diff --git a/container/debian8/builders/bazel/BUILD b/container/debian8/builders/bazel/BUILD
index fd3a955..20b3b98 100644
--- a/container/debian8/builders/bazel/BUILD
+++ b/container/debian8/builders/bazel/BUILD
@@ -21,6 +21,7 @@
     "language_tool_layer",
     "toolchain_container",
 )
+load("@io_bazel_rules_docker//container:container.bzl", "container_image")
 load("@io_bazel_rules_docker//contrib:test.bzl", "container_test")
 load("//container/common/bazel:version.bzl", "BAZEL_VERSION_SHA256S")
 
@@ -37,13 +38,8 @@
 # Generate the Bazel container for all supported versions using the
 # corresponding Bazel language_tool_layer targets.
 [toolchain_container(
-    name = "bazel_%s" % bazel_version,
+    name = "bazel_%s_intermediate" % bazel_version,
     base = "@debian8//image",
-    cmd = [
-        "/bin/sh",
-        "-c",
-        "/bin/bash",
-    ],
     # TODO(xingao) Fix this. We should not remove /etc/ssl/certs/java/cacerts
     # file in the java-ltl, but instead, archive it for future container
     # reproduction.
@@ -59,6 +55,18 @@
     ],
 ) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
 
+# Set up `entrypoint` and cmd in the container. These cannot be down in the
+# `toolchain_container` rule as they would be consumed by intermediate
+# `container_image` rule in its implementation.
+# TODO(xingao): enable setting things like `entrypoint` and `cmd` in
+# `toolchain_container`.
+[container_image(
+    name = "bazel_%s" % bazel_version,
+    base = ":bazel_%s_intermediate" % bazel_version,
+    cmd = None,
+    entrypoint = ["/usr/local/bin/bazel"],
+) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
+
 # container_test targets for all supported Bazel versions.
 [container_test(
     name = "bazel_%s-test" % bazel_version,
diff --git a/container/debian8/builders/bazel/container.yaml b/container/debian8/builders/bazel/container.yaml
index c27a43a..082ae57 100644
--- a/container/debian8/builders/bazel/container.yaml
+++ b/container/debian8/builders/bazel/container.yaml
@@ -4,3 +4,5 @@
   env:
     - key: 'PATH'
       value: '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/python3.6/bin'
+  entrypoint: ["/usr/local/bin/bazel"]
+  cmd: []
diff --git a/container/ubuntu14_04/builders/bazel/BUILD b/container/ubuntu14_04/builders/bazel/BUILD
index a1fe6e5..7d53c93 100644
--- a/container/ubuntu14_04/builders/bazel/BUILD
+++ b/container/ubuntu14_04/builders/bazel/BUILD
@@ -21,6 +21,7 @@
     "language_tool_layer",
     "toolchain_container",
 )
+load("@io_bazel_rules_docker//container:container.bzl", "container_image")
 load("@io_bazel_rules_docker//contrib:test.bzl", "container_test")
 load("//container/common/bazel:version.bzl", "BAZEL_VERSION_SHA256S")
 
@@ -37,13 +38,8 @@
 # Generate the Bazel container for all supported versions using the
 # corresponding Bazel language_tool_layer targets.
 [toolchain_container(
-    name = "bazel_%s" % bazel_version,
+    name = "bazel_%s_intermediate" % bazel_version,
     base = "@trusty//image",
-    cmd = [
-        "/bin/sh",
-        "-c",
-        "/bin/bash",
-    ],
     # TODO(xingao) Fix this. We should not remove /etc/ssl/certs/java/cacerts
     # file in the java-ltl, but instead, archive it for future container
     # reproduction.
@@ -59,6 +55,18 @@
     ],
 ) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
 
+# Set up `entrypoint` and cmd in the container. These cannot be down in the
+# `toolchain_container` rule as they would be consumed by intermediate
+# `container_image` rule in its implementation.
+# TODO(xingao): enable setting things like `entrypoint` and `cmd` in
+# `toolchain_container`.
+[container_image(
+    name = "bazel_%s" % bazel_version,
+    base = ":bazel_%s_intermediate" % bazel_version,
+    cmd = None,
+    entrypoint = ["/usr/local/bin/bazel"],
+) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
+
 # container_test targets for all supported Bazel versions.
 [container_test(
     name = "bazel_%s-test" % bazel_version,
diff --git a/container/ubuntu14_04/builders/bazel/container.yaml b/container/ubuntu14_04/builders/bazel/container.yaml
index 258b514..2f67509 100644
--- a/container/ubuntu14_04/builders/bazel/container.yaml
+++ b/container/ubuntu14_04/builders/bazel/container.yaml
@@ -4,3 +4,5 @@
   env:
     - key: 'PATH'
       value: '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
+  entrypoint: ["/usr/local/bin/bazel"]
+  cmd: []
diff --git a/container/ubuntu16_04/builders/bazel/BUILD b/container/ubuntu16_04/builders/bazel/BUILD
index 90bd556..618a9ea 100644
--- a/container/ubuntu16_04/builders/bazel/BUILD
+++ b/container/ubuntu16_04/builders/bazel/BUILD
@@ -21,6 +21,7 @@
     "language_tool_layer",
     "toolchain_container",
 )
+load("@io_bazel_rules_docker//container:container.bzl", "container_image")
 load("@io_bazel_rules_docker//contrib:test.bzl", "container_test")
 load("//container/common/bazel:version.bzl", "BAZEL_VERSION_SHA256S")
 
@@ -37,13 +38,8 @@
 # Generate the Bazel container for all supported versions using the
 # corresponding Bazel language_tool_layer targets.
 [toolchain_container(
-    name = "bazel_%s" % bazel_version,
+    name = "bazel_%s_intermediate" % bazel_version,
     base = "@ubuntu16_04//image",
-    cmd = [
-        "/bin/sh",
-        "-c",
-        "/bin/bash",
-    ],
     # TODO(xingao) Fix this. We should not remove /etc/ssl/certs/java/cacerts
     # file in the java-ltl, but instead, archive it for future container
     # reproduction.
@@ -59,6 +55,18 @@
     ],
 ) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
 
+# Set up `entrypoint` and cmd in the container. These cannot be down in the
+# `toolchain_container` rule as they would be consumed by intermediate
+# `container_image` rule in its implementation.
+# TODO(xingao): enable setting things like `entrypoint` and `cmd` in
+# `toolchain_container`.
+[container_image(
+    name = "bazel_%s" % bazel_version,
+    base = ":bazel_%s_intermediate" % bazel_version,
+    cmd = None,
+    entrypoint = ["/usr/local/bin/bazel"],
+) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
+
 # container_test targets for all supported Bazel versions.
 [container_test(
     name = "bazel_%s-test" % bazel_version,
diff --git a/container/ubuntu16_04/builders/bazel/container.yaml b/container/ubuntu16_04/builders/bazel/container.yaml
index c27a43a..082ae57 100644
--- a/container/ubuntu16_04/builders/bazel/container.yaml
+++ b/container/ubuntu16_04/builders/bazel/container.yaml
@@ -4,3 +4,5 @@
   env:
     - key: 'PATH'
       value: '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/python3.6/bin'
+  entrypoint: ["/usr/local/bin/bazel"]
+  cmd: []
diff --git a/container/ubuntu16_04/builders/bazel_docker_gcloud/BUILD b/container/ubuntu16_04/builders/bazel_docker_gcloud/BUILD
index 7ba275f..24f9781 100644
--- a/container/ubuntu16_04/builders/bazel_docker_gcloud/BUILD
+++ b/container/ubuntu16_04/builders/bazel_docker_gcloud/BUILD
@@ -21,6 +21,7 @@
     "language_tool_layer",
     "toolchain_container",
 )
+load("@io_bazel_rules_docker//container:container.bzl", "container_image")
 load("@io_bazel_rules_docker//contrib:test.bzl", "container_test")
 load("//container/common/bazel:version.bzl", "BAZEL_VERSION_SHA256S")
 
@@ -37,13 +38,8 @@
 # Generate the container with Bazel and Docker for all supported versions of
 # Bazel.
 [toolchain_container(
-    name = "bazel_%s_docker_gcloud" % bazel_version,
+    name = "bazel_%s_docker_gcloud_intermediate" % bazel_version,
     base = "@ubuntu16_04//image",
-    cmd = [
-        "/bin/sh",
-        "-c",
-        "/bin/bash",
-    ],
     # TODO(xingao) Fix this. We should not remove /etc/ssl/certs/java/cacerts
     # file in the java-ltl, but instead, archive it for future container
     # reproduction.
@@ -61,6 +57,18 @@
     ],
 ) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
 
+# Set up `entrypoint` and cmd in the container. These cannot be down in the
+# `toolchain_container` rule as they would be consumed by intermediate
+# `container_image` rule in its implementation.
+# TODO(xingao): enable setting things like `entrypoint` and `cmd` in
+# `toolchain_container`.
+[container_image(
+    name = "bazel_%s_docker_gcloud" % bazel_version,
+    base = ":bazel_%s_docker_gcloud_intermediate" % bazel_version,
+    cmd = None,
+    entrypoint = ["/usr/local/bin/bazel"],
+) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
+
 # container_test targets for all supported bazel_docker containers..
 [container_test(
     name = "bazel_%s_docker_gcloud-test" % bazel_version,
diff --git a/container/ubuntu16_04/builders/bazel_docker_gcloud/container.yaml b/container/ubuntu16_04/builders/bazel_docker_gcloud/container.yaml
index c27a43a..082ae57 100644
--- a/container/ubuntu16_04/builders/bazel_docker_gcloud/container.yaml
+++ b/container/ubuntu16_04/builders/bazel_docker_gcloud/container.yaml
@@ -4,3 +4,5 @@
   env:
     - key: 'PATH'
       value: '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/python3.6/bin'
+  entrypoint: ["/usr/local/bin/bazel"]
+  cmd: []
diff --git a/repositories/repositories.bzl b/repositories/repositories.bzl
index 8f47e79..2248d42 100644
--- a/repositories/repositories.bzl
+++ b/repositories/repositories.bzl
@@ -54,9 +54,9 @@
     if "io_bazel_rules_docker" not in excludes:
         http_archive(
             name = "io_bazel_rules_docker",
-            sha256 = "b4775b7c4fc76e3113dab643ee35eefbabca0b44908d0d1c85dcf29cab7c0638",
-            strip_prefix = "rules_docker-c7a93454d27e09ef707dfca53887ed0ff4372f04",
-            urls = ["https://github.com/bazelbuild/rules_docker/archive/c7a93454d27e09ef707dfca53887ed0ff4372f04.tar.gz"],
+            sha256 = "78083b4664b56b23ae1baccd69cb66de8f185a8b627c22ca415e0708cf0bf7b6",
+            strip_prefix = "rules_docker-0faaa7180810ad04d41e931488c7794c18c8d7a4",
+            urls = ["https://github.com/bazelbuild/rules_docker/archive/0faaa7180810ad04d41e931488c7794c18c8d7a4.tar.gz"],
         )
 
     # io_bazel_rules_go is the dependency of container_test rules.