diff --git a/container/debian8-clang-fully-loaded/BUILD b/container/debian8-clang-fully-loaded/BUILD
index 0305a36..d3acab4 100644
--- a/container/debian8-clang-fully-loaded/BUILD
+++ b/container/debian8-clang-fully-loaded/BUILD
@@ -110,4 +110,5 @@
         "/usr/bin/python": "/usr/bin/python2.7",
     },
     tags = ["manual"],
+    tars = ["//third_party/python:tar"],
 )
diff --git a/container/debian8-clang-fully-loaded/cloudbuild.yaml b/container/debian8-clang-fully-loaded/cloudbuild.yaml
index ac910d0..8c522c4 100644
--- a/container/debian8-clang-fully-loaded/cloudbuild.yaml
+++ b/container/debian8-clang-fully-loaded/cloudbuild.yaml
@@ -35,7 +35,7 @@
   -  name: "py-build-container"
      args: ['cp', '/tmp/py.tar.gz', 'py.tar.gz']
      id: copy-py
-     dir: '${_DIR}'
+     dir: 'third_party/python'
      waitFor:
      - 'build-py'
 
@@ -65,6 +65,12 @@
     waitFor: # wait for all artifacts to be ready
     - 'fl-container'
 
+# Step: test the image
+  - name: gcr.io/gcp-runtimes/structure_test
+    args: [
+    '--image', 'gcr.io/${_PROJECT}/${_CONTAINER}:${_TAG}',
+    '--config', '/workspace/container/debian8-clang-fully-loaded/test.yaml']
+
 # Build the release-container
 images:
   - 'gcr.io/${_PROJECT}/${_CONTAINER}:${_TAG}'
diff --git a/container/debian8-clang-fully-loaded/test.yaml b/container/debian8-clang-fully-loaded/test.yaml
new file mode 100644
index 0000000..4b75224
--- /dev/null
+++ b/container/debian8-clang-fully-loaded/test.yaml
@@ -0,0 +1,30 @@
+commandTests:
+- name: 'path'
+  command: 'sh'
+  args: ['-c', 'echo $PATH']
+  expectedOutput: ['/usr/local/go/bin:/opt/python3.6/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin']
+fileExistenceTests:
+- name: 'Root'
+  isDirectory: true
+  path: '/'
+  shouldExist: true
+- name: 'Clang'
+  isDirectory: false
+  path: '/usr/local/bin/clang'
+  shouldExist: true
+- name: 'OpenJDK'
+  isDirectory: true
+  path: '/usr/lib/jvm/java-8-openjdk-amd64'
+  shouldExist: true
+- name: 'Python2'
+  isDirectory: false
+  path: '/usr/bin/python2.7'
+  shouldExist: true
+- name: 'Python3'
+  isDirectory: false
+  path: '/opt/python3.6/bin/python3'
+  shouldExist: true
+- name: 'Golang'
+  isDirectory: false
+  path: '/usr/local/go/bin/go'
+  shouldExist: true
diff --git a/third_party/python/BUILD b/third_party/python/BUILD
new file mode 100644
index 0000000..97f0d04
--- /dev/null
+++ b/third_party/python/BUILD
@@ -0,0 +1,39 @@
+# Copyright 2017 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This BUILD file is used for installing clang.tar.gz into /usr/local
+# of debian8-clang-fully-loaded container. The clang.tar.gz file was
+# downloaded by gsutil_cp rule in the WORKSPACE file, and contains
+# the same compiled clang binary as in
+# https://console.cloud.google.com/launcher/details/google/clang-debian8
+
+licenses(["notice"])  # Apache 2.0
+
+package(default_visibility = ["//visibility:public"])
+
+load("@bazel_tools//tools/build_defs/pkg:pkg.bzl", "pkg_tar")
+
+# py.tar.gz contains python3.6, and was generated from
+# container/debian8-clang-fully-loaded/Dockerfile.py.build
+# This target is broken if executed directly and needs to run from
+# container/debian8-clang-fully-loaded/cloud.yaml as it creates the py.tar.gz file
+# TODO(yiyu): better way for fetching python3.6 release from docker image
+pkg_tar(
+    name = "tar",
+    srcs = glob(["**/*"]),
+    package_dir = "/",
+    strip_prefix = ".",
+    tags = ["manual"],
+    deps = [":py.tar.gz"],
+)