_clang/0.2.0/bazel_0.10.0/BUILD
+++ b/configs/debian8_clang/0.2.0/bazel_0.10.0/BUILD
@@ -65,7 +65,6 @@
     supports_param_files = 1,
 )
 
-
 # Android tooling requires a default toolchain for the armeabi-v7a cpu.
 cc_toolchain(
     name = "cc-compiler-armeabi-v7a",
diff --git a/configs/debian8_clang/0.2.0/bazel_0.10.0/dummy_toolchain.bzl b/configs/debian8_clang/0.2.0/bazel_0.10.0/dummy_toolchain.bzl
index c787f73..45c0285 100755
--- a/configs/debian8_clang/0.2.0/bazel_0.10.0/dummy_toolchain.bzl
+++ b/configs/debian8_clang/0.2.0/bazel_0.10.0/dummy_toolchain.bzl
@@ -14,10 +14,10 @@
 # limitations under the License.
 
 """Skylark rule that stubs a toolchain."""
+
 def _dummy_toolchain_impl(ctx):
-  ctx = ctx  # unused argument
-  toolchain = platform_common.ToolchainInfo()
-  return [toolchain]
+    ctx = ctx  # unused argument
+    toolchain = platform_common.ToolchainInfo()
+    return [toolchain]
 
 dummy_toolchain = rule(_dummy_toolchain_impl, attrs = {})
-
diff --git a/configs/debian8_clang/0.2.0/bazel_0.6.0/BUILD b/configs/debian8_clang/0.2.0/bazel_0.6.0/BUILD
index ba8e4e0..5f639d1 100755
--- a/configs/debian8_clang/0.2.0/bazel_0.6.0/BUILD
+++ b/configs/debian8_clang/0.2.0/bazel_0.6.0/BUILD
@@ -60,7 +60,6 @@
     supports_param_files = 1,
 )
 
-
 # Android tooling requires a default toolchain for the armeabi-v7a cpu.
 cc_toolchain(
     name = "cc-compiler-armeabi-v7a",
diff --git a/configs/debian8_clang/0.2.0/bazel_0.6.0/dummy_toolchain.bzl b/configs/debian8_clang/0.2.0/bazel_0.6.0/dummy_toolchain.bzl
index c787f73..45c0285 100755
--- a/configs/debian8_clang/0.2.0/bazel_0.6.0/dummy_toolchain.bzl
+++ b/configs/debian8_clang/0.2.0/bazel_0.6.0/dummy_toolchain.bzl
@@ -14,10 +14,10 @@
 # limitations under the License.
 
 """Skylark rule that stubs a toolchain."""
+
 def _dummy_toolchain_impl(ctx):
-  ctx = ctx  # unused argument
-  toolchain = platform_common.ToolchainInfo()
-  return [toolchain]
+    ctx = ctx  # unused argument
+    toolchain = platform_common.ToolchainInfo()
+    return [toolchain]
 
 dummy_toolchain = rule(_dummy_toolchain_impl, attrs = {})
-
diff --git a/configs/debian8_clang/0.2.0/bazel_0.7.0/BUILD b/configs/debian8_clang/0.2.0/bazel_0.7.0/BUILD
index 1db02e1..887cb71 100755
--- a/configs/debian8_clang/0.2.0/bazel_0.7.0/BUILD
+++ b/configs/debian8_clang/0.2.0/bazel_0.7.0/BUILD
@@ -60,7 +60,6 @@
     supports_param_files = 1,
 )
 
-
 # Android tooling requires a default toolchain for the armeabi-v7a cpu.
 cc_toolchain(
     name = "cc-compiler-armeabi-v7a",
diff --git a/configs/debian8_clang/0.2.0/bazel_0.7.0/dummy_toolchain.bzl b/configs/debian8_clang/0.2.0/bazel_0.7.0/dummy_toolchain.bzl
index c787f73..45c0285 100755
--- a/configs/debian8_clang/0.2.0/bazel_0.7.0/dummy_toolchain.bzl
+++ b/configs/debian8_clang/0.2.0/bazel_0.7.0/dummy_toolchain.bzl
@@ -14,10 +14,10 @@
 # limitations under the License.
 
 """Skylark rule that stubs a toolchain."""
+
 def _dummy_toolchain_impl(ctx):
-  ctx = ctx  # unused argument
-  toolchain = platform_common.ToolchainInfo()
-  return [toolchain]
+    ctx = ctx  # unused argument
+    toolchain = platform_common.ToolchainInfo()
+    return [toolchain]
 
 dummy_toolchain = rule(_dummy_toolchain_impl, attrs = {})
-
diff --git a/configs/debian8_clang/0.2.0/bazel_0.8.0/dummy_toolchain.bzl b/configs/debian8_clang/0.2.0/bazel_0.8.0/dummy_toolchain.bzl
index c787f73..45c0285 100755
--- a/configs/debian8_clang/0.2.0/bazel_0.8.0/dummy_toolchain.bzl
+++ b/configs/debian8_clang/0.2.0/bazel_0.8.0/dummy_toolchain.bzl
@@ -14,10 +14,10 @@
 # limitations under the License.
 
 """Skylark rule that stubs a toolchain."""
+
 def _dummy_toolchain_impl(ctx):
-  ctx = ctx  # unused argument
-  toolchain = platform_common.ToolchainInfo()
-  return [toolchain]
+    ctx = ctx  # unused argument
+    toolchain = platform_common.ToolchainInfo()
+    return [toolchain]
 
 dummy_toolchain = rule(_dummy_toolchain_impl, attrs = {})
-
diff --git a/configs/debian8_clang/0.2.0/bazel_0.9.0/BUILD b/configs/debian8_clang/0.2.0/bazel_0.9.0/BUILD
index fdfe552..946e790 100755
--- a/configs/debian8_clang/0.2.0/bazel_0.9.0/BUILD
+++ b/configs/debian8_clang/0.2.0/bazel_0.9.0/BUILD
@@ -60,7 +60,6 @@
     supports_param_files = 1,
 )
 
-
 # Android tooling requires a default toolchain for the armeabi-v7a cpu.
 cc_toolchain(
     name = "cc-compiler-armeabi-v7a",
@@ -104,6 +103,7 @@
 )
 
 filegroup(name = "toolchain_category")
+
 toolchain(
     name = "dummy_cc_toolchain",
     toolchain = "dummy_cc_toolchain_impl",
diff --git a/configs/debian8_clang/0.2.0/bazel_0.9.0/dummy_toolchain.bzl b/configs/debian8_clang/0.2.0/bazel_0.9.0/dummy_toolchain.bzl
index c787f73..45c0285 100755
--- a/configs/debian8_clang/0.2.0/bazel_0.9.0/dummy_toolchain.bzl
+++ b/configs/debian8_clang/0.2.0/bazel_0.9.0/dummy_toolchain.bzl
@@ -14,10 +14,10 @@
 # limitations under the License.
 
 """Skylark rule that stubs a toolchain."""
+
 def _dummy_toolchain_impl(ctx):
-  ctx = ctx  # unused argument
-  toolchain = platform_common.ToolchainInfo()
-  return [toolchain]
+    ctx = ctx  # unused argument
+    toolchain = platform_common.ToolchainInfo()
+    return [toolchain]
 
 dummy_toolchain = rule(_dummy_toolchain_impl, attrs = {})
-
diff --git a/configs/debian8_clang/0.3.0/bazel_0.10.0/BUILD b/configs/debian8_clang/0.3.0/bazel_0.10.0/BUILD
index bc64924..0efd037 100755
--- a/configs/debian8_clang/0.3.0/bazel_0.10.0/BUILD
+++ b/configs/debian8_clang/0.3.0/bazel_0.10.0/BUILD
@@ -65,7 +65,6 @@
     supports_param_files = 1,
 )
 
-
 # Android tooling requires a default toolchain for the armeabi-v7a cpu.
 cc_toolchain(
     name = "cc-compiler-armeabi-v7a",
diff --git a/configs/debian8_clang/0.3.0/bazel_0.10.0/dummy_toolchain.bzl b/configs/debian8_clang/0.3.0/bazel_0.10.0/dummy_toolchain.bzl
index c787f73..45c0285 100755
--- a/configs/debian8_clang/0.3.0/bazel_0.10.0/dummy_toolchain.bzl
+++ b/configs/debian8_clang/0.3.0/bazel_0.10.0/dummy_toolchain.bzl
@@ -14,10 +14,10 @@
 # limitations under the License.
 
 """Skylark rule that stubs a toolchain."""
+
 def _dummy_toolchain_impl(ctx):
-  ctx = ctx  # unused argument
-  toolchain = platform_common.ToolchainInfo()
-  return [toolchain]
+    ctx = ctx  # unused argument
+    toolchain = platform_common.ToolchainInfo()
+    return [toolchain]
 
 dummy_toolchain = rule(_dummy_toolchain_impl, attrs = {})
-
diff --git a/configs/debian8_clang/0.3.0/bazel_0.11.0/msan/BUILD b/configs/debian8_clang/0.3.0/bazel_0.11.0/msan/BUILD
index 5346d06..6db7164 100755
--- a/configs/debian8_clang/0.3.0/bazel_0.11.0/msan/BUILD
+++ b/configs/debian8_clang/0.3.0/bazel_0.11.0/msan/BUILD
@@ -65,7 +65,6 @@
     supports_param_files = 1,
 )
 
-
 # Android tooling requires a default toolchain for the armeabi-v7a cpu.
 cc_toolchain(
     name = "cc-compiler-armeabi-v7a",
diff --git a/configs/debian8_clang/0.3.0/bazel_0.11.0/msan/dummy_toolchain.bzl b/configs/debian8_clang/0.3.0/bazel_0.11.0/msan/dummy_toolchain.bzl
index c787f73..45c0285 100755
--- a/configs/debian8_clang/0.3.0/bazel_0.11.0/msan/dummy_toolchain.bzl
+++ b/configs/debian8_clang/0.3.0/bazel_0.11.0/msan/dummy_toolchain.bzl
@@ -14,10 +14,10 @@
 # limitations under the License.
 
 """Skylark rule that stubs a toolchain."""
+
 def _dummy_toolchain_impl(ctx):
-  ctx = ctx  # unused argument
-  toolchain = platform_common.ToolchainInfo()
-  return [toolchain]
+    ctx = ctx  # unused argument
+    toolchain = platform_common.ToolchainInfo()
+    return [toolchain]
 
 dummy_toolchain = rule(_dummy_toolchain_impl, attrs = {})
-
diff --git a/configs/debian8_clang/0.3.0/bazel_0.12.0/default/BUILD b/configs/debian8_clang/0.3.0/bazel_0.12.0/default/BUILD
index 5346d06..6db7164 100755
--- a/configs/debian8_clang/0.3.0/bazel_0.12.0/default/BUILD
+++ b/configs/debian8_clang/0.3.0/bazel_0.12.0/default/BUILD
@@ -65,7 +65,6 @@
     supports_param_files = 1,
 )
 
-
 # Android tooling requires a default toolchain for the armeabi-v7a cpu.
 cc_toolchain(
     name = "cc-compiler-armeabi-v7a",
diff --git a/configs/debian8_clang/0.3.0/bazel_0.12.0/default/dummy_toolchain.bzl b/configs/debian8_clang/0.3.0/bazel_0.12.0/default/dummy_toolchain.bzl
index c787f73..45c0285 100755
--- a/configs/debian8_clang/0.3.0/bazel_0.12.0/default/dummy_toolchain.bzl
+++ b/configs/debian8_clang/0.3.0/bazel_0.12.0/default/dummy_toolchain.bzl
@@ -14,10 +14,10 @@
 # limitations under the License.
 
 """Skylark rule that stubs a toolchain."""
+
 def _dummy_toolchain_impl(ctx):
-  ctx = ctx  # unused argument
-  toolchain = platform_common.ToolchainInfo()
-  return [toolchain]
+    ctx = ctx  # unused argument
+    toolchain = platform_common.ToolchainInfo()
+    return [toolchain]
 
 dummy_toolchain = rule(_dummy_toolchain_impl, attrs = {})
-
diff --git a/configs/debian8_clang/0.3.0/bazel_0.12.0/msan/BUILD b/configs/debian8_clang/0.3.0/bazel_0.12.0/msan/BUILD
index 5346d06..6db7164 100755
--- a/configs/debian8_clang/0.3.0/bazel_0.12.0/msan/BUILD
+++ b/configs/debian8_clang/0.3.0/bazel_0.12.0/msan/BUILD
@@ -65,7 +65,6 @@
     supports_param_files = 1,
 )
 
-
 # Android tooling requires a default toolchain for the armeabi-v7a cpu.
 cc_toolchain(
     name = "cc-compiler-armeabi-v7a",
diff --git a/configs/debian8_clang/0.3.0/bazel_0.12.0/msan/dummy_toolchain.bzl b/configs/debian8_clang/0.3.0/bazel_0.12.0/msan/dummy_toolchain.bzl
index c787f73..45c0285 100755
--- a/configs/debian8_clang/0.3.0/bazel_0.12.0/msan/dummy_toolchain.bzl
+++ b/configs/debian8_clang/0.3.0/bazel_0.12.0/msan/dummy_toolchain.bzl
@@ -14,10 +14,10 @@
 # limitations under the License.
 
 """Skylark rule that stubs a toolchain."""
+
 def _dummy_toolchain_impl(ctx):
-  ctx = ctx  # unused argument
-  toolchain = platform_common.ToolchainInfo()
-  return [toolchain]
+    ctx = ctx  # unused argument
+    toolchain = platform_common.ToolchainInfo()
+    return [toolchain]
 
 dummy_toolchain = rule(_dummy_toolchain_impl, attrs = {})
-
diff --git a/configs/debian8_clang/0.3.0/bazel_0.13.0/default/dummy_toolchain.bzl b/configs/debian8_clang/0.3.0/bazel_0.13.0/default/dummy_toolchain.bzl
index c787f73..45c0285 100755
--- a/configs/debian8_clang/0.3.0/bazel_0.13.0/default/dummy_toolchain.bzl
+++ b/configs/debian8_clang/0.3.0/bazel_0.13.0/default/dummy_toolchain.bzl
@@ -14,10 +14,10 @@
 # limitations under the License.
 
 """Skylark rule that stubs a toolchain."""
+
 def _dummy_toolchain_impl(ctx):
-  ctx = ctx  # unused argument
-  toolchain = platform_common.ToolchainInfo()
-  return [toolchain]
+    ctx = ctx  # unused argument
+    toolchain = platform_common.ToolchainInfo()
+    return [toolchain]
 
 dummy_toolchain = rule(_dummy_toolchain_impl, attrs = {})
-
diff --git a/configs/debian8_clang/0.3.0/bazel_0.13.0/msan/dummy_toolchain.bzl b/configs/debian8_clang/0.3.0/bazel_0.13.0/msan/dummy_toolchain.bzl
index c787f73..45c0285 100755
--- a/configs/debian8_clang/0.3.0/bazel_0.13.0/msan/dummy_toolchain.bzl
+++ b/configs/debian8_clang/0.3.0/bazel_0.13.0/msan/dummy_toolchain.bzl
@@ -14,10 +14,10 @@
 # limitations under the License.
 
 """Skylark rule that stubs a toolchain."""
+
 def _dummy_toolchain_impl(ctx):
-  ctx = ctx  # unused argument
-  toolchain = platform_common.ToolchainInfo()
-  return [toolchain]
+    ctx = ctx  # unused argument
+    toolchain = platform_common.ToolchainInfo()
+    return [toolchain]
 
 dummy_toolchain = rule(_dummy_toolchain_impl, attrs = {})
-
diff --git a/configs/debian8_clang/BUILD b/configs/debian8_clang/BUILD
index 08e3bd9..f3ff7d8 100644
--- a/configs/debian8_clang/BUILD
+++ b/configs/debian8_clang/BUILD
@@ -17,11 +17,12 @@
 package(default_visibility = ["//visibility:public"])
 
 load("@bazel_toolchains//rules:docker_config.bzl", "docker_toolchain_autoconfig")
-load("@bazel_toolchains//rules:environments.bzl",
+load(
+    "@bazel_toolchains//rules:environments.bzl",
     "clang_env",
     "debian8_clang_default_keys",
     "debian8_clang_default_packages",
-    "debian8_clang_default_repos"
+    "debian8_clang_default_repos",
 )
 
 # Created on 2017.10.18
@@ -100,7 +101,7 @@
     base = "@debian8-clang//image",
     bazel_version = "0.11.0",
     env = clang_env() + {
-      "BAZEL_LINKOPTS": "-lc++:-lc++abi:-lm",
+        "BAZEL_LINKOPTS": "-lc++:-lc++abi:-lm",
     },
     keys = debian8_clang_default_keys(),
     packages = debian8_clang_default_packages(),
@@ -130,7 +131,7 @@
     base = "@debian8-clang//image",
     bazel_version = "0.12.0",
     env = clang_env() + {
-      "BAZEL_LINKOPTS": "-lc++:-lc++abi:-lm",
+        "BAZEL_LINKOPTS": "-lc++:-lc++abi:-lm",
     },
     keys = debian8_clang_default_keys(),
     packages = debian8_clang_default_packages(),
@@ -160,7 +161,7 @@
     base = "@debian8-clang//image",
     bazel_version = "0.13.0",
     env = clang_env() + {
-      "BAZEL_LINKOPTS": "-lc++:-lc++abi:-lm",
+        "BAZEL_LINKOPTS": "-lc++:-lc++abi:-lm",
     },
     keys = debian8_clang_default_keys(),
     packages = debian8_clang_default_packages(),
diff --git a/configs/experimental/BUILD b/configs/experimental/BUILD
index 976a447..f176103 100644
--- a/configs/experimental/BUILD
+++ b/configs/experimental/BUILD
@@ -17,11 +17,12 @@
 package(default_visibility = ["//visibility:public"])
 
 load("@bazel_toolchains//rules:docker_config.bzl", "docker_toolchain_autoconfig")
-load("@bazel_toolchains//rules:environments.bzl", 
+load(
+    "@bazel_toolchains//rules:environments.bzl",
     "clang_env",
     "debian8_clang_default_keys",
     "debian8_clang_default_packages",
-    "debian8_clang_default_repos"
+    "debian8_clang_default_repos",
 )
 
 # Created on 2018.02.13
@@ -34,11 +35,10 @@
     base = "@debian8-clang//image",
     bazel_version = "0.11.0",
     env = clang_env() + {
-      "BAZEL_LINKOPTS": "-lc++:-lc++abi:-lm",
+        "BAZEL_LINKOPTS": "-lc++:-lc++abi:-lm",
     },
     keys = debian8_clang_default_keys(),
     packages = debian8_clang_default_packages(),
     tags = ["manual"],
     test = True,
 )
-
diff --git a/configs/experimental/debian8_clang/0.2.0/bazel_0.9.0/msan/BUILD b/configs/experimental/debian8_clang/0.2.0/bazel_0.9.0/msan/BUILD
index b9a945e..3d2434a 100755
--- a/configs/experimental/debian8_clang/0.2.0/bazel_0.9.0/msan/BUILD
+++ b/configs/experimental/debian8_clang/0.2.0/bazel_0.9.0/msan/BUILD
@@ -60,7 +60,6 @@
     supports_param_files = 1,
 )
 
-
 # Android tooling requires a default toolchain for the armeabi-v7a cpu.
 cc_toolchain(
     name = "cc-compiler-armeabi-v7a",
@@ -104,6 +103,7 @@
 )
 
 filegroup(name = "toolchain_category")
+
 toolchain(
     name = "dummy_cc_toolchain",
     toolchain = "dummy_cc_toolchain_impl",
diff --git a/configs/experimental/debian8_clang/0.2.0/bazel_0.9.0/msan/dummy_toolchain.bzl b/configs/experimental/debian8_clang/0.2.0/bazel_0.9.0/msan/dummy_toolchain.bzl
index c787f73..45c0285 100755
--- a/configs/experimental/debian8_clang/0.2.0/bazel_0.9.0/msan/dummy_toolchain.bzl
+++ b/configs/experimental/debian8_clang/0.2.0/bazel_0.9.0/msan/dummy_toolchain.bzl
@@ -14,10 +14,10 @@
 # limitations under the License.
 
 """Skylark rule that stubs a toolchain."""
+
 def _dummy_toolchain_impl(ctx):
-  ctx = ctx  # unused argument
-  toolchain = platform_common.ToolchainInfo()
-  return [toolchain]
+    ctx = ctx  # unused argument
+    toolchain = platform_common.ToolchainInfo()
+    return [toolchain]
 
 dummy_toolchain = rule(_dummy_toolchain_impl, attrs = {})
-
diff --git a/configs/experimental/debian8_clang/0.2.0/bazel_0.9.0/ubsan/BUILD b/configs/experimental/debian8_clang/0.2.0/bazel_0.9.0/ubsan/BUILD
index dfca639..dc70b7f 100755
--- a/configs/experimental/debian8_clang/0.2.0/bazel_0.9.0/ubsan/BUILD
+++ b/configs/experimental/debian8_clang/0.2.0/bazel_0.9.0/ubsan/BUILD
@@ -60,7 +60,6 @@
     supports_param_files = 1,
 )
 
-
 # Android tooling requires a default toolchain for the armeabi-v7a cpu.
 cc_toolchain(
     name = "cc-compiler-armeabi-v7a",
@@ -104,6 +103,7 @@
 )
 
 filegroup(name = "toolchain_category")
+
 toolchain(
     name = "dummy_cc_toolchain",
     toolchain = "dummy_cc_toolchain_impl",
diff --git a/configs/experimental/debian8_clang/0.2.0/bazel_0.9.0/ubsan/dummy_toolchain.bzl b/configs/experimental/debian8_clang/0.2.0/bazel_0.9.0/ubsan/dummy_toolchain.bzl
index c787f73..45c0285 100755
--- a/configs/experimental/debian8_clang/0.2.0/bazel_0.9.0/ubsan/dummy_toolchain.bzl
+++ b/configs/experimental/debian8_clang/0.2.0/bazel_0.9.0/ubsan/dummy_toolchain.bzl
@@ -14,10 +14,10 @@
 # limitations under the License.
 
 """Skylark rule that stubs a toolchain."""
+
 def _dummy_toolchain_impl(ctx):
-  ctx = ctx  # unused argument
-  toolchain = platform_common.ToolchainInfo()
-  return [toolchain]
+    ctx = ctx  # unused argument
+    toolchain = platform_common.ToolchainInfo()
+    return [toolchain]
 
 dummy_toolchain = rule(_dummy_toolchain_impl, attrs = {})
-
diff --git a/configs/experimental/debian8_clang/0.3.0/bazel_0.10.0/msan/BUILD b/configs/experimental/debian8_clang/0.3.0/bazel_0.10.0/msan/BUILD
index f2ddcf9..4b7f687 100755
--- a/configs/experimental/debian8_clang/0.3.0/bazel_0.10.0/msan/BUILD
+++ b/configs/experimental/debian8_clang/0.3.0/bazel_0.10.0/msan/BUILD
@@ -65,7 +65,6 @@
     supports_param_files = 1,
 )
 
-
 # Android tooling requires a default toolchain for the armeabi-v7a cpu.
 cc_toolchain(
     name = "cc-compiler-armeabi-v7a",
diff --git a/configs/experimental/debian8_clang/0.3.0/bazel_0.10.0/msan/dummy_toolchain.bzl b/configs/experimental/debian8_clang/0.3.0/bazel_0.10.0/msan/dummy_toolchain.bzl
index c787f73..45c0285 100755
--- a/configs/experimental/debian8_clang/0.3.0/bazel_0.10.0/msan/dummy_toolchain.bzl
+++ b/configs/experimental/debian8_clang/0.3.0/bazel_0.10.0/msan/dummy_toolchain.bzl
@@ -14,10 +14,10 @@
 # limitations under the License.
 
 """Skylark rule that stubs a toolchain."""
+
 def _dummy_toolchain_impl(ctx):
-  ctx = ctx  # unused argument
-  toolchain = platform_common.ToolchainInfo()
-  return [toolchain]
+    ctx = ctx  # unused argument
+    toolchain = platform_common.ToolchainInfo()
+    return [toolchain]
 
 dummy_toolchain = rule(_dummy_toolchain_impl, attrs = {})
-
diff --git a/configs/experimental/debian8_clang/0.3.0/bazel_0.10.0/ubsan/BUILD b/configs/experimental/debian8_clang/0.3.0/bazel_0.10.0/ubsan/BUILD
index 757963b..1b56888 100755
--- a/configs/experimental/debian8_clang/0.3.0/bazel_0.10.0/ubsan/BUILD
+++ b/configs/experimental/debian8_clang/0.3.0/bazel_0.10.0/ubsan/BUILD
@@ -65,7 +65,6 @@
     supports_param_files = 1,
 )
 
-
 # Android tooling requires a default toolchain for the armeabi-v7a cpu.
 cc_toolchain(
     name = "cc-compiler-armeabi-v7a",
diff --git a/configs/experimental/debian8_clang/0.3.0/bazel_0.10.0/ubsan/dummy_toolchain.bzl b/configs/experimental/debian8_clang/0.3.0/bazel_0.10.0/ubsan/dummy_toolchain.bzl
index c787f73..45c0285 100755
--- a/configs/experimental/debian8_clang/0.3.0/bazel_0.10.0/ubsan/dummy_toolchain.bzl
+++ b/configs/experimental/debian8_clang/0.3.0/bazel_0.10.0/ubsan/dummy_toolchain.bzl
@@ -14,10 +14,10 @@
 # limitations under the License.
 
 """Skylark rule that stubs a toolchain."""
+
 def _dummy_toolchain_impl(ctx):
-  ctx = ctx  # unused argument
-  toolchain = platform_common.ToolchainInfo()
-  return [toolchain]
+    ctx = ctx  # unused argument
+    toolchain = platform_common.ToolchainInfo()
+    return [toolchain]
 
 dummy_toolchain = rule(_dummy_toolchain_impl, attrs = {})
-
diff --git a/configs/experimental/debian8_clang/0.3.0/bazel_0.12.0/ubsan/BUILD b/configs/experimental/debian8_clang/0.3.0/bazel_0.12.0/ubsan/BUILD
index 5346d06..6db7164 100755
--- a/configs/experimental/debian8_clang/0.3.0/bazel_0.12.0/ubsan/BUILD
+++ b/configs/experimental/debian8_clang/0.3.0/bazel_0.12.0/ubsan/BUILD
@@ -65,7 +65,6 @@
     supports_param_files = 1,
 )
 
-
 # Android tooling requires a default toolchain for the armeabi-v7a cpu.
 cc_toolchain(
     name = "cc-compiler-armeabi-v7a",
diff --git a/configs/experimental/debian8_clang/0.3.0/bazel_0.12.0/ubsan/dummy_toolchain.bzl b/configs/experimental/debian8_clang/0.3.0/bazel_0.12.0/ubsan/dummy_toolchain.bzl
index c787f73..45c0285 100755
--- a/configs/experimental/debian8_clang/0.3.0/bazel_0.12.0/ubsan/dummy_toolchain.bzl
+++ b/configs/experimental/debian8_clang/0.3.0/bazel_0.12.0/ubsan/dummy_toolchain.bzl
@@ -14,10 +14,10 @@
 # limitations under the License.
 
 """Skylark rule that stubs a toolchain."""
+
 def _dummy_toolchain_impl(ctx):
-  ctx = ctx  # unused argument
-  toolchain = platform_common.ToolchainInfo()
-  return [toolchain]
+    ctx = ctx  # unused argument
+    toolchain = platform_common.ToolchainInfo()
+    return [toolchain]
 
 dummy_toolchain = rule(_dummy_toolchain_impl, attrs = {})
-
diff --git a/configs/experimental/ubuntu16_04_clang/1.0/bazel_0.13.0/ubsan/dummy_toolchain.bzl b/configs/experimental/ubuntu16_04_clang/1.0/bazel_0.13.0/ubsan/dummy_toolchain.bzl
index c787f73..45c0285 100755
--- a/configs/experimental/ubuntu16_04_clang/1.0/bazel_0.13.0/ubsan/dummy_toolchain.bzl
+++ b/configs/experimental/ubuntu16_04_clang/1.0/bazel_0.13.0/ubsan/dummy_toolchain.bzl
@@ -14,10 +14,10 @@
 # limitations under the License.
 
 """Skylark rule that stubs a toolchain."""
+
 def _dummy_toolchain_impl(ctx):
-  ctx = ctx  # unused argument
-  toolchain = platform_common.ToolchainInfo()
-  return [toolchain]
+    ctx = ctx  # unused argument
+    toolchain = platform_common.ToolchainInfo()
+    return [toolchain]
 
 dummy_toolchain = rule(_dummy_toolchain_impl, attrs = {})
-
diff --git a/configs/ubuntu16_04_clang/1.0/bazel_0.13.0/cpp/BUILD b/configs/ubuntu16_04_clang/1.0/bazel_0.13.0/cpp/BUILD
index 259a890..02d28a5 100644
--- a/configs/ubuntu16_04_clang/1.0/bazel_0.13.0/cpp/BUILD
+++ b/configs/ubuntu16_04_clang/1.0/bazel_0.13.0/cpp/BUILD
@@ -32,7 +32,6 @@
     toolchain_type = "@bazel_tools//tools/cpp:toolchain_type",
 )
 
-
 toolchain(
     name = "cc-toolchain-clang-x86_64-msan",
     exec_compatible_with = [
diff --git a/configs/ubuntu16_04_clang/1.0/bazel_0.13.0/default/dummy_toolchain.bzl b/configs/ubuntu16_04_clang/1.0/bazel_0.13.0/default/dummy_toolchain.bzl
index c787f73..45c0285 100755
--- a/configs/ubuntu16_04_clang/1.0/bazel_0.13.0/default/dummy_toolchain.bzl
+++ b/configs/ubuntu16_04_clang/1.0/bazel_0.13.0/default/dummy_toolchain.bzl
@@ -14,10 +14,10 @@
 # limitations under the License.
 
 """Skylark rule that stubs a toolchain."""
+
 def _dummy_toolchain_impl(ctx):
-  ctx = ctx  # unused argument
-  toolchain = platform_common.ToolchainInfo()
-  return [toolchain]
+    ctx = ctx  # unused argument
+    toolchain = platform_common.ToolchainInfo()
+    return [toolchain]
 
 dummy_toolchain = rule(_dummy_toolchain_impl, attrs = {})
-
diff --git a/configs/ubuntu16_04_clang/1.0/bazel_0.13.0/msan/dummy_toolchain.bzl b/configs/ubuntu16_04_clang/1.0/bazel_0.13.0/msan/dummy_toolchain.bzl
index c787f73..45c0285 100755
--- a/configs/ubuntu16_04_clang/1.0/bazel_0.13.0/msan/dummy_toolchain.bzl
+++ b/configs/ubuntu16_04_clang/1.0/bazel_0.13.0/msan/dummy_toolchain.bzl
@@ -14,10 +14,10 @@
 # limitations under the License.
 
 """Skylark rule that stubs a toolchain."""
+
 def _dummy_toolchain_impl(ctx):
-  ctx = ctx  # unused argument
-  toolchain = platform_common.ToolchainInfo()
-  return [toolchain]
+    ctx = ctx  # unused argument
+    toolchain = platform_common.ToolchainInfo()
+    return [toolchain]
 
 dummy_toolchain = rule(_dummy_toolchain_impl, attrs = {})
-
diff --git a/configs/ubuntu16_04_clang/BUILD b/configs/ubuntu16_04_clang/BUILD
index 0702928..19150b9 100644
--- a/configs/ubuntu16_04_clang/BUILD
+++ b/configs/ubuntu16_04_clang/BUILD
@@ -17,11 +17,12 @@
 package(default_visibility = ["//visibility:public"])
 
 load("@bazel_toolchains//rules:docker_config.bzl", "docker_toolchain_autoconfig")
-load("@bazel_toolchains//rules:environments.bzl",
+load(
+    "@bazel_toolchains//rules:environments.bzl",
     "clang_env",
     "ubuntu16_04_clang_default_keys",
     "ubuntu16_04_clang_default_packages",
-    "ubuntu16_04_clang_default_repos"
+    "ubuntu16_04_clang_default_repos",
 )
 
 # Created on 2018.05.09
@@ -46,7 +47,7 @@
     base = "@ubuntu16_04-clang//image",
     bazel_version = "0.13.0",
     env = clang_env() + {
-      "BAZEL_LINKOPTS": "-lc++:-lc++abi:-lm",
+        "BAZEL_LINKOPTS": "-lc++:-lc++abi:-lm",
     },
     keys = ubuntu16_04_clang_default_keys(),
     packages = ubuntu16_04_clang_default_packages(),
diff --git a/container/experimental/rbe-debian8/BUILD b/container/experimental/rbe-debian8/BUILD
index 19b3d40..d82fb70 100644
--- a/container/experimental/rbe-debian8/BUILD
+++ b/container/experimental/rbe-debian8/BUILD
@@ -42,13 +42,13 @@
     base = "@debian8//image",
     env = {
         "LC_ALL ": "C.UTF-8",
-    }
+    },
     layers = [
-        "base-ltl",
-        "clang-ltl",
-        "go-ltl",
-        "java-ltl",
-        "python-ltl",
+        ":base-ltl",
+        ":clang-ltl",
+        ":go-ltl",
+        ":java-ltl",
+        ":python-ltl",
     ],
     tags = ["manual"],
 )
diff --git a/container/rules/docker_toolchains.bzl b/container/rules/docker_toolchains.bzl
index a598e57..98bcec8 100644
--- a/container/rules/docker_toolchains.bzl
+++ b/container/rules/docker_toolchains.bzl
@@ -20,162 +20,173 @@
 load("@base_images_docker//package_managers:apt_key.bzl", _key = "key")
 
 def _input_validation(kwargs):
-  if "debs" in kwargs:
-    fail("debs is not supported.")
+    if "debs" in kwargs:
+        fail("debs is not supported.")
 
-  if "packages" in kwargs and "installables_tar" in kwargs:
-    fail("'packages' and 'installables_tar' cannot be specified at the same time.")
+    if "packages" in kwargs and "installables_tar" in kwargs:
+        fail("'packages' and 'installables_tar' cannot be specified at the same time.")
 
-  has_no_packages = "packages" not in kwargs or kwargs["packages"] == []
-  if has_no_packages and "additional_repos" in kwargs:
-    fail("'additional_repos' can only be specified when 'packages' is not empty.")
-  if has_no_packages and "keys" in kwargs:
-    fail("'keys' can only be specified when 'packages' is not empty.")
+    has_no_packages = "packages" not in kwargs or kwargs["packages"] == []
+    if has_no_packages and "additional_repos" in kwargs:
+        fail("'additional_repos' can only be specified when 'packages' is not empty.")
+    if has_no_packages and "keys" in kwargs:
+        fail("'keys' can only be specified when 'packages' is not empty.")
 
-  has_no_tar = "installables_tar" not in kwargs or kwargs["installables_tar"] == ""
-  if has_no_packages and has_no_tar and "installation_cleanup_commands" in kwargs:
-    fail("'installation_cleanup_commands' can only be specified when at least " +
-      "one of 'packages' or 'installables_tar' is not empty.")
+    has_no_tar = "installables_tar" not in kwargs or kwargs["installables_tar"] == ""
+    if has_no_packages and has_no_tar and "installation_cleanup_commands" in kwargs:
+        fail("'installation_cleanup_commands' can only be specified when at least " +
+             "one of 'packages' or 'installables_tar' is not empty.")
 
-def _language_tool_layer_impl(ctx, symlinks=None, env=None, tars=None,
-                              files=None, packages=None, additional_repos=None,
-                              keys=None, installables_tars=None,
-                              installation_cleanup_commands=""):
-  """Implementation for the language_tool_layer rule.
-
-  Args:
-    ctx: ctx of container_image rule
-           (https://github.com/bazelbuild/rules_docker#container_image-1) +
-         ctx of download_pkgs rule
-           (https://github.com/GoogleCloudPlatform/base-images-docker/blob/master/package_managers/download_pkgs.bzl) +
-         ctx of install_pkgs rule
-           (https://github.com/GoogleCloudPlatform/base-images-docker/blob/master/package_managers/install_pkgs.bzl) +
-         some overrides.
-    symlinks: str Dict, overrides ctx.attr.symlinks
-    env: str Dict, overrides ctx.attr.env
-    tars: File list, overrides ctx.files.tars
-    files: File list, overrides ctx.files.files
-    packages: str List, overrides ctx.attr.packages
-    additional_repos: str List, overrides ctx.attr.additional_repos
-    keys: File list, overrides ctx.files.keys
-    installables_tars: File list, overrides [ctx.file.installables_tar]
-    installation_cleanup_commands: str, overrides ctx.attr.installation_cleanup_commands
-
-  TODO(ngiraldo): add validations to restrict use of any other attrs.
-  """
-
-  symlinks = symlinks or ctx.attr.symlinks
-  env = env or ctx.attr.env
-  tars = tars or ctx.files.tars
-  files = files or ctx.files.files
-  packages = packages or ctx.attr.packages
-  additional_repos = additional_repos or ctx.attr.additional_repos
-  keys = keys or ctx.files.keys
-  installables_tars = installables_tars or []
-  installation_cleanup_commands = installation_cleanup_commands or ctx.attr.installation_cleanup_commands
-
-  # If ctx.file.installables_tar is specified, ignore 'packages' and other tars in installables_tars.
-  if ctx.file.installables_tar:
-    installables_tars = [ctx.file.installables_tar]
-  # Otherwise, download packages if packages list is not empty, and add the tar of downloaded
-  # debs to installables_tars.
-  elif packages != []:
-
-    # Prepare base image for the download_pkgs rule.
-    download_base = ctx.files.base[0]
-
-    # Create an intermediate image with additional gpg keys used to download packages.
-    if keys != []:
-      image_with_keys = "%s_with_keys" % ctx.attr.name
-      # Declare intermediate output file generated by add_apt_key rule.
-      image_with_keys_output_executable = ctx.actions.declare_file(image_with_keys)
-      image_with_keys_output_tarball = ctx.actions.declare_file(image_with_keys + ".tar")
-      image_with_keys_output_layer = ctx.actions.declare_file(image_with_keys + "-layer.tar")
-
-      _key.implementation(
+def _language_tool_layer_impl(
         ctx,
-        name = image_with_keys,
-        image_tar=ctx.files.base[0],
-        keys=keys,
-        output_executable=image_with_keys_output_executable,
-        output_tarball=image_with_keys_output_tarball,
-        output_layer=image_with_keys_output_layer
-      )
-      download_base = image_with_keys_output_tarball
+        symlinks = None,
+        env = None,
+        tars = None,
+        files = None,
+        packages = None,
+        additional_repos = None,
+        keys = None,
+        installables_tars = None,
+        installation_cleanup_commands = ""):
+    """Implementation for the language_tool_layer rule.
 
-    # Declare intermediate output file generated by download_pkgs rule.
-    download_pkgs_output_executable = ctx.actions.declare_file(ctx.attr.name + "-download_pkgs_output_executable.sh")
-    download_pkgs_output_tar = ctx.actions.declare_file(ctx.attr.name + "-download_pkgs_output_tar.tar")
-    download_pkgs_output_script = ctx.actions.declare_file(ctx.attr.name + "-download_pkgs_output_script.sh")
+    Args:
+      ctx: ctx of container_image rule
+             (https://github.com/bazelbuild/rules_docker#container_image-1) +
+           ctx of download_pkgs rule
+             (https://github.com/GoogleCloudPlatform/base-images-docker/blob/master/package_managers/download_pkgs.bzl) +
+           ctx of install_pkgs rule
+             (https://github.com/GoogleCloudPlatform/base-images-docker/blob/master/package_managers/install_pkgs.bzl) +
+           some overrides.
+      symlinks: str Dict, overrides ctx.attr.symlinks
+      env: str Dict, overrides ctx.attr.env
+      tars: File list, overrides ctx.files.tars
+      files: File list, overrides ctx.files.files
+      packages: str List, overrides ctx.attr.packages
+      additional_repos: str List, overrides ctx.attr.additional_repos
+      keys: File list, overrides ctx.files.keys
+      installables_tars: File list, overrides [ctx.file.installables_tar]
+      installation_cleanup_commands: str, overrides ctx.attr.installation_cleanup_commands
 
-    # download_pkgs rule consumes 'packages' and 'additional_repos'.
-    _download.implementation(
-      ctx,
-      image_tar=download_base,
-      packages=packages,
-      additional_repos=additional_repos,
-      output_executable=download_pkgs_output_executable,
-      output_tar=download_pkgs_output_tar,
-      output_script=download_pkgs_output_script
-    )
-    installables_tars.append(download_pkgs_output_tar)
+    TODO(ngiraldo): add validations to restrict use of any other attrs.
+    """
 
-  # Prepare new base image for the container_image rule.
-  new_base = ctx.files.base[0]
+    symlinks = symlinks or ctx.attr.symlinks
+    env = env or ctx.attr.env
+    tars = tars or ctx.files.tars
+    files = files or ctx.files.files
+    packages = packages or ctx.attr.packages
+    additional_repos = additional_repos or ctx.attr.additional_repos
+    keys = keys or ctx.files.keys
+    installables_tars = installables_tars or []
+    installation_cleanup_commands = installation_cleanup_commands or ctx.attr.installation_cleanup_commands
 
-  # Install debian packages in the base image.
-  if installables_tars != []:
-    # Create a list of paths of installables_tars.
-    installables_tars_paths = []
-    for tar in installables_tars:
-      if tar:
-        installables_tars_paths.append(tar.path)
+    # If ctx.file.installables_tar is specified, ignore 'packages' and other tars in installables_tars.
+    if ctx.file.installables_tar:
+        installables_tars = [ctx.file.installables_tar]
+        # Otherwise, download packages if packages list is not empty, and add the tar of downloaded
+        # debs to installables_tars.
 
-    # Declare file for final tarball of debian packages to install.
-    final_installables_tar = ctx.actions.declare_file(ctx.attr.name + "-packages.tar")
+    elif packages != []:
+        # Prepare base image for the download_pkgs rule.
+        download_base = ctx.files.base[0]
 
-    # Combine all installables_tars into one tar. install_pkgs only takes a
-    # single installables_tar as input.
-    ctx.actions.run_shell(
-      inputs=installables_tars,
-      outputs=[final_installables_tar],
-      command="tar cvf {output_tar} --files-from /dev/null && \
-        for i in {input_tars}; do tar A --file={output_tar} $i; done".format(
-        output_tar=final_installables_tar.path,
-        input_tars=' '.join(installables_tars_paths)
-      ),
-    )
+        # Create an intermediate image with additional gpg keys used to download packages.
+        if keys != []:
+            image_with_keys = "%s_with_keys" % ctx.attr.name
 
-    # Declare intermediate output file generated by install_pkgs rule.
-    install_pkgs_out = ctx.actions.declare_file(ctx.attr.name + "-with-packages.tar")
-    # install_pkgs rule consumes 'final_installables_tar' and 'installation_cleanup_commands'.
-    _install.implementation(
-      ctx,
-      image_tar=ctx.files.base[0],
-      installables_tar= final_installables_tar,
-      installation_cleanup_commands = installation_cleanup_commands,
-      output_image_name = ctx.attr.name + "-with-packages",
-      output_tar=install_pkgs_out
-    )
-    # Set the image with packages installed to be the new base.
-    new_base = install_pkgs_out
+            # Declare intermediate output file generated by add_apt_key rule.
+            image_with_keys_output_executable = ctx.actions.declare_file(image_with_keys)
+            image_with_keys_output_tarball = ctx.actions.declare_file(image_with_keys + ".tar")
+            image_with_keys_output_layer = ctx.actions.declare_file(image_with_keys + "-layer.tar")
 
-  # Install tars and configure env, symlinks using the container_image rule.
-  result = _container.image.implementation(ctx, base=new_base, symlinks=symlinks, env=env, tars=tars, files=files)
-
-  return struct(runfiles = result.runfiles,
-                files = result.files,
-                container_parts = result.container_parts,
-                tars = tars,
-                input_files = files,
-                env = env,
-                symlinks = symlinks,
-                packages = packages,
-                additional_repos = additional_repos,
+            _key.implementation(
+                ctx,
+                name = image_with_keys,
+                image_tar = ctx.files.base[0],
                 keys = keys,
-                installables_tar = ctx.file.installables_tar,
-                installation_cleanup_commands = installation_cleanup_commands
-                )
+                output_executable = image_with_keys_output_executable,
+                output_tarball = image_with_keys_output_tarball,
+                output_layer = image_with_keys_output_layer,
+            )
+            download_base = image_with_keys_output_tarball
+
+        # Declare intermediate output file generated by download_pkgs rule.
+        download_pkgs_output_executable = ctx.actions.declare_file(ctx.attr.name + "-download_pkgs_output_executable.sh")
+        download_pkgs_output_tar = ctx.actions.declare_file(ctx.attr.name + "-download_pkgs_output_tar.tar")
+        download_pkgs_output_script = ctx.actions.declare_file(ctx.attr.name + "-download_pkgs_output_script.sh")
+
+        # download_pkgs rule consumes 'packages' and 'additional_repos'.
+        _download.implementation(
+            ctx,
+            image_tar = download_base,
+            packages = packages,
+            additional_repos = additional_repos,
+            output_executable = download_pkgs_output_executable,
+            output_tar = download_pkgs_output_tar,
+            output_script = download_pkgs_output_script,
+        )
+        installables_tars.append(download_pkgs_output_tar)
+
+    # Prepare new base image for the container_image rule.
+    new_base = ctx.files.base[0]
+
+    # Install debian packages in the base image.
+    if installables_tars != []:
+        # Create a list of paths of installables_tars.
+        installables_tars_paths = []
+        for tar in installables_tars:
+            if tar:
+                installables_tars_paths.append(tar.path)
+
+        # Declare file for final tarball of debian packages to install.
+        final_installables_tar = ctx.actions.declare_file(ctx.attr.name + "-packages.tar")
+
+        # Combine all installables_tars into one tar. install_pkgs only takes a
+        # single installables_tar as input.
+        ctx.actions.run_shell(
+            inputs = installables_tars,
+            outputs = [final_installables_tar],
+            command = "tar cvf {output_tar} --files-from /dev/null && \
+        for i in {input_tars}; do tar A --file={output_tar} $i; done".format(
+                output_tar = final_installables_tar.path,
+                input_tars = " ".join(installables_tars_paths),
+            ),
+        )
+
+        # Declare intermediate output file generated by install_pkgs rule.
+        install_pkgs_out = ctx.actions.declare_file(ctx.attr.name + "-with-packages.tar")
+
+        # install_pkgs rule consumes 'final_installables_tar' and 'installation_cleanup_commands'.
+        _install.implementation(
+            ctx,
+            image_tar = ctx.files.base[0],
+            installables_tar = final_installables_tar,
+            installation_cleanup_commands = installation_cleanup_commands,
+            output_image_name = ctx.attr.name + "-with-packages",
+            output_tar = install_pkgs_out,
+        )
+
+        # Set the image with packages installed to be the new base.
+        new_base = install_pkgs_out
+
+    # Install tars and configure env, symlinks using the container_image rule.
+    result = _container.image.implementation(ctx, base = new_base, symlinks = symlinks, env = env, tars = tars, files = files)
+
+    return struct(
+        runfiles = result.runfiles,
+        files = result.files,
+        container_parts = result.container_parts,
+        tars = tars,
+        input_files = files,
+        env = env,
+        symlinks = symlinks,
+        packages = packages,
+        additional_repos = additional_repos,
+        keys = keys,
+        installables_tar = ctx.file.installables_tar,
+        installation_cleanup_commands = installation_cleanup_commands,
+    )
 
 language_tool_layer_attrs = _container.image.attrs + _key.attrs + _download.attrs + _install.attrs + {
     # Redeclare following attributes as non-mandatory.
@@ -202,100 +213,101 @@
 )
 
 def language_tool_layer(**kwargs):
-  """A wrapper around attrs in container_image, download_pkgs and install_pkgs rules.
+    """A wrapper around attrs in container_image, download_pkgs and install_pkgs rules.
 
-  Downloads and installs debian packages using
-  https://github.com/GoogleCloudPlatform/base-images-docker/tree/master/package_managers,
-  and configures the rest using https://github.com/bazelbuild/rules_docker#container_image-1.
+    Downloads and installs debian packages using
+    https://github.com/GoogleCloudPlatform/base-images-docker/tree/master/package_managers,
+    and configures the rest using https://github.com/bazelbuild/rules_docker#container_image-1.
 
-  Args:
-    Same args as https://github.com/bazelbuild/rules_docker#container_image-1
-    minus:
-      debs: debian packages should be listed in 'packages', or be included in
-            'installables_tar' as .deb files.
-    plus:
-      packages: list of packages to fetch and install in the base image.
-      additional_repos: list of additional debian package repos to use,
-        in sources.list format.
-      keys: list of labels of additional gpg keys to use while downloading
-        packages.
-      installables_tar: a tar of debian packages to install in the base image.
-      installation_cleanup_commands: cleanup commands to run after package
-        installation.
+    Args:
+      Same args as https://github.com/bazelbuild/rules_docker#container_image-1
+      minus:
+        debs: debian packages should be listed in 'packages', or be included in
+              'installables_tar' as .deb files.
+      plus:
+        packages: list of packages to fetch and install in the base image.
+        additional_repos: list of additional debian package repos to use,
+          in sources.list format.
+        keys: list of labels of additional gpg keys to use while downloading
+          packages.
+        installables_tar: a tar of debian packages to install in the base image.
+        installation_cleanup_commands: cleanup commands to run after package
+          installation.
 
-  Note:
-    - 'additional_repos' can only be specified when 'packages' is speficified.
-    - 'installation_cleanup_commands' can only be specified when at least one of
-      'packages' or 'installables_tar' is specified.
+    Note:
+      - 'additional_repos' can only be specified when 'packages' is speficified.
+      - 'installation_cleanup_commands' can only be specified when at least one of
+        'packages' or 'installables_tar' is specified.
 
-  Experimental rule.
-  """
+    Experimental rule.
+    """
 
-  _input_validation(kwargs)
+    _input_validation(kwargs)
 
-  language_tool_layer_(**kwargs)
+    language_tool_layer_(**kwargs)
 
 def _toolchain_container_impl(ctx):
-  """Implementation for the toolchain_container rule.
+    """Implementation for the toolchain_container rule.
 
-  toolchain_container rule composes all attrs from itself and language_tool_layer(s),
-  and generates container using container_image rule.
+    toolchain_container rule composes all attrs from itself and language_tool_layer(s),
+    and generates container using container_image rule.
 
-  Args:
-    ctx: ctx as the same as for container_image + list of language_tool_layer(s)
-    https://github.com/bazelbuild/rules_docker#container_image
-  """
+    Args:
+      ctx: ctx as the same as for container_image + list of language_tool_layer(s)
+      https://github.com/bazelbuild/rules_docker#container_image
+    """
 
-  tars = []
-  files = []
-  env = {}
-  symlinks = {}
-  packages = []
-  additional_repos = []
-  keys = []
-  installables_tars = []
-  installation_cleanup_commands = "cd ."
+    tars = []
+    files = []
+    env = {}
+    symlinks = {}
+    packages = []
+    additional_repos = []
+    keys = []
+    installables_tars = []
+    installation_cleanup_commands = "cd ."
 
-  # TODO(ngiraldo): we rewrite env and symlinks if there are conficts,
-  # warn the user of conflicts or error out.
-  for layer in ctx.attr.language_layers:
-    tars.extend(layer.tars)
-    files.extend(layer.input_files)
-    env.update(layer.env)
-    symlinks.update(layer.symlinks)
-    packages.extend(layer.packages)
-    additional_repos.extend(layer.additional_repos)
-    keys.extend(layer.keys)
-    if layer.installables_tar:
-      installables_tars.append(layer.installables_tar)
-    if layer.installation_cleanup_commands:
-      installation_cleanup_commands += (" && " + layer.installation_cleanup_commands)
-  tars.extend(ctx.files.tars)
-  env.update(ctx.attr.env)
-  symlinks.update(ctx.attr.symlinks)
-  packages.extend(ctx.attr.packages)
-  additional_repos.extend(ctx.attr.additional_repos)
-  keys.extend(ctx.files.keys)
-  if ctx.attr.installation_cleanup_commands:
-    installation_cleanup_commands += (" && " + ctx.attr.installation_cleanup_commands)
+    # TODO(ngiraldo): we rewrite env and symlinks if there are conficts,
+    # warn the user of conflicts or error out.
+    for layer in ctx.attr.language_layers:
+        tars.extend(layer.tars)
+        files.extend(layer.input_files)
+        env.update(layer.env)
+        symlinks.update(layer.symlinks)
+        packages.extend(layer.packages)
+        additional_repos.extend(layer.additional_repos)
+        keys.extend(layer.keys)
+        if layer.installables_tar:
+            installables_tars.append(layer.installables_tar)
+        if layer.installation_cleanup_commands:
+            installation_cleanup_commands += (" && " + layer.installation_cleanup_commands)
+    tars.extend(ctx.files.tars)
+    env.update(ctx.attr.env)
+    symlinks.update(ctx.attr.symlinks)
+    packages.extend(ctx.attr.packages)
+    additional_repos.extend(ctx.attr.additional_repos)
+    keys.extend(ctx.files.keys)
+    if ctx.attr.installation_cleanup_commands:
+        installation_cleanup_commands += (" && " + ctx.attr.installation_cleanup_commands)
 
-  files = depset(files).to_list()
-  packages = depset(packages).to_list()
-  additional_repos = depset(additional_repos).to_list()
-  keys = depset(keys).to_list()
-  installables_tars = depset(installables_tars).to_list()
+    files = depset(files).to_list()
+    packages = depset(packages).to_list()
+    additional_repos = depset(additional_repos).to_list()
+    keys = depset(keys).to_list()
+    installables_tars = depset(installables_tars).to_list()
 
-  return _language_tool_layer_impl(ctx,
-                                   symlinks=symlinks,
-                                   env=env,
-                                   tars=tars,
-                                   files=files,
-                                   packages=packages,
-                                   additional_repos=additional_repos,
-                                   keys=keys,
-                                   installables_tars=installables_tars,
-                                   installation_cleanup_commands=installation_cleanup_commands
-                                   )
+    return _language_tool_layer_impl(
+        ctx,
+        symlinks = symlinks,
+        env = env,
+        tars = tars,
+        files = files,
+        packages = packages,
+        additional_repos = additional_repos,
+        keys = keys,
+        installables_tars = installables_tars,
+        installation_cleanup_commands = installation_cleanup_commands,
+    )
 
 toolchain_container_ = rule(
     attrs = language_tool_layer_attrs + {
@@ -307,31 +319,31 @@
 )
 
 def toolchain_container(**kwargs):
-  """Composes multiple language_tool_layers into a single resulting image.
+    """Composes multiple language_tool_layers into a single resulting image.
 
-  Args:
-    Same args as https://github.com/bazelbuild/rules_docker#container_image-1
-    minus:
-      debs: debian packages should be listed in 'packages', or be included in
-            'installables_tar' as .deb files.
-    plus:
-      language_layers: a list of language_tool_layer.
-      installables_tar: a tar of debian packages to install in the base image.
-      packages: list of packages to fetch and install in the base image.
-      additional_repos: list of additional debian package repos to use,
-        in sources.list format.
-      keys: list of labels of additional gpg keys to use while downloading
-        packages.
-      installation_cleanup_commands: cleanup commands to run after package
-        installation.
+    Args:
+      Same args as https://github.com/bazelbuild/rules_docker#container_image-1
+      minus:
+        debs: debian packages should be listed in 'packages', or be included in
+              'installables_tar' as .deb files.
+      plus:
+        language_layers: a list of language_tool_layer.
+        installables_tar: a tar of debian packages to install in the base image.
+        packages: list of packages to fetch and install in the base image.
+        additional_repos: list of additional debian package repos to use,
+          in sources.list format.
+        keys: list of labels of additional gpg keys to use while downloading
+          packages.
+        installation_cleanup_commands: cleanup commands to run after package
+          installation.
 
-  If 'installables_tar' is specified in the 'toolchain_container' rule, then
-  'packages' or 'installables_tar' specified in any of the 'language_layers'
-  passed to this 'toolchain_container' rule will be ignored.
+    If 'installables_tar' is specified in the 'toolchain_container' rule, then
+    'packages' or 'installables_tar' specified in any of the 'language_layers'
+    passed to this 'toolchain_container' rule will be ignored.
 
-  Experimental rule.
-  """
+    Experimental rule.
+    """
 
-  _input_validation(kwargs)
+    _input_validation(kwargs)
 
-  toolchain_container_(**kwargs)
+    toolchain_container_(**kwargs)
diff --git a/container/test/BUILD b/container/test/BUILD
index 0c9d377..e067d88 100644
--- a/container/test/BUILD
+++ b/container/test/BUILD
@@ -23,19 +23,19 @@
 
 toolchain_container(
     name = "bazel-toolchain",
-    base = "@debian8//image",
-    packages = [
-        "bazel",
-    ],
     additional_repos = [
-      "deb [arch=amd64] http://storage.googleapis.com/bazel-apt stable jdk1.8",
+        "deb [arch=amd64] http://storage.googleapis.com/bazel-apt stable jdk1.8",
     ],
+    base = "@debian8//image",
     keys = [
-      "@bazel_gpg//file",
+        "@bazel_gpg//file",
     ],
     language_layers = [
         "//container/rbe-debian8:java-ltl",
     ],
+    packages = [
+        "bazel",
+    ],
 )
 
 container_test(
diff --git a/rules/BUILD b/rules/BUILD
index 20edf85..f7c8eef 100644
--- a/rules/BUILD
+++ b/rules/BUILD
@@ -31,4 +31,3 @@
         "cc-sample-project/test.cc",
     ],
 )
-
diff --git a/rules/docker_config.bzl b/rules/docker_config.bzl
index c35302a..f58bf3f 100644
--- a/rules/docker_config.bzl
+++ b/rules/docker_config.bzl
@@ -151,142 +151,152 @@
 ]
 
 def _docker_toolchain_autoconfig_impl(ctx):
-  """Implementation for the docker_toolchain_autoconfig rule.
+    """Implementation for the docker_toolchain_autoconfig rule.
 
-  Args:
-    ctx: context. See docker_toolchain_autoconfig below for details
-        of what this ctx must include
-  Returns:
-    null
-  """
-  bazel_config_dir = "/bazel-config"
-  project_repo_dir = "project_src"
+    Args:
+      ctx: context. See docker_toolchain_autoconfig below for details
+          of what this ctx must include
+    Returns:
+      null
+    """
+    bazel_config_dir = "/bazel-config"
+    project_repo_dir = "project_src"
 
-  # Command to retrieve the project from github if requested.
-  clone_repo_cmd = "cd ."
-  if ctx.attr.git_repo:
-    clone_repo_cmd = ("cd " + bazel_config_dir + " && git clone " +
-                      ctx.attr.git_repo + " " + project_repo_dir)
+    # Command to retrieve the project from github if requested.
+    clone_repo_cmd = "cd ."
+    if ctx.attr.git_repo:
+        clone_repo_cmd = ("cd " + bazel_config_dir + " && git clone " +
+                          ctx.attr.git_repo + " " + project_repo_dir)
 
-  # Command to install custom Bazel version (if requested)
-  install_bazel_cmd = "cd ."
-  if ctx.attr.use_bazel_head:
-    # If use_bazel_head was requested, we clone the source code from github and compile
-    # it using the release version with "bazel build //src:bazel".
-    install_bazel_cmd = "/install_bazel_head.sh"
-  elif ctx.attr.bazel_version:
-    # If a specific Bazel and Bazel RC version is specified, install that version.
-    bazel_url = "https://releases.bazel.build/" + ctx.attr.bazel_version
-    if ctx.attr.bazel_rc_version:
-      bazel_url += ("/rc" + ctx.attr.bazel_rc_version +
-                    "/bazel-" + ctx.attr.bazel_version + "rc" +
-                    ctx.attr.bazel_rc_version)
-    else:
-      bazel_url += "/release/bazel-" + ctx.attr.bazel_version
-    bazel_url += "-installer-linux-x86_64.sh"
-    install_bazel_cmd = "/install_bazel_version.sh " + bazel_url
+    # Command to install custom Bazel version (if requested)
+    install_bazel_cmd = "cd ."
+    if ctx.attr.use_bazel_head:
+        # If use_bazel_head was requested, we clone the source code from github and compile
+        # it using the release version with "bazel build //src:bazel".
+        install_bazel_cmd = "/install_bazel_head.sh"
+    elif ctx.attr.bazel_version:
+        # If a specific Bazel and Bazel RC version is specified, install that version.
+        bazel_url = "https://releases.bazel.build/" + ctx.attr.bazel_version
+        if ctx.attr.bazel_rc_version:
+            bazel_url += ("/rc" + ctx.attr.bazel_rc_version +
+                          "/bazel-" + ctx.attr.bazel_version + "rc" +
+                          ctx.attr.bazel_rc_version)
+        else:
+            bazel_url += "/release/bazel-" + ctx.attr.bazel_version
+        bazel_url += "-installer-linux-x86_64.sh"
+        install_bazel_cmd = "/install_bazel_version.sh " + bazel_url
 
-  # Command to recursively convert soft links to hard links in the config_repos
-  deref_symlinks_cmd = []
-  for config_repo in ctx.attr.config_repos:
-    symlinks_cmd = ("find $(bazel info output_base)/" +
-                    _EXTERNAL_FOLDER_PREFIX + config_repo +
-                    " -type l -exec bash -c 'ln -f \"$(readlink -m \"$0\")\" \"$0\"' {} \;")
-    deref_symlinks_cmd.append(symlinks_cmd)
-  deref_symlinks_cmd = " && ".join(deref_symlinks_cmd)
+    # Command to recursively convert soft links to hard links in the config_repos
+    deref_symlinks_cmd = []
+    for config_repo in ctx.attr.config_repos:
+        symlinks_cmd = ("find $(bazel info output_base)/" +
+                        _EXTERNAL_FOLDER_PREFIX + config_repo +
+                        " -type l -exec bash -c 'ln -f \"$(readlink -m \"$0\")\" \"$0\"' {} \;")
+        deref_symlinks_cmd.append(symlinks_cmd)
+    deref_symlinks_cmd = " && ".join(deref_symlinks_cmd)
 
-  # Command to copy produced toolchain configs to outside of
-  # the containter (to the mount_point).
-  copy_cmd = []
-  for config_repo in ctx.attr.config_repos:
-    src_dir = "$(bazel info output_base)/" + _EXTERNAL_FOLDER_PREFIX + config_repo
-    copy_cmd.append("cp -dr " + src_dir + " " + bazel_config_dir + "/")
-    # We need to change the owner of the files we copied, so that they can
-    # be manipulated from outside the container.
-    copy_cmd.append("chown -R $USER_ID " + bazel_config_dir + "/" + config_repo)
-  output_copy_cmd = " && ".join(copy_cmd)
+    # Command to copy produced toolchain configs to outside of
+    # the containter (to the mount_point).
+    copy_cmd = []
+    for config_repo in ctx.attr.config_repos:
+        src_dir = "$(bazel info output_base)/" + _EXTERNAL_FOLDER_PREFIX + config_repo
+        copy_cmd.append("cp -dr " + src_dir + " " + bazel_config_dir + "/")
 
-  # Command to run autoconfigure targets.
-  bazel_cmd = "cd " + bazel_config_dir + "/" + project_repo_dir
-  if ctx.attr.use_default_project:
-    bazel_cmd += " && touch WORKSPACE && mv BUILD.sample BUILD"
-  # For each config repo we run the target @<config_repo>//...
-  bazel_targets = "@" + "//... @".join(ctx.attr.config_repos) + "//..."
-  bazel_flags = ""
-  if not ctx.attr.incompatible_changes_off:
-    bazel_flags += " --all_incompatible_changes"
-  bazel_cmd += " && bazel build " + bazel_flags + " " + bazel_targets
+        # We need to change the owner of the files we copied, so that they can
+        # be manipulated from outside the container.
+        copy_cmd.append("chown -R $USER_ID " + bazel_config_dir + "/" + config_repo)
+    output_copy_cmd = " && ".join(copy_cmd)
 
-  # Command to run to clean up after autoconfiguration.
-  # we start with "cd ." to make sure in case of failure everything after the
-  # ";" will be executed
-  clean_cmd = "cd . ; bazel clean"
-  if ctx.attr.use_default_project:
-    clean_cmd += " && rm WORKSPACE"
-  if ctx.attr.git_repo:
-    clean_cmd += " && cd " + bazel_config_dir + " && rm -drf " + project_repo_dir
+    # Command to run autoconfigure targets.
+    bazel_cmd = "cd " + bazel_config_dir + "/" + project_repo_dir
+    if ctx.attr.use_default_project:
+        bazel_cmd += " && touch WORKSPACE && mv BUILD.sample BUILD"
 
-  # Full command to use for docker container
-  # TODO(xingao): Make sure the command exits with error right away if a sub
-  # command fails.
-  docker_cmd = [
-      "/bin/sh", "-c", " && ".join([
-          "set -ex",
-          ctx.attr.setup_cmd,
-          install_bazel_cmd,
-          "echo === Cloning project repo ===",
-          clone_repo_cmd,
-          "echo === Running Bazel autoconfigure command ===",
-          bazel_cmd,
-          "echo === Copying outputs ===",
-          deref_symlinks_cmd,
-          output_copy_cmd,
-          "echo === Cleaning up ===",
-          clean_cmd])]
+    # For each config repo we run the target @<config_repo>//...
+    bazel_targets = "@" + "//... @".join(ctx.attr.config_repos) + "//..."
+    bazel_flags = ""
+    if not ctx.attr.incompatible_changes_off:
+        bazel_flags += " --all_incompatible_changes"
+    bazel_cmd += " && bazel build " + bazel_flags + " " + bazel_targets
 
-  # Expand contents of repo_pkg_tar
-  # (and remove them after we're done running the docker command).
-  # A dummy command that does nothing in case git_repo was used
-  expand_repo_cmd = "cd ."
-  remove_repo_cmd = "cd ."
-  if ctx.attr.repo_pkg_tar:
-    repo_pkg_tar = str(ctx.attr.repo_pkg_tar.label.name)
-    package_name = _EXTERNAL_FOLDER_PREFIX + _WORKSPACE_NAME + "/" + str(ctx.attr.repo_pkg_tar.label.package)
-    # Expand the tar file pointed by repo_pkg_tar
-    expand_repo_cmd = ("mkdir ./%s ; tar -xf %s/%s.tar -C ./%s" %
-                       (project_repo_dir, package_name, repo_pkg_tar, project_repo_dir))
-    remove_repo_cmd = ("rm -drf ./%s" % project_repo_dir)
+    # Command to run to clean up after autoconfiguration.
+    # we start with "cd ." to make sure in case of failure everything after the
+    # ";" will be executed
+    clean_cmd = "cd . ; bazel clean"
+    if ctx.attr.use_default_project:
+        clean_cmd += " && rm WORKSPACE"
+    if ctx.attr.git_repo:
+        clean_cmd += " && cd " + bazel_config_dir + " && rm -drf " + project_repo_dir
 
-  result = _container.image.implementation(ctx, cmd=docker_cmd, output_executable=ctx.outputs.load_image)
+    # Full command to use for docker container
+    # TODO(xingao): Make sure the command exits with error right away if a sub
+    # command fails.
+    docker_cmd = [
+        "/bin/sh",
+        "-c",
+        " && ".join([
+            "set -ex",
+            ctx.attr.setup_cmd,
+            install_bazel_cmd,
+            "echo === Cloning project repo ===",
+            clone_repo_cmd,
+            "echo === Running Bazel autoconfigure command ===",
+            bazel_cmd,
+            "echo === Copying outputs ===",
+            deref_symlinks_cmd,
+            output_copy_cmd,
+            "echo === Cleaning up ===",
+            clean_cmd,
+        ]),
+    ]
 
-  # By default we copy the produced tar file to /tmp/
-  output_location = "/tmp/" + ctx.attr.name + ".tar"
-  if _DOCKER_AUTOCONF_OUTPUT in ctx.var:
-    output_location = ctx.var[_DOCKER_AUTOCONF_OUTPUT] + "/" + ctx.attr.name + ".tar"
-  # Create the script to load image and run it
-  ctx.actions.expand_template(
-      template = ctx.files.run_tpl[0],
-      substitutions ={
-          "%{EXPAND_REPO_CMD}": expand_repo_cmd,
-          "%{LOAD_IMAGE_SH}": ctx.outputs.load_image.short_path,
-          "%{IMAGE_NAME}": "bazel/" + ctx.label.package + ":" + ctx.label.name,
-          "%{RM_REPO_CMD}": remove_repo_cmd,
-          "%{CONFIG_REPOS}": " ".join(ctx.attr.config_repos),
-          "%{OUTPUT}": output_location,
-      },
-      output = ctx.outputs.executable,
-      is_executable = True
-  )
+    # Expand contents of repo_pkg_tar
+    # (and remove them after we're done running the docker command).
+    # A dummy command that does nothing in case git_repo was used
+    expand_repo_cmd = "cd ."
+    remove_repo_cmd = "cd ."
+    if ctx.attr.repo_pkg_tar:
+        repo_pkg_tar = str(ctx.attr.repo_pkg_tar.label.name)
+        package_name = _EXTERNAL_FOLDER_PREFIX + _WORKSPACE_NAME + "/" + str(ctx.attr.repo_pkg_tar.label.package)
 
-  # add to the runfiles the script to load image and (if needed) the repo_pkg_tar file
-  runfiles = ctx.runfiles(files = result.runfiles.files.to_list() + [ctx.outputs.load_image])
-  if ctx.attr.repo_pkg_tar:
-    runfiles = ctx.runfiles(files = result.runfiles.files.to_list() +
-                            [ctx.outputs.load_image] + ctx.files.repo_pkg_tar)
+        # Expand the tar file pointed by repo_pkg_tar
+        expand_repo_cmd = ("mkdir ./%s ; tar -xf %s/%s.tar -C ./%s" %
+                           (project_repo_dir, package_name, repo_pkg_tar, project_repo_dir))
+        remove_repo_cmd = ("rm -drf ./%s" % project_repo_dir)
 
-  return struct(runfiles = runfiles,
-                files = result.files,
-                container_parts = result.container_parts)
+    result = _container.image.implementation(ctx, cmd = docker_cmd, output_executable = ctx.outputs.load_image)
+
+    # By default we copy the produced tar file to /tmp/
+    output_location = "/tmp/" + ctx.attr.name + ".tar"
+    if _DOCKER_AUTOCONF_OUTPUT in ctx.var:
+        output_location = ctx.var[_DOCKER_AUTOCONF_OUTPUT] + "/" + ctx.attr.name + ".tar"
+
+    # Create the script to load image and run it
+    ctx.actions.expand_template(
+        template = ctx.files.run_tpl[0],
+        substitutions = {
+            "%{EXPAND_REPO_CMD}": expand_repo_cmd,
+            "%{LOAD_IMAGE_SH}": ctx.outputs.load_image.short_path,
+            "%{IMAGE_NAME}": "bazel/" + ctx.label.package + ":" + ctx.label.name,
+            "%{RM_REPO_CMD}": remove_repo_cmd,
+            "%{CONFIG_REPOS}": " ".join(ctx.attr.config_repos),
+            "%{OUTPUT}": output_location,
+        },
+        output = ctx.outputs.executable,
+        is_executable = True,
+    )
+
+    # add to the runfiles the script to load image and (if needed) the repo_pkg_tar file
+    runfiles = ctx.runfiles(files = result.runfiles.files.to_list() + [ctx.outputs.load_image])
+    if ctx.attr.repo_pkg_tar:
+        runfiles = ctx.runfiles(files = result.runfiles.files.to_list() +
+                                        [ctx.outputs.load_image] + ctx.files.repo_pkg_tar)
+
+    return struct(
+        runfiles = runfiles,
+        files = result.files,
+        container_parts = result.container_parts,
+    )
 
 docker_toolchain_autoconfig_ = rule(
     attrs = _container.image.attrs + {
@@ -353,134 +363,134 @@
 ]
 
 def docker_toolchain_autoconfig(**kwargs):
-  """Generate toolchain configs for a docker container.
+    """Generate toolchain configs for a docker container.
 
-  This rule produces a tar file with toolchain configs produced from the
-  execution of targets in skylark remote repositories. Typically, this rule is
-  used to produce toolchain configs for the local_config_cc repository.
-  This repo (as well as others, depending on the project) contains generated
-  toolchain configs that Bazel uses to properly use a toolchain. For instance,
-  the local_config_cc repo generates a cc_toolchain rule.
+    This rule produces a tar file with toolchain configs produced from the
+    execution of targets in skylark remote repositories. Typically, this rule is
+    used to produce toolchain configs for the local_config_cc repository.
+    This repo (as well as others, depending on the project) contains generated
+    toolchain configs that Bazel uses to properly use a toolchain. For instance,
+    the local_config_cc repo generates a cc_toolchain rule.
 
-  The toolchain configs that this rule produces, can be used to, for
-  instance, use a remote execution service that runs actions inside docker
-  containers.
+    The toolchain configs that this rule produces, can be used to, for
+    instance, use a remote execution service that runs actions inside docker
+    containers.
 
-  All the toolchain configs published in the bazel-toolchains
-  repo (https://github.com/bazelbuild/bazel-toolchains/) have been produced
-  using this rule.
+    All the toolchain configs published in the bazel-toolchains
+    repo (https://github.com/bazelbuild/bazel-toolchains/) have been produced
+    using this rule.
 
-  This rule is implemented by extending the container_image rule in
-  https://github.com/bazelbuild/rules_docker. The rule installs debs packages
-  to run bazel (using the package manager rules offered by
-  https://github.com/GoogleCloudPlatform/distroless/tree/master/package_manager).
-  The rule creates the container with a command that pulls a repo from github,
-  and runs bazel build for a series of remote repos. Files generated in these
-  repos are copied to a mount point inside the Bazel output tree, and finally
-  copied to the /tmp directory or to the DOCKER_AUTOCONF_OUTPUT directory
-  if passed as build variable.
+    This rule is implemented by extending the container_image rule in
+    https://github.com/bazelbuild/rules_docker. The rule installs debs packages
+    to run bazel (using the package manager rules offered by
+    https://github.com/GoogleCloudPlatform/distroless/tree/master/package_manager).
+    The rule creates the container with a command that pulls a repo from github,
+    and runs bazel build for a series of remote repos. Files generated in these
+    repos are copied to a mount point inside the Bazel output tree, and finally
+    copied to the /tmp directory or to the DOCKER_AUTOCONF_OUTPUT directory
+    if passed as build variable.
 
-  Args:
-    **kwargs:
-  Required Args
-    name: A unique name for this rule.
-    base: Docker image base - optionally with all tools pre-installed for
-        which a configuration will be generated. Packages can also be installed
-        by listing them in the 'packages' attriute.
-  Default Args:
-    config_repos: a list of remote repositories. Autoconfig will run targets in
-        each of these remote repositories and copy all contents to the mount
-        point.
-    env: Dictionary of env variables for Bazel / project specific autoconfigure
-    git_repo: A git repo with the sources for the project to be used for
-        autoconfigure. If no git_repo is passed, autoconfig will run with a
-        sample c++ project.
-    bazel_version: a specific version of Bazel used to generate toolchain
-        configs. Format: x.x.x
-    bazel_rc_version: a specific version of Bazel release candidate used to
-        generate toolchain configs. Input "2" if you would like to use rc2.
-    use_bazel_head = Download bazel head from github, compile it and use it
-        to run autoconfigure targets.
-    setup_cmd: a customized command that will run as the very first command
-        inside the docker container.
-    packages: list of packages to fetch and install in the base image.
-    additional_repos: list of additional debian package repos to use,
-        in sources.list format.
-    keys: list of additional gpg keys to use while downloading packages.
-    incompatible_changes_off: If True Bazel will run without the
-        all_incompatible_changes flag. Default False.
-    test: a boolean which specifies whether a test target for this
-        docker_toolchain_autoconfig will be added.
-        If True, a test target with name {name}_test will be added.
-        The test will build this docker_toolchain_autoconfig target, run the
-        output script, and check the toolchain configs for the c++ auto
-        generated config exist.
-  """
-  for reserved in reserved_attrs:
-    if reserved in kwargs:
-      fail("reserved for internal use by docker_toolchain_autoconfig macro", attr=reserved)
+    Args:
+      **kwargs:
+    Required Args
+      name: A unique name for this rule.
+      base: Docker image base - optionally with all tools pre-installed for
+          which a configuration will be generated. Packages can also be installed
+          by listing them in the 'packages' attriute.
+    Default Args:
+      config_repos: a list of remote repositories. Autoconfig will run targets in
+          each of these remote repositories and copy all contents to the mount
+          point.
+      env: Dictionary of env variables for Bazel / project specific autoconfigure
+      git_repo: A git repo with the sources for the project to be used for
+          autoconfigure. If no git_repo is passed, autoconfig will run with a
+          sample c++ project.
+      bazel_version: a specific version of Bazel used to generate toolchain
+          configs. Format: x.x.x
+      bazel_rc_version: a specific version of Bazel release candidate used to
+          generate toolchain configs. Input "2" if you would like to use rc2.
+      use_bazel_head = Download bazel head from github, compile it and use it
+          to run autoconfigure targets.
+      setup_cmd: a customized command that will run as the very first command
+          inside the docker container.
+      packages: list of packages to fetch and install in the base image.
+      additional_repos: list of additional debian package repos to use,
+          in sources.list format.
+      keys: list of additional gpg keys to use while downloading packages.
+      incompatible_changes_off: If True Bazel will run without the
+          all_incompatible_changes flag. Default False.
+      test: a boolean which specifies whether a test target for this
+          docker_toolchain_autoconfig will be added.
+          If True, a test target with name {name}_test will be added.
+          The test will build this docker_toolchain_autoconfig target, run the
+          output script, and check the toolchain configs for the c++ auto
+          generated config exist.
+    """
+    for reserved in reserved_attrs:
+        if reserved in kwargs:
+            fail("reserved for internal use by docker_toolchain_autoconfig macro", attr = reserved)
 
-  for required in required_attrs:
-    if required not in kwargs:
-      fail("required for docker_toolchain_autoconfig", attr=required)
+    for required in required_attrs:
+        if required not in kwargs:
+            fail("required for docker_toolchain_autoconfig", attr = required)
 
-  # Input validations
-  if "use_bazel_head" in kwargs and ("bazel_version" in kwargs or "bazel_rc_version" in kwargs):
-    fail ("Only one of use_bazel_head or a combination of bazel_version and" +
-          "bazel_rc_version can be set at a time.")
+    # Input validations
+    if "use_bazel_head" in kwargs and ("bazel_version" in kwargs or "bazel_rc_version" in kwargs):
+        fail("Only one of use_bazel_head or a combination of bazel_version and" +
+             "bazel_rc_version can be set at a time.")
 
-  packages_is_empty = "packages" not in kwargs or kwargs["packages"] == []
+    packages_is_empty = "packages" not in kwargs or kwargs["packages"] == []
 
-  if packages_is_empty and "additional_repos" in kwargs:
-    fail("'additional_repos' can only be specified when 'packages' is not empty.")
-  if packages_is_empty and "keys" in kwargs:
-    fail("'keys' can only be specified when 'packages' is not empty.")
+    if packages_is_empty and "additional_repos" in kwargs:
+        fail("'additional_repos' can only be specified when 'packages' is not empty.")
+    if packages_is_empty and "keys" in kwargs:
+        fail("'keys' can only be specified when 'packages' is not empty.")
 
-  # If the git_repo was not provided, use the default autoconfig project
-  if "git_repo" not in kwargs:
-    kwargs["repo_pkg_tar"] = _DEFAULT_AUTOCONFIG_PROJECT_PKG_TAR
-    kwargs["use_default_project"] = True
-  kwargs["files"] = [
-      _WORKSPACE_PREFIX + "rules:install_bazel_head.sh",
-      _WORKSPACE_PREFIX + "rules:install_bazel_version.sh",
-  ]
+    # If the git_repo was not provided, use the default autoconfig project
+    if "git_repo" not in kwargs:
+        kwargs["repo_pkg_tar"] = _DEFAULT_AUTOCONFIG_PROJECT_PKG_TAR
+        kwargs["use_default_project"] = True
+    kwargs["files"] = [
+        _WORKSPACE_PREFIX + "rules:install_bazel_head.sh",
+        _WORKSPACE_PREFIX + "rules:install_bazel_version.sh",
+    ]
 
-  # The template for the main script to execute for this rule, which produces
-  # the toolchain configs
-  kwargs["run_tpl"] = _WORKSPACE_PREFIX + "rules:docker_config.sh.tpl"
+    # The template for the main script to execute for this rule, which produces
+    # the toolchain configs
+    kwargs["run_tpl"] = _WORKSPACE_PREFIX + "rules:docker_config.sh.tpl"
 
-  # Do not install packags if 'packages' is not specified or is an ampty list.
-  if not packages_is_empty:
-    # "additional_repos" and "keys" are optional for docker_toolchain_autoconfig,
-    # but required for toolchain_container". Use empty lists as placeholder.
-    if "additional_repos" not in kwargs:
-      kwargs["additional_repos"] = []
-    if "keys" not in kwargs:
-      kwargs["keys"] = []
+    # Do not install packags if 'packages' is not specified or is an ampty list.
+    if not packages_is_empty:
+        # "additional_repos" and "keys" are optional for docker_toolchain_autoconfig,
+        # but required for toolchain_container". Use empty lists as placeholder.
+        if "additional_repos" not in kwargs:
+            kwargs["additional_repos"] = []
+        if "keys" not in kwargs:
+            kwargs["keys"] = []
 
-    # Install packages in the base image.
-    toolchain_container(
-      name = kwargs["name"] + "_image",
-      base = kwargs["base"],
-      packages = kwargs["packages"],
-      additional_repos = kwargs["additional_repos"],
-      keys = kwargs["keys"],
-    )
+        # Install packages in the base image.
+        toolchain_container(
+            name = kwargs["name"] + "_image",
+            base = kwargs["base"],
+            packages = kwargs["packages"],
+            additional_repos = kwargs["additional_repos"],
+            keys = kwargs["keys"],
+        )
 
-    # Use the image with packages installed as the new base for autoconfiguring.
-    kwargs["base"] = ":" + kwargs["name"] + "_image.tar"
+        # Use the image with packages installed as the new base for autoconfiguring.
+        kwargs["base"] = ":" + kwargs["name"] + "_image.tar"
 
-  if "test" in kwargs and kwargs["test"] == True:
-    # Create a test target for the current docker_toolchain_autoconfig target,
-    # which builds this docker_toolchain_autoconfig target, runs the output
-    # script, and checks the toolchain configs for the c++ auto generated config
-    # exist.
-    native.sh_test(
-      name = kwargs["name"] + "_test",
-      size = "medium",
-      timeout = "long",
-      srcs = ["//test/configs:autoconfig_test.sh"],
-      data = [":" + kwargs["name"]],
-    )
+    if "test" in kwargs and kwargs["test"] == True:
+        # Create a test target for the current docker_toolchain_autoconfig target,
+        # which builds this docker_toolchain_autoconfig target, runs the output
+        # script, and checks the toolchain configs for the c++ auto generated config
+        # exist.
+        native.sh_test(
+            name = kwargs["name"] + "_test",
+            size = "medium",
+            timeout = "long",
+            srcs = ["//test/configs:autoconfig_test.sh"],
+            data = [":" + kwargs["name"]],
+        )
 
-  docker_toolchain_autoconfig_(**kwargs)
+    docker_toolchain_autoconfig_(**kwargs)
diff --git a/rules/environments.bzl b/rules/environments.bzl
index f2fe693..c150023 100644
--- a/rules/environments.bzl
+++ b/rules/environments.bzl
@@ -13,82 +13,80 @@
 # limitations under the License.
 """Default dictionaries of env variables."""
 
-
 def gcc_env():
-  return {
-      "ABI_VERSION": "gcc",
-      "ABI_LIBC_VERSION": "glibc_2.19",
-      "BAZEL_COMPILER": "gcc",
-      "BAZEL_HOST_SYSTEM": "i686-unknown-linux-gnu",
-      "BAZEL_TARGET_LIBC": "glibc_2.19",
-      "BAZEL_TARGET_CPU": "k8",
-      "BAZEL_TARGET_SYSTEM": "x86_64-unknown-linux-gnu",
-      "CC_TOOLCHAIN_NAME": "linux_gnu_x86"
-  }
-
+    return {
+        "ABI_VERSION": "gcc",
+        "ABI_LIBC_VERSION": "glibc_2.19",
+        "BAZEL_COMPILER": "gcc",
+        "BAZEL_HOST_SYSTEM": "i686-unknown-linux-gnu",
+        "BAZEL_TARGET_LIBC": "glibc_2.19",
+        "BAZEL_TARGET_CPU": "k8",
+        "BAZEL_TARGET_SYSTEM": "x86_64-unknown-linux-gnu",
+        "CC_TOOLCHAIN_NAME": "linux_gnu_x86",
+    }
 
 def clang_env():
-  return {
-      "ABI_VERSION": "clang",
-      "ABI_LIBC_VERSION": "glibc_2.19",
-      "BAZEL_COMPILER": "clang",
-      "BAZEL_HOST_SYSTEM": "i686-unknown-linux-gnu",
-      "BAZEL_TARGET_LIBC": "glibc_2.19",
-      "BAZEL_TARGET_CPU": "k8",
-      "BAZEL_TARGET_SYSTEM": "x86_64-unknown-linux-gnu",
-      "CC_TOOLCHAIN_NAME": "linux_gnu_x86",
-      "CC": "clang"
-  }
+    return {
+        "ABI_VERSION": "clang",
+        "ABI_LIBC_VERSION": "glibc_2.19",
+        "BAZEL_COMPILER": "clang",
+        "BAZEL_HOST_SYSTEM": "i686-unknown-linux-gnu",
+        "BAZEL_TARGET_LIBC": "glibc_2.19",
+        "BAZEL_TARGET_CPU": "k8",
+        "BAZEL_TARGET_SYSTEM": "x86_64-unknown-linux-gnu",
+        "CC_TOOLCHAIN_NAME": "linux_gnu_x86",
+        "CC": "clang",
+    }
 
 def debian8_clang_default_packages():
-  return [
-    "bazel",
-    "ca-certificates-java=20161107'*'",
-    "curl",
-    "git",
-    "openjdk-8-jdk-headless",
-    "openjdk-8-jre-headless",
-    "python-dev",
-    "unzip",
-    "wget",
-    "zip",
-  ]
+    return [
+        "bazel",
+        "ca-certificates-java=20161107'*'",
+        "curl",
+        "git",
+        "openjdk-8-jdk-headless",
+        "openjdk-8-jre-headless",
+        "python-dev",
+        "unzip",
+        "wget",
+        "zip",
+    ]
 
 def debian8_clang_default_repos():
-  return [
-    "deb http://deb.debian.org/debian jessie-backports main",
-    bazel_repo(),
-  ]
+    return [
+        "deb http://deb.debian.org/debian jessie-backports main",
+        bazel_repo(),
+    ]
 
 def debian8_clang_default_keys():
-  return bazel_key()
+    return bazel_key()
 
 def ubuntu16_04_clang_default_packages():
-  return [
-    "bazel",
-    "ca-certificates-java",
-    "curl",
-    "git",
-    "openjdk-8-jdk-headless",
-    "openjdk-8-jre-headless",
-    "python-dev",
-    "unzip",
-    "wget",
-    "zip",
-  ]
+    return [
+        "bazel",
+        "ca-certificates-java",
+        "curl",
+        "git",
+        "openjdk-8-jdk-headless",
+        "openjdk-8-jre-headless",
+        "python-dev",
+        "unzip",
+        "wget",
+        "zip",
+    ]
 
 def ubuntu16_04_clang_default_repos():
-  return [
-    bazel_repo(),
-  ]
+    return [
+        bazel_repo(),
+    ]
 
 def ubuntu16_04_clang_default_keys():
-  return bazel_key()
+    return bazel_key()
 
 def bazel_key():
-  return [
-    "@bazel_gpg//file",
-  ]
+    return [
+        "@bazel_gpg//file",
+    ]
 
 def bazel_repo():
-  return "deb [arch=amd64] http://storage.googleapis.com/bazel-apt stable jdk1.8"
+    return "deb [arch=amd64] http://storage.googleapis.com/bazel-apt stable jdk1.8"
diff --git a/skylib/container_file_export.bzl b/skylib/container_file_export.bzl
index 35e4044..f2a258f 100644
--- a/skylib/container_file_export.bzl
+++ b/skylib/container_file_export.bzl
@@ -14,32 +14,34 @@
 """Rules to export a file/directory located inside a container available as a tarball."""
 
 def _container_file_export_impl(ctx):
-  """Implementation of the container_file_export rule."""
-  input = ctx.file._container_file_export_exec
-  args = [
-      input.path,
-      ctx.attr.image,
-      ctx.attr.src_path,
-      ctx.outputs.out.path,
-  ]
-  # The command may only access files declared in inputs.
-  ctx.actions.run_shell(
-      arguments = args,
-      inputs = [input],
-      outputs = [ctx.outputs.out],
-      progress_message = "copying %{} out of docker image %{} ...".format(ctx.attr.src_path, ctx.attr.image),
-      command = "$1 $2 $3 $4",
-  )
+    """Implementation of the container_file_export rule."""
+    input = ctx.file._container_file_export_exec
+    args = [
+        input.path,
+        ctx.attr.image,
+        ctx.attr.src_path,
+        ctx.outputs.out.path,
+    ]
+
+    # The command may only access files declared in inputs.
+    ctx.actions.run_shell(
+        arguments = args,
+        inputs = [input],
+        outputs = [ctx.outputs.out],
+        progress_message = "copying %{} out of docker image %{} ...".format(ctx.attr.src_path, ctx.attr.image),
+        command = "$1 $2 $3 $4",
+    )
 
 _container_file_export = rule(
     implementation = _container_file_export_impl,
     attrs = {
-        "image": attr.string(mandatory=True),
-        "src_path": attr.string(mandatory=True),
+        "image": attr.string(mandatory = True),
+        "src_path": attr.string(mandatory = True),
         "_container_file_export_exec": attr.label(
-            default=Label("//skylib:container_file_export.sh"),
-            single_file=True,
-            allow_files=True)
+            default = Label("//skylib:container_file_export.sh"),
+            single_file = True,
+            allow_files = True,
+        ),
     },
     outputs = {
         "out": "%{name}.tar.gz",
@@ -57,4 +59,4 @@
 #     src_path = '/opt/python3.6'
 #   )
 def container_file_export(**kwargs):
-  _container_file_export(**kwargs)
+    _container_file_export(**kwargs)
diff --git a/skylib/package_names.bzl b/skylib/package_names.bzl
index d26f091..c21269e 100644
--- a/skylib/package_names.bzl
+++ b/skylib/package_names.bzl
@@ -43,389 +43,389 @@
 )
 
 def jessie_tools():
-  return {
-      tool_names.binutils: _jessie_binutils_package_names(),
-      tool_names.curl: _jessie_curl_package_names(),
-      tool_names.ed: _jessie_ed_package_names(),
-      tool_names.file: _jessie_file_package_names(),
-      tool_names.gcc: _jessie_gcc_package_names(),
-      tool_names.git: _jessie_git_package_names(),
-      tool_names.java: _jessie_java_package_names(),
-      tool_names.java_no_ca_certs: _jessie_java_no_ca_certs_package_names(),
-      tool_names.lib_cpp: _jessie_lib_cpp_package_names(),
-      tool_names.openssh_client: _jessie_openssh_client_package_names(),
-      tool_names.python_dev: _jessie_python_dev_package_names(),
-      tool_names.python_numpy: _jessie_python_numpy_package_names(),
-      tool_names.python_pip: _jessie_python_pip_package_names(),
-      tool_names.python3_dev: _jessie_python3_dev_package_names(),
-      tool_names.python3_numpy: _jessie_python3_numpy_package_names(),
-      tool_names.python3_pip: _jessie_python3_pip_package_names(),
-      tool_names.wget: _jessie_wget_package_names(),
-      tool_names.zip: _zip_package_names(),
-  }
+    return {
+        tool_names.binutils: _jessie_binutils_package_names(),
+        tool_names.curl: _jessie_curl_package_names(),
+        tool_names.ed: _jessie_ed_package_names(),
+        tool_names.file: _jessie_file_package_names(),
+        tool_names.gcc: _jessie_gcc_package_names(),
+        tool_names.git: _jessie_git_package_names(),
+        tool_names.java: _jessie_java_package_names(),
+        tool_names.java_no_ca_certs: _jessie_java_no_ca_certs_package_names(),
+        tool_names.lib_cpp: _jessie_lib_cpp_package_names(),
+        tool_names.openssh_client: _jessie_openssh_client_package_names(),
+        tool_names.python_dev: _jessie_python_dev_package_names(),
+        tool_names.python_numpy: _jessie_python_numpy_package_names(),
+        tool_names.python_pip: _jessie_python_pip_package_names(),
+        tool_names.python3_dev: _jessie_python3_dev_package_names(),
+        tool_names.python3_numpy: _jessie_python3_numpy_package_names(),
+        tool_names.python3_pip: _jessie_python3_pip_package_names(),
+        tool_names.wget: _jessie_wget_package_names(),
+        tool_names.zip: _zip_package_names(),
+    }
 
 def jessie_package_names():
-  return _package_names(jessie_tools)
+    return _package_names(jessie_tools)
 
 def _package_names(tools):
-  packages = []
-  for tool in tools().values():
-    packages.extend(tool)
-  return depset(packages).to_list()
+    packages = []
+    for tool in tools().values():
+        packages.extend(tool)
+    return depset(packages).to_list()
 
 def _jessie_binutils_package_names():
-  return [
-      "binutils",
-  ]
+    return [
+        "binutils",
+    ]
 
 def _jessie_curl_package_names():
-  return [
-      "curl",
-      "libcurl3",
-      "libffi6",
-      "libgmp10",
-      "libgnutls-deb0-28",
-      "libgssapi-krb5-2",
-      "libhogweed2",
-      "libidn11",
-      "libk5crypto3",
-      "libkeyutils1",
-      "libkrb5-3",
-      "libkrb5support0",
-      "libldap-2.4-2",
-      "libnettle4",
-      "libp11-kit0",
-      "librtmp1",
-      "libsasl2-2",
-      "libsasl2-modules-db",
-      "libssh2-1",
-      "libtasn1-6",
-  ]
+    return [
+        "curl",
+        "libcurl3",
+        "libffi6",
+        "libgmp10",
+        "libgnutls-deb0-28",
+        "libgssapi-krb5-2",
+        "libhogweed2",
+        "libidn11",
+        "libk5crypto3",
+        "libkeyutils1",
+        "libkrb5-3",
+        "libkrb5support0",
+        "libldap-2.4-2",
+        "libnettle4",
+        "libp11-kit0",
+        "librtmp1",
+        "libsasl2-2",
+        "libsasl2-modules-db",
+        "libssh2-1",
+        "libtasn1-6",
+    ]
 
 def _jessie_gcc_package_names():
-  return [
-      "binutils",
-      "cpp",
-      "cpp-4.9",
-      "g++",
-      "g++-4.9",
-      "gcc",
-      "gcc-4.9",
-      "libasan1",
-      "libatomic1",
-      "libc-dev-bin",
-      "libc6-dev",
-      "libcilkrts5",
-      "libcloog-isl4",
-      "libgcc-4.9-dev",
-      "libgmp10",
-      "libgomp1",
-      "libisl10",
-      "libitm1",
-      "liblsan0",
-      "libmpc3",
-      "libmpfr4",
-      "libquadmath0",
-      "libstdc++-4.9-dev",
-      "libtsan0",
-      "libubsan0",
-      "linux-libc-dev",
-  ]
+    return [
+        "binutils",
+        "cpp",
+        "cpp-4.9",
+        "g++",
+        "g++-4.9",
+        "gcc",
+        "gcc-4.9",
+        "libasan1",
+        "libatomic1",
+        "libc-dev-bin",
+        "libc6-dev",
+        "libcilkrts5",
+        "libcloog-isl4",
+        "libgcc-4.9-dev",
+        "libgmp10",
+        "libgomp1",
+        "libisl10",
+        "libitm1",
+        "liblsan0",
+        "libmpc3",
+        "libmpfr4",
+        "libquadmath0",
+        "libstdc++-4.9-dev",
+        "libtsan0",
+        "libubsan0",
+        "linux-libc-dev",
+    ]
 
 def _jessie_ed_package_names():
-  return [
-      "ed",
-  ]
+    return [
+        "ed",
+    ]
 
 def _jessie_file_package_names():
-  return [
-      "file",
-      "libmagic1",
-  ]
+    return [
+        "file",
+        "libmagic1",
+    ]
 
 def _jessie_git_package_names():
-  return [
-      "git",
-      "git-man",
-      "libcurl3-gnutls",
-      "liberror-perl",
-      "libexpat1",
-      "libffi6",
-      "libgdbm3",
-      "libgmp10",
-      "libgnutls-deb0-28",
-      "libgssapi-krb5-2",
-      "libhogweed2",
-      "libidn11",
-      "libk5crypto3",
-      "libkeyutils1",
-      "libkrb5-3",
-      "libkrb5support0",
-      "libldap-2.4-2",
-      "libnettle4",
-      "libp11-kit0",
-      "librtmp1",
-      "libsasl2-2",
-      "libsasl2-modules-db",
-      "libssh2-1",
-      "libtasn1-6",
-      "perl",
-      "perl-modules",
-      # Though not strictly required, we get a 'Problem with the SSL CA cert'
-      # errror w/o these packages
-      "ca-certificates",
-      "libssl1.0.0",
-      "openssl",
-  ]
+    return [
+        "git",
+        "git-man",
+        "libcurl3-gnutls",
+        "liberror-perl",
+        "libexpat1",
+        "libffi6",
+        "libgdbm3",
+        "libgmp10",
+        "libgnutls-deb0-28",
+        "libgssapi-krb5-2",
+        "libhogweed2",
+        "libidn11",
+        "libk5crypto3",
+        "libkeyutils1",
+        "libkrb5-3",
+        "libkrb5support0",
+        "libldap-2.4-2",
+        "libnettle4",
+        "libp11-kit0",
+        "librtmp1",
+        "libsasl2-2",
+        "libsasl2-modules-db",
+        "libssh2-1",
+        "libtasn1-6",
+        "perl",
+        "perl-modules",
+        # Though not strictly required, we get a 'Problem with the SSL CA cert'
+        # errror w/o these packages
+        "ca-certificates",
+        "libssl1.0.0",
+        "openssl",
+    ]
 
 def _jessie_java_no_ca_certs_package_names():
-  return [
-      "fontconfig-config",
-      "fonts-dejavu-core",
-      "java-common",
-      "libavahi-client3",
-      "libavahi-common-data",
-      "libavahi-common3",
-      "libcups2",
-      "libdbus-1-3",
-      "libexpat1",
-      "libffi6",
-      "libfontconfig1",
-      "libfreetype6",
-      "libgmp10",
-      "libgnutls-deb0-28",
-      "libgssapi-krb5-2",
-      "libhogweed2",
-      "libjpeg62-turbo",
-      "libk5crypto3",
-      "libkeyutils1",
-      "libkrb5-3",
-      "libkrb5support0",
-      "liblcms2-2",
-      "libnettle4",
-      "libnspr4",
-      "libnss3",
-      "libp11-kit0",
-      "libpcsclite1",
-      "libpng12-0",
-      "libsqlite3-0",
-      "libtasn1-6",
-      "libx11-6",
-      "libx11-data",
-      "libxau6",
-      "libxcb1",
-      "libxdmcp6",
-      "libxext6",
-      "libxi6",
-      "libxrender1",
-      "libxtst6",
-      "openjdk-8-jdk-headless",
-      "openjdk-8-jre-headless",
-      "ucf",
-      "x11-common",
-      "zlib1g",
-  ]
+    return [
+        "fontconfig-config",
+        "fonts-dejavu-core",
+        "java-common",
+        "libavahi-client3",
+        "libavahi-common-data",
+        "libavahi-common3",
+        "libcups2",
+        "libdbus-1-3",
+        "libexpat1",
+        "libffi6",
+        "libfontconfig1",
+        "libfreetype6",
+        "libgmp10",
+        "libgnutls-deb0-28",
+        "libgssapi-krb5-2",
+        "libhogweed2",
+        "libjpeg62-turbo",
+        "libk5crypto3",
+        "libkeyutils1",
+        "libkrb5-3",
+        "libkrb5support0",
+        "liblcms2-2",
+        "libnettle4",
+        "libnspr4",
+        "libnss3",
+        "libp11-kit0",
+        "libpcsclite1",
+        "libpng12-0",
+        "libsqlite3-0",
+        "libtasn1-6",
+        "libx11-6",
+        "libx11-data",
+        "libxau6",
+        "libxcb1",
+        "libxdmcp6",
+        "libxext6",
+        "libxi6",
+        "libxrender1",
+        "libxtst6",
+        "openjdk-8-jdk-headless",
+        "openjdk-8-jre-headless",
+        "ucf",
+        "x11-common",
+        "zlib1g",
+    ]
 
 def _jessie_java_package_names():
-  return _jessie_java_no_ca_certs_package_names() + ["ca-certificates-java"]
+    return _jessie_java_no_ca_certs_package_names() + ["ca-certificates-java"]
 
 def _jessie_lib_cpp_package_names():
-  return [
-      "libasan1",
-      "libatomic1",
-      "libc-dev-bin",
-      "libc6-dev",
-      "libcilkrts5",
-      "libgcc-4.9-dev",
-      "libgomp1",
-      "libitm1",
-      "liblsan0",
-      "libquadmath0",
-      "libstdc++-4.9-dev",
-      "libtsan0",
-      "libubsan0",
-      "linux-libc-dev",
-  ]
+    return [
+        "libasan1",
+        "libatomic1",
+        "libc-dev-bin",
+        "libc6-dev",
+        "libcilkrts5",
+        "libgcc-4.9-dev",
+        "libgomp1",
+        "libitm1",
+        "liblsan0",
+        "libquadmath0",
+        "libstdc++-4.9-dev",
+        "libtsan0",
+        "libubsan0",
+        "linux-libc-dev",
+    ]
 
 def _jessie_openssh_client_package_names():
-  return [
-      "libbsd0",
-      "libedit2",
-      "libgssapi-krb5-2",
-      "libk5crypto3",
-      "libkeyutils1",
-      "libkrb5-3",
-      "libkrb5support0",
-      "openssh-client",
-  ]
+    return [
+        "libbsd0",
+        "libedit2",
+        "libgssapi-krb5-2",
+        "libk5crypto3",
+        "libkeyutils1",
+        "libkrb5-3",
+        "libkrb5support0",
+        "openssh-client",
+    ]
 
 def _jessie_python3_dev_package_names():
-  return [
-      "dh-python",
-      "libc-dev-bin",
-      "libc6-dev",
-      "libexpat1",
-      "libexpat1-dev",
-      "libffi6",
-      "libmpdec2",
-      "libpython3-dev",
-      "libpython3-stdlib",
-      "libpython3.4",
-      "libpython3.4-dev",
-      "libpython3.4-minimal",
-      "libpython3.4-stdlib",
-      "libsqlite3-0",
-      "linux-libc-dev",
-      "mime-support",
-      "python3",
-      "python3-dev",
-      "python3-minimal",
-      "python3.4",
-      "python3.4-dev",
-      "python3.4-minimal",
-  ]
+    return [
+        "dh-python",
+        "libc-dev-bin",
+        "libc6-dev",
+        "libexpat1",
+        "libexpat1-dev",
+        "libffi6",
+        "libmpdec2",
+        "libpython3-dev",
+        "libpython3-stdlib",
+        "libpython3.4",
+        "libpython3.4-dev",
+        "libpython3.4-minimal",
+        "libpython3.4-stdlib",
+        "libsqlite3-0",
+        "linux-libc-dev",
+        "mime-support",
+        "python3",
+        "python3-dev",
+        "python3-minimal",
+        "python3.4",
+        "python3.4-dev",
+        "python3.4-minimal",
+    ]
 
 def _jessie_python3_numpy_package_names():
-  return [
-      "dh-python",
-      "libblas-common",
-      "libblas3",
-      "libexpat1",
-      "libffi6",
-      "libgfortran3",
-      "liblapack3",
-      "libmpdec2",
-      "libpython3-stdlib",
-      "libpython3.4-minimal",
-      "libpython3.4-stdlib",
-      "libquadmath0",
-      "libsqlite3-0",
-      "mime-support",
-      "python3",
-      "python3-minimal",
-      "python3-numpy",
-      "python3.4",
-      "python3.4-minimal",
-  ]
+    return [
+        "dh-python",
+        "libblas-common",
+        "libblas3",
+        "libexpat1",
+        "libffi6",
+        "libgfortran3",
+        "liblapack3",
+        "libmpdec2",
+        "libpython3-stdlib",
+        "libpython3.4-minimal",
+        "libpython3.4-stdlib",
+        "libquadmath0",
+        "libsqlite3-0",
+        "mime-support",
+        "python3",
+        "python3-minimal",
+        "python3-numpy",
+        "python3.4",
+        "python3.4-minimal",
+    ]
 
 def _jessie_python3_pip_package_names():
-  return [
-      "dh-python",
-      "libexpat1",
-      "libffi6",
-      "libmpdec2",
-      "libpython3-stdlib",
-      "libpython3.4-minimal",
-      "libpython3.4-stdlib",
-      "libsqlite3-0",
-      "mime-support",
-      "python3",
-      "python3-chardet",
-      "python3-colorama",
-      "python3-distlib",
-      "python3-html5lib",
-      "python3-minimal",
-      "python3-pip",
-      "python3-pkg-resources",
-      "python3-requests",
-      "python3-setuptools",
-      "python3-six",
-      "python3-urllib3",
-      "python3.4",
-      "python3.4-minimal",
-  ]
+    return [
+        "dh-python",
+        "libexpat1",
+        "libffi6",
+        "libmpdec2",
+        "libpython3-stdlib",
+        "libpython3.4-minimal",
+        "libpython3.4-stdlib",
+        "libsqlite3-0",
+        "mime-support",
+        "python3",
+        "python3-chardet",
+        "python3-colorama",
+        "python3-distlib",
+        "python3-html5lib",
+        "python3-minimal",
+        "python3-pip",
+        "python3-pkg-resources",
+        "python3-requests",
+        "python3-setuptools",
+        "python3-six",
+        "python3-urllib3",
+        "python3.4",
+        "python3.4-minimal",
+    ]
 
 def _jessie_python_dev_package_names():
-  return [
-      "libc-dev-bin",
-      "libc6-dev",
-      "libexpat1",
-      "libexpat1-dev",
-      "libffi6",
-      "libpython-dev",
-      "libpython-stdlib",
-      "libpython2.7",
-      "libpython2.7-dev",
-      "libpython2.7-minimal",
-      "libpython2.7-stdlib",
-      "libsqlite3-0",
-      "linux-libc-dev",
-      "mime-support",
-      "python",
-      "python-dev",
-      "python-minimal",
-      "python2.7",
-      "python2.7-dev",
-      "python2.7-minimal",
-  ]
+    return [
+        "libc-dev-bin",
+        "libc6-dev",
+        "libexpat1",
+        "libexpat1-dev",
+        "libffi6",
+        "libpython-dev",
+        "libpython-stdlib",
+        "libpython2.7",
+        "libpython2.7-dev",
+        "libpython2.7-minimal",
+        "libpython2.7-stdlib",
+        "libsqlite3-0",
+        "linux-libc-dev",
+        "mime-support",
+        "python",
+        "python-dev",
+        "python-minimal",
+        "python2.7",
+        "python2.7-dev",
+        "python2.7-minimal",
+    ]
 
 def _jessie_python_pip_package_names():
-  return [
-      "libexpat1",
-      "libffi6",
-      "libpython-stdlib",
-      "libpython2.7-minimal",
-      "libpython2.7-stdlib",
-      "libsqlite3-0",
-      "mime-support",
-      "python",
-      "python-chardet",
-      "python-colorama",
-      "python-distlib",
-      "python-html5lib",
-      "python-minimal",
-      "python-pip",
-      "python-pkg-resources",
-      "python-requests",
-      "python-setuptools",
-      "python-six",
-      "python-urllib3",
-      "python2.7",
-      "python2.7-minimal",
-  ]
+    return [
+        "libexpat1",
+        "libffi6",
+        "libpython-stdlib",
+        "libpython2.7-minimal",
+        "libpython2.7-stdlib",
+        "libsqlite3-0",
+        "mime-support",
+        "python",
+        "python-chardet",
+        "python-colorama",
+        "python-distlib",
+        "python-html5lib",
+        "python-minimal",
+        "python-pip",
+        "python-pkg-resources",
+        "python-requests",
+        "python-setuptools",
+        "python-six",
+        "python-urllib3",
+        "python2.7",
+        "python2.7-minimal",
+    ]
 
 def _jessie_python_numpy_package_names():
-  return [
-      "libblas-common",
-      "libblas3",
-      "libexpat1",
-      "libffi6",
-      "libgfortran3",
-      "liblapack3",
-      "libpython-stdlib",
-      "libpython2.7-minimal",
-      "libpython2.7-stdlib",
-      "libquadmath0",
-      "libsqlite3-0",
-      "mime-support",
-      "python",
-      "python-minimal",
-      "python-numpy",
-      "python2.7",
-      "python2.7-minimal",
-  ]
+    return [
+        "libblas-common",
+        "libblas3",
+        "libexpat1",
+        "libffi6",
+        "libgfortran3",
+        "liblapack3",
+        "libpython-stdlib",
+        "libpython2.7-minimal",
+        "libpython2.7-stdlib",
+        "libquadmath0",
+        "libsqlite3-0",
+        "mime-support",
+        "python",
+        "python-minimal",
+        "python-numpy",
+        "python2.7",
+        "python2.7-minimal",
+    ]
 
 def _jessie_wget_package_names():
-  return [
-      "libffi6",
-      "libgmp10",
-      "libgnutls-deb0-28",
-      "libhogweed2",
-      "libicu52",
-      "libidn11",
-      "libnettle4",
-      "libp11-kit0",
-      "libpsl0",
-      "libtasn1-6",
-      "wget",
-      # Needed for cert validation done by wget
-      "ca-certificates",
-      "libssl1.0.0",
-      "openssl",
-  ]
+    return [
+        "libffi6",
+        "libgmp10",
+        "libgnutls-deb0-28",
+        "libhogweed2",
+        "libicu52",
+        "libidn11",
+        "libnettle4",
+        "libp11-kit0",
+        "libpsl0",
+        "libtasn1-6",
+        "wget",
+        # Needed for cert validation done by wget
+        "ca-certificates",
+        "libssl1.0.0",
+        "openssl",
+    ]
 
 def _zip_package_names():
-  return [
-      "zip",
-      "unzip",
-  ]
+    return [
+        "zip",
+        "unzip",
+    ]
diff --git a/skylib/packages.bzl b/skylib/packages.bzl
index 6eb3cca..4d9c572 100644
--- a/skylib/packages.bzl
+++ b/skylib/packages.bzl
@@ -27,64 +27,64 @@
 )
 load(
     ":package_names.bzl",
-    "tool_names",
     "jessie_tools",
+    "tool_names",
 )
 
 def get_jessie_packages(pkg_list):
-  """Common function for getting jessie packages."""
-  return [jessie_packages[p] for p in pkg_list]
+    """Common function for getting jessie packages."""
+    return [jessie_packages[p] for p in pkg_list]
 
 def base_layer_packages():
-  """Base packages for fully loaded toolchain."""
-  base_tools = [
-      tool_names.binutils,
-      tool_names.curl,
-      tool_names.ed,
-      tool_names.file,
-      tool_names.git,
-      tool_names.openssh_client,
-      tool_names.wget,
-      tool_names.zip,
-  ]
-  packages = []
-  for tool in base_tools:
-    packages.extend(get_jessie_packages(jessie_tools()[tool]))
-  return depset(packages).to_list()
+    """Base packages for fully loaded toolchain."""
+    base_tools = [
+        tool_names.binutils,
+        tool_names.curl,
+        tool_names.ed,
+        tool_names.file,
+        tool_names.git,
+        tool_names.openssh_client,
+        tool_names.wget,
+        tool_names.zip,
+    ]
+    packages = []
+    for tool in base_tools:
+        packages.extend(get_jessie_packages(jessie_tools()[tool]))
+    return depset(packages).to_list()
 
 def clang_layer_packages():
-  """Packages for the clang layer."""
-  clang_tools = [
-      tool_names.binutils,
-      tool_names.lib_cpp,
-  ]
-  packages = []
-  for tool in clang_tools:
-    packages.extend(get_jessie_packages(jessie_tools()[tool]))
-  return depset(packages).to_list()
+    """Packages for the clang layer."""
+    clang_tools = [
+        tool_names.binutils,
+        tool_names.lib_cpp,
+    ]
+    packages = []
+    for tool in clang_tools:
+        packages.extend(get_jessie_packages(jessie_tools()[tool]))
+    return depset(packages).to_list()
 
 def python_layer_packages():
-  """Packages for the python layer."""
-  python_tools = [
-      tool_names.python_dev,
-      tool_names.python_numpy,
-      tool_names.python_pip,
-      tool_names.python3_dev,
-      tool_names.python3_numpy,
-      tool_names.python3_pip,
-  ]
-  packages = []
-  for tool in python_tools:
-    packages.extend(get_jessie_packages(jessie_tools()[tool]))
-  return depset(packages).to_list()
+    """Packages for the python layer."""
+    python_tools = [
+        tool_names.python_dev,
+        tool_names.python_numpy,
+        tool_names.python_pip,
+        tool_names.python3_dev,
+        tool_names.python3_numpy,
+        tool_names.python3_pip,
+    ]
+    packages = []
+    for tool in python_tools:
+        packages.extend(get_jessie_packages(jessie_tools()[tool]))
+    return depset(packages).to_list()
 
 def java_layer_packages():
-  """Packages for the java layer."""
-  java_tools = [
-      tool_names.java_no_ca_certs,
-  ]
-  packages = []
-  for tool in java_tools:
-    packages.extend(get_jessie_packages(jessie_tools()[tool]))
-  packages.append(ca_certs_packages["ca-certificates-java"])
-  return depset(packages).to_list()
+    """Packages for the java layer."""
+    java_tools = [
+        tool_names.java_no_ca_certs,
+    ]
+    packages = []
+    for tool in java_tools:
+        packages.extend(get_jessie_packages(jessie_tools()[tool]))
+    packages.append(ca_certs_packages["ca-certificates-java"])
+    return depset(packages).to_list()
diff --git a/test/configs/BUILD b/test/configs/BUILD
index 3781720..2a7d3e2 100644
--- a/test/configs/BUILD
+++ b/test/configs/BUILD
@@ -18,22 +18,23 @@
 
 load("//container/rules:docker_toolchains.bzl", "toolchain_container")
 load("@bazel_toolchains//rules:docker_config.bzl", "docker_toolchain_autoconfig")
-load("@bazel_toolchains//rules:environments.bzl",
-    "gcc_env",
+load(
+    "@bazel_toolchains//rules:environments.bzl",
     "debian8_clang_default_keys",
     "debian8_clang_default_packages",
-    "debian8_clang_default_repos"
+    "debian8_clang_default_repos",
+    "gcc_env",
 )
 
 # Use "rbe-test-" prefix for easy identification of images to remove after the tests.
 toolchain_container(
     name = "rbe-test-jessie-with-pkgs",
+    additional_repos = debian8_clang_default_repos(),
     base = "@official_jessie//image",
+    keys = debian8_clang_default_keys(),
     packages = debian8_clang_default_packages() + [
         "gcc",
     ],
-    additional_repos = debian8_clang_default_repos(),
-    keys = debian8_clang_default_keys(),
 )
 
 # Targets here are for testing purposes, we do not actually
@@ -51,8 +52,8 @@
     base = ":rbe-test-jessie-with-pkgs.tar",
     env = gcc_env(),
     tags = ["manual"],
-    use_bazel_head = True,
     test = True,
+    use_bazel_head = True,
 )
 
 docker_toolchain_autoconfig(
@@ -68,8 +69,8 @@
 docker_toolchain_autoconfig(
     name = "debian-jessie-custom-bazel-rc-version-autoconfig",
     base = ":rbe-test-jessie-with-pkgs.tar",
-    bazel_version = "0.13.0",
     bazel_rc_version = "1",
+    bazel_version = "0.13.0",
     env = gcc_env(),
     tags = ["manual"],
     test = True,
@@ -78,7 +79,13 @@
 # Use "rbe-test-" prefix for easy identification of images to remove after the tests.
 toolchain_container(
     name = "rbe-test-xenial-with-pkgs",
+    additional_repos = [
+        "deb [arch=amd64] http://storage.googleapis.com/bazel-apt stable jdk1.8",
+    ],
     base = "@official_xenial//image",
+    keys = [
+        "@bazel_gpg//file",
+    ],
     packages = [
         "bazel",
         "curl",
@@ -90,12 +97,6 @@
         "wget",
         "zip",
     ],
-    additional_repos = [
-        "deb [arch=amd64] http://storage.googleapis.com/bazel-apt stable jdk1.8",
-    ],
-    keys = [
-        "@bazel_gpg//file",
-    ],
 )
 
 docker_toolchain_autoconfig(
@@ -111,8 +112,8 @@
     base = ":rbe-test-xenial-with-pkgs.tar",
     env = gcc_env(),
     tags = ["manual"],
-    use_bazel_head = True,
     test = True,
+    use_bazel_head = True,
 )
 
 docker_toolchain_autoconfig(
@@ -128,8 +129,8 @@
 docker_toolchain_autoconfig(
     name = "ubuntu-xenial-custom-bazel-rc-version-autoconfig",
     base = ":rbe-test-xenial-with-pkgs.tar",
-    bazel_version = "0.13.0",
     bazel_rc_version = "1",
+    bazel_version = "0.13.0",
     env = gcc_env(),
     tags = ["manual"],
     test = True,
@@ -141,7 +142,7 @@
     timeout = "long",
     srcs = ["debian8_clang_autoconfig_test.sh"],
     data = [
-      "//configs/debian8_clang:debian8-clang-0.3.0-bazel_0.10.0-autoconfig",
-      "@bazel_toolchains_test//file",
+        "//configs/debian8_clang:debian8-clang-0.3.0-bazel_0.10.0-autoconfig",
+        "@bazel_toolchains_test//file",
     ],
 )
diff --git a/test/container/container_determinism_test.bzl b/test/container/container_determinism_test.bzl
index 698396a..649912f 100644
--- a/test/container/container_determinism_test.bzl
+++ b/test/container/container_determinism_test.bzl
@@ -1,18 +1,18 @@
 def container_determinism_test(name, container_name, container_sha):
-  """Macro to invoke a sh_test rule with right parameters.
+    """Macro to invoke a sh_test rule with right parameters.
 
-  Args:
-      name: name of this rule.
-      container_name:  name of the container
-      container_sha: value of the expected sha to check against
-  """
+    Args:
+        name: name of this rule.
+        container_name:  name of the container
+        container_sha: value of the expected sha to check against
+    """
 
-  return native.sh_test(
-           name = name,
-           size = "medium",
-           timeout = "long",
-           srcs = ["container_determinism_test.sh"],
-           data = [container_name],
-           tags = ["manual"],
-           args = ["-c %s -s %s" % (container_name, container_sha)],
-         )
+    return native.sh_test(
+        name = name,
+        size = "medium",
+        timeout = "long",
+        srcs = ["container_determinism_test.sh"],
+        data = [container_name],
+        tags = ["manual"],
+        args = ["-c %s -s %s" % (container_name, container_sha)],
+    )
diff --git a/third_party/clang/revision.bzl b/third_party/clang/revision.bzl
index 5e91319..547595e 100644
--- a/third_party/clang/revision.bzl
+++ b/third_party/clang/revision.bzl
@@ -1,4 +1,4 @@
-CLANG_REVISION="r328903"
-DEBIAN8_CLANG_SHA256="8f460b909788ffd8dd467ea4ee106ccd08b4a43408dd98ac8e3938a9b6452bb7"
-DEBIAN9_CLANG_SHA256="350f77999033e39a02294406250df819cacb2106daa7b04b5fd6bfe7aa0ab5a1"
-UBUNTU16_04_CLANG_SHA256="f1874c57aa1e34c09595a4a0e03b91d7bf89dd7ad044ff4834b46198ff2e9d14"
+CLANG_REVISION = "r328903"
+DEBIAN8_CLANG_SHA256 = "8f460b909788ffd8dd467ea4ee106ccd08b4a43408dd98ac8e3938a9b6452bb7"
+DEBIAN9_CLANG_SHA256 = "350f77999033e39a02294406250df819cacb2106daa7b04b5fd6bfe7aa0ab5a1"
+UBUNTU16_04_CLANG_SHA256 = "f1874c57aa1e34c09595a4a0e03b91d7bf89dd7ad044ff4834b46198ff2e9d14"
diff --git a/third_party/golang/revision.bzl b/third_party/golang/revision.bzl
index 0484f05..9738cec 100644
--- a/third_party/golang/revision.bzl
+++ b/third_party/golang/revision.bzl
@@ -1,2 +1,2 @@
-GOLANG_REVISION="1.10"
-GOLANG_SHA256="b5a64335f1490277b585832d1f6c7f8c6c11206cba5cd3f771dcb87b98ad1a33"
+GOLANG_REVISION = "1.10"
+GOLANG_SHA256 = "b5a64335f1490277b585832d1f6c7f8c6c11206cba5cd3f771dcb87b98ad1a33"
diff --git a/third_party/libcxx/revision.bzl b/third_party/libcxx/revision.bzl
index 28baf11..8b7fe21 100644
--- a/third_party/libcxx/revision.bzl
+++ b/third_party/libcxx/revision.bzl
@@ -1,4 +1,4 @@
-LIBCXX_REVISION="r328903"
-DEBIAN8_LIBCXX_SHA256="d9798333832690577ca740acb3016a803be684ad0ed02e78922424b4b651f8ce"
-DEBIAN9_LIBCXX_SHA256="66219b838f8d243c071a4c094e13ef78082cd858d87841dd607839a351680b90"
-UBUNTU16_04_LIBCXX_SHA256="786a35a813e493342a018c04b8fb951a8b34a7d7e377e1ac793db738fc240451"
+LIBCXX_REVISION = "r328903"
+DEBIAN8_LIBCXX_SHA256 = "d9798333832690577ca740acb3016a803be684ad0ed02e78922424b4b651f8ce"
+DEBIAN9_LIBCXX_SHA256 = "66219b838f8d243c071a4c094e13ef78082cd858d87841dd607839a351680b90"
+UBUNTU16_04_LIBCXX_SHA256 = "786a35a813e493342a018c04b8fb951a8b34a7d7e377e1ac793db738fc240451"