diff --git a/WORKSPACE b/WORKSPACE
index 0d545e8..243b245 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -111,6 +111,12 @@
     url = "https://bazel.build/bazel-release.pub.gpg",
 )
 
+http_file(
+    name = "debian_docker_gpg",
+    sha256 = "1500c1f56fa9e26b9b8f42452a553675796ade0807cdce11975eb98170b3a570",
+    url = "https://download.docker.com/linux/debian/gpg",
+)
+
 # Use http_archive rule instead of git_repository rule
 # https://docs.bazel.build/versions/master/be/workspace.html#git_repository
 http_archive(
diff --git a/rules/docker_config.bzl b/rules/docker_config.bzl
index 6239de4..6dd0090 100644
--- a/rules/docker_config.bzl
+++ b/rules/docker_config.bzl
@@ -152,7 +152,7 @@
     ".tar.xz",
 ]
 
-def container_install_pkgs(name, base, packages, additional_repos, keys):
+def container_install_pkgs(name, base, packages, additional_repos = [], keys = [], tags = []):
   """Macro to download and install deb packages in a container.
 
   The output image with packages installed will have name {name}.tar.
@@ -165,6 +165,7 @@
     additional_repos: list of additional debian package repos to use,
       in sources.list format.
     keys: label of additional gpg keys to use while downloading packages.
+    tags: tags to pass down to generated rules
   """
 
   # Create an intermediate image which includes additional gpg keys.
@@ -181,6 +182,7 @@
       additional_repos = additional_repos,
       image_tar = ":" + name + "_with_keys.tar",
       packages = packages,
+      tags = tags,
   )
 
   # Execute the package installation script in the container and commit the
@@ -190,7 +192,8 @@
       name = name,
       image_tar = base,
       installables_tar = ":" + name + "_pkgs.tar",
-      output_image_name = name,
+      output_image_name = "bazel/" + native.package_name() + ":" + name,
+      tags = tags,
   )
 
 def _docker_toolchain_autoconfig_impl(ctx):
diff --git a/test/container/BUILD b/test/container/BUILD
index 9c1604a..e00c038 100644
--- a/test/container/BUILD
+++ b/test/container/BUILD
@@ -15,3 +15,107 @@
 licenses(["notice"])  # Apache 2.0
 
 package(default_visibility = ["//visibility:public"])
+
+load("@base_images_docker//package_managers:download_pkgs.bzl", "download_pkgs")
+load("@base_images_docker//package_managers:install_pkgs.bzl", "install_pkgs")
+load("@base_images_docker//package_managers:apt_key.bzl", "add_apt_key")
+
+load("@bazel_toolchains//rules:docker_config.bzl", "container_install_pkgs")
+
+# This file contains some sample targets that excersise the container rules
+# We just keep these as examples that should not break (unless indicated)
+# with changes.
+
+# The two targets below test that container_install_pkgs can sequentially
+# install packages
+container_install_pkgs(
+    name = "rbe-test-xenial-base",
+    base = "@official_xenial//image",
+    packages = [
+        "curl",
+        "gcc",
+        "git",
+        "openjdk-8-jdk",
+        "python-dev",
+        "unzip",
+        "wget",
+        "zip",
+    ],
+)
+
+container_install_pkgs(
+    name = "rbe-test-xenial-with-pkgs",
+    base = ":rbe-test-xenial-base.tar",
+    packages = [
+        "bazel",
+    ],
+    additional_repos = [
+        "deb [arch=amd64] http://storage.googleapis.com/bazel-apt stable jdk1.8",
+    ],
+    keys = [
+        "@bazel_gpg//file",
+    ],
+)
+
+# The target below (marked manual, should not be run by CI) shows a case of a
+# package that cannot be installed because downloading it requires an additional
+# package (apt-transport-https) not present in the base.
+container_install_pkgs(
+    name = "docker-noprereq-fails",
+    additional_repos = [
+        "deb [arch=amd64] https://download.docker.com/linux/debian jessie stable",
+    ],
+    base = "@debian8//image",
+    packages = [
+        "docker-ce",
+        "apt-transport-https",
+    ],
+    keys = [
+      "@debian_docker_gpg//file",
+    ],
+    tags = ["manual"],
+)
+
+# The targets below exemplify how to install a package whose download
+# has pre-requisites in a way that the final container in which the
+# package is installed does not need the pre-requisites
+download_pkgs(
+    name = "docker-prereq-packages",
+    image_tar = "@debian8//image",
+    packages = [
+        "apt-transport-https",
+    ],
+)
+
+install_pkgs(
+      name = "docker-prereq-test",
+      image_tar = "@debian8//image",
+      installables_tar = ":docker-prereq-packages.tar",
+      output_image_name = "bazel/test/container:docker-prereq-test",
+)
+
+add_apt_key(
+      name = "test-docker-with-keys",
+      image = ":docker-prereq-test.tar",
+      keys = [
+        "@debian_docker_gpg//file",
+      ],
+)
+
+download_pkgs(
+      name = "test-docker-packages",
+      additional_repos = [
+        "deb [arch=amd64] https://download.docker.com/linux/debian jessie stable",
+      ],
+      image_tar = ":test-docker-with-keys.tar",
+      packages = [
+        "docker-ce",
+      ],
+)
+
+install_pkgs(
+      name = "docker",
+      image_tar = "@debian8//image",
+      installables_tar = ":test-docker-packages.tar",
+      output_image_name = "bazel/test/container:docker",
+)