Add experimental trusty based Bazel container. (#170)

* Add experimental trusty based Bazel container.
diff --git a/.bazelci/presubmit.yml b/.bazelci/presubmit.yml
index 394c51d..ef2eed4 100644
--- a/.bazelci/presubmit.yml
+++ b/.bazelci/presubmit.yml
@@ -31,6 +31,7 @@
     - "//container/ubuntu16_04/builders/bazel:bazel_0.16.1-test"
     - "//container/ubuntu16_04/builders/bazel_docker_gcloud:bazel_0.16.1_docker_gcloud-test"
     - "//container/debian8/builders/bazel:bazel_0.16.1-test"
+    - "//container/ubuntu14_04/builders/bazel:bazel_0.16.1-test"
     test_flags:
     - "--test_output=errors"
     - "--verbose_failures"
diff --git a/container/build.py b/container/build.py
index d03d3a7..fa08caa 100644
--- a/container/build.py
+++ b/container/build.py
@@ -84,7 +84,7 @@
 
 SUPPORTED_TYPES = [
     "rbe-debian8", "rbe-debian9", "rbe-ubuntu16_04", "ubuntu16_04-bazel",
-    "ubuntu16_04-bazel-docker-gcloud", "debian8-bazel"
+    "ubuntu16_04-bazel-docker-gcloud", "debian8-bazel", "ubuntu14_04-bazel"
 ]
 
 # File passed in -m must include the following 3 maps
@@ -101,6 +101,7 @@
     "ubuntu16_04-bazel-docker-gcloud":
         "container/ubuntu16_04/builders/bazel_docker_gcloud",
     "debian8-bazel": "container/debian8/builders/bazel",
+    "ubuntu14_04-bazel": "container/ubuntu14_04/builders/bazel",
 }
 
 # Map to store all supported container type and the name of target to build it.
@@ -112,6 +113,7 @@
     "ubuntu16_04-bazel-docker-gcloud":
         "bazel_{}_docker_gcloud".format(LATEST_BAZEL_VERSION),
     "debian8-bazel": "bazel_{}".format(LATEST_BAZEL_VERSION),
+    "ubuntu14_04-bazel": "bazel_{}".format(LATEST_BAZEL_VERSION),
 }
 
 # Map to store all supported container type and the name of target to build it.
@@ -128,6 +130,8 @@
         "bazel_{}_docker_gcloud-packages.tar".format(LATEST_BAZEL_VERSION),
     "debian8-bazel":
          "bazel_{}-packages.tar".format(LATEST_BAZEL_VERSION),
+    "ubuntu14_04-bazel":
+        "bazel_{}-packages.tar".format(LATEST_BAZEL_VERSION),
 }
 
 # =========== ENDING HERE ===========
diff --git a/container/ubuntu14_04/BUILD b/container/ubuntu14_04/BUILD
new file mode 100644
index 0000000..8ece167
--- /dev/null
+++ b/container/ubuntu14_04/BUILD
@@ -0,0 +1,19 @@
+# Copyright 2017 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+licenses(["notice"])  # Apache 2.0
+
+package(default_visibility = ["//visibility:public"])
+
+exports_files(glob(["*.yaml"]))
diff --git a/container/ubuntu14_04/builders/bazel/BUILD b/container/ubuntu14_04/builders/bazel/BUILD
new file mode 100644
index 0000000..6c8968f
--- /dev/null
+++ b/container/ubuntu14_04/builders/bazel/BUILD
@@ -0,0 +1,65 @@
+# Copyright 2017 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+licenses(["notice"])  # Apache 2.0
+
+package(default_visibility = ["//visibility:public"])
+
+load("//container/rules:docker_toolchains.bzl", "toolchain_container")
+load("@io_bazel_rules_docker//contrib:test.bzl", "container_test")
+load("//container/common/bazel:version.bzl", "BAZEL_VERSION_SHA256S")
+
+# Generate the Bazel container for all supported versions using the
+# corresponding Bazel language_tool_layer targets.
+[toolchain_container(
+    name = "bazel_%s" % bazel_version,
+    base = "@trusty//image",
+    cmd = [
+        "/bin/sh",
+        "-c",
+        "/bin/bash",
+    ],
+    # TODO(xingao) Fix this. We should not remove /etc/ssl/certs/java/cacerts
+    # file in the java-ltl, but instead, archive it for future container
+    # reproduction.
+    installation_cleanup_commands = "update-ca-certificates -f",
+    language_layers = [
+        "//container/ubuntu14_04/layers/gcc:gcc-ltl",
+        "//container/ubuntu14_04/layers/java:java-ltl",
+        "//container/ubuntu14_04/layers/java:java10-ltl",
+        "//container/ubuntu14_04/layers/python:python-ltl",
+        "//container/ubuntu14_04/layers/bazel:bazel-tools",
+        "//container/ubuntu14_04/layers/bazel:bazel_%s-ltl" % bazel_version,
+        "//container/ubuntu14_04/layers/git:git-ltl",
+        "//container/ubuntu14_04/layers/wget:wget-ltl",
+    ],
+) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
+
+# container_test targets for all supported Bazel versions.
+[container_test(
+    name = "bazel_%s-test" % bazel_version,
+    configs = [
+        ":container.yaml",
+        "//container/common:git.yaml",
+        "//container/common:java.yaml",
+        "//container/common:python2.yaml",
+        "//container/common:wget.yaml",
+        "//container/common/bazel:bazel_tools.yaml",
+        "//container/ubuntu14_04:ubuntu14_04.yaml",
+        "//container/ubuntu14_04/layers/bazel:bazel_%s.yaml" % bazel_version,
+        "//container/ubuntu14_04/layers/gcc:gcc.yaml",
+    ],
+    image = ":bazel_%s" % bazel_version,
+    verbose = True,
+) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
diff --git a/container/ubuntu14_04/builders/bazel/container.yaml b/container/ubuntu14_04/builders/bazel/container.yaml
new file mode 100644
index 0000000..258b514
--- /dev/null
+++ b/container/ubuntu14_04/builders/bazel/container.yaml
@@ -0,0 +1,6 @@
+schemaVersion: "2.0.0"
+
+metadataTest:
+  env:
+    - key: 'PATH'
+      value: '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
diff --git a/container/ubuntu14_04/layers/bazel/BUILD b/container/ubuntu14_04/layers/bazel/BUILD
new file mode 100644
index 0000000..3495b53
--- /dev/null
+++ b/container/ubuntu14_04/layers/bazel/BUILD
@@ -0,0 +1,80 @@
+# Copyright 2017 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+licenses(["notice"])  # Apache 2.0
+
+package(default_visibility = ["//visibility:public"])
+
+load("//container/rules:docker_toolchains.bzl", "language_tool_layer")
+load("//container/rules:docker_toolchains.bzl", "toolchain_container")
+load("@base_images_docker//util:run.bzl", "container_run_and_extract")
+load(
+    "//container/common/bazel:version.bzl",
+    "BAZEL_VERSION_SHA256S",
+)
+
+exports_files(glob(["*.yaml"]))
+
+# Tools required by Bazel. Note that we do not add a CC complier here as we
+# will include that in the final container.
+language_tool_layer(
+    name = "bazel-tools",
+    base = "@trusty//image",
+    packages = [
+        "bash-completion",
+        "binutils",
+        "patch",
+        "unzip",
+        "zip",
+    ],
+)
+
+# Create image with Bazel installer for all supported versions.
+[toolchain_container(
+    name = "bazel_%s_installer_image" % bazel_version,
+    base = "@trusty//image",
+    files = [
+        "@bazel_%s_installer//file" % bazel_version.replace(".", ""),
+    ],
+    packages = [
+        "unzip",
+    ],
+) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
+
+# Extract Bazel binaries for all supported versions.
+[container_run_and_extract(
+    name = "bazel_%s_tar" % bazel_version,
+    commands = [
+        "chmod +x /bazel-%s-installer-linux-x86_64.sh" % bazel_version,
+        "/bazel-%s-installer-linux-x86_64.sh" % bazel_version,
+        "tar cvf /bazel.tar --mtime='1970-01-01' /usr/local/bin/bazel /usr/local/lib/bazel/*",
+    ],
+    extract_file = "/bazel.tar",
+    image = ":bazel_%s_installer_image.tar" % bazel_version,
+) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
+
+# Language_tool_layer targets for all supported Bazel versions.
+[language_tool_layer(
+    name = "bazel_%s-ltl" % bazel_version,
+    base = "@trusty//image",
+    tars = [":bazel_%s_tar" % bazel_version],
+) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
+
+# Generate Bazel container testing yaml files with all supported Bazel versions.
+[genrule(
+    name = "generate_bazel_%s_yaml" % bazel_version,
+    srcs = [":bazel.yaml.tpl"],
+    outs = ["bazel_%s.yaml" % bazel_version],
+    cmd = "sed 's|{_BAZEL_VERSION}|" + bazel_version + "|' <$< >$@ ",
+) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
diff --git a/container/ubuntu14_04/layers/bazel/bazel.yaml.tpl b/container/ubuntu14_04/layers/bazel/bazel.yaml.tpl
new file mode 100644
index 0000000..e391955
--- /dev/null
+++ b/container/ubuntu14_04/layers/bazel/bazel.yaml.tpl
@@ -0,0 +1,7 @@
+schemaVersion: "2.0.0"
+
+commandTests:
+- name: 'check-bazel'
+  command: 'bazel'
+  args: ['version']
+  expectedOutput: ['Build label: {_BAZEL_VERSION}']
diff --git a/container/ubuntu14_04/layers/gcc/BUILD b/container/ubuntu14_04/layers/gcc/BUILD
new file mode 100644
index 0000000..4d6ab68
--- /dev/null
+++ b/container/ubuntu14_04/layers/gcc/BUILD
@@ -0,0 +1,32 @@
+# Copyright 2017 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+licenses(["notice"])  # Apache 2.0
+
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "//container/rules:docker_toolchains.bzl",
+    "language_tool_layer",
+)
+
+exports_files(glob(["*.yaml"]))
+
+language_tool_layer(
+    name = "gcc-ltl",
+    base = "@trusty//image",
+    packages = [
+        "g++",
+    ],
+)
diff --git a/container/ubuntu14_04/layers/gcc/gcc.yaml b/container/ubuntu14_04/layers/gcc/gcc.yaml
new file mode 100644
index 0000000..bc1d68c
--- /dev/null
+++ b/container/ubuntu14_04/layers/gcc/gcc.yaml
@@ -0,0 +1,7 @@
+schemaVersion: "2.0.0"
+
+commandTests:
+- name: 'check-g++'
+  command: 'g++'
+  args: ['--version']
+  expectedOutput: ['g[+][+] [(]Ubuntu .*']
diff --git a/container/ubuntu14_04/layers/git/BUILD b/container/ubuntu14_04/layers/git/BUILD
new file mode 100644
index 0000000..61e19f8
--- /dev/null
+++ b/container/ubuntu14_04/layers/git/BUILD
@@ -0,0 +1,27 @@
+# Copyright 2017 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+licenses(["notice"])  # Apache 2.0
+
+package(default_visibility = ["//visibility:public"])
+
+load("//container/rules:docker_toolchains.bzl", "language_tool_layer")
+
+language_tool_layer(
+    name = "git-ltl",
+    base = "@trusty//image",
+    packages = [
+        "git",
+    ],
+)
diff --git a/container/ubuntu14_04/layers/java/BUILD b/container/ubuntu14_04/layers/java/BUILD
new file mode 100644
index 0000000..6a545f1
--- /dev/null
+++ b/container/ubuntu14_04/layers/java/BUILD
@@ -0,0 +1,61 @@
+# Copyright 2017 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+licenses(["notice"])  # Apache 2.0
+
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "//container/rules:docker_toolchains.bzl",
+    "language_tool_layer",
+)
+
+JAVA_CLEANUP_COMMANDS = (
+    "rm -rf " +
+    "/etc/ssl/certs/java/cacerts " +
+    "/tmp/hsperfdata_root/* " +
+    "/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/amd64/server/classes.jsa"
+)
+
+language_tool_layer(
+    name = "java-ltl",
+    additional_repos = [
+        "deb [arch=amd64] http://ppa.launchpad.net/openjdk-r/ppa/ubuntu/ trusty main",
+    ],
+    base = "@trusty//image",
+    env = {
+        "JAVA_HOME": "/usr/lib/jvm/java-8-openjdk-amd64",
+    },
+    installation_cleanup_commands = JAVA_CLEANUP_COMMANDS,
+    keys = [
+        "@launchpad_openjdk_gpg//file",
+    ],
+    packages = [
+        "ca-certificates-java",
+        "openjdk-8-jdk-headless",
+        "openjdk-8-jre-headless",
+    ],
+    symlinks = {
+        "/usr/bin/java": "/usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java",
+    },
+)
+
+language_tool_layer(
+    name = "java10-ltl",
+    base = "@trusty//image",
+    tars = [
+        "//third_party/openjdk:open_jdk_tar",
+        "//third_party/openjdk:open_jdk_src_tar",
+    ],
+)
diff --git a/container/ubuntu14_04/layers/python/BUILD b/container/ubuntu14_04/layers/python/BUILD
new file mode 100644
index 0000000..5096284
--- /dev/null
+++ b/container/ubuntu14_04/layers/python/BUILD
@@ -0,0 +1,38 @@
+# Copyright 2017 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+licenses(["notice"])  # Apache 2.0
+
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "//container/rules:docker_toolchains.bzl",
+    "language_tool_layer",
+)
+
+PYTHON_CLEANUP_COMMANDS = (
+    "find /usr/lib/python* -name __pycache__ -exec rm -rf {} +"
+)
+
+language_tool_layer(
+    name = "python-ltl",
+    base = "@trusty//image",
+    installation_cleanup_commands = PYTHON_CLEANUP_COMMANDS,
+    packages = [
+        "python-dev",
+    ],
+    symlinks = {
+        "/usr/bin/python": "/usr/bin/python2.7",
+    },
+)
diff --git a/container/ubuntu14_04/layers/wget/BUILD b/container/ubuntu14_04/layers/wget/BUILD
new file mode 100644
index 0000000..00fde62
--- /dev/null
+++ b/container/ubuntu14_04/layers/wget/BUILD
@@ -0,0 +1,28 @@
+# Copyright 2017 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+licenses(["notice"])  # Apache 2.0
+
+package(default_visibility = ["//visibility:public"])
+
+load("//container/rules:docker_toolchains.bzl", "language_tool_layer")
+
+language_tool_layer(
+    name = "wget-ltl",
+    base = "@trusty//image",
+    packages = [
+        "ca-certificates",
+        "wget",
+    ],
+)
diff --git a/container/ubuntu14_04/ubuntu14_04.yaml b/container/ubuntu14_04/ubuntu14_04.yaml
new file mode 100644
index 0000000..9bbb8ca
--- /dev/null
+++ b/container/ubuntu14_04/ubuntu14_04.yaml
@@ -0,0 +1,7 @@
+schemaVersion: "2.0.0"
+
+# Distro-specific tests
+fileContentTests:
+- name: 'os-version'
+  expectedContents: ['Ubuntu 14.04.* LTS']
+  path: '/etc/issue.net'
diff --git a/repositories/images.bzl b/repositories/images.bzl
index 2d15756..8bd7071 100644
--- a/repositories/images.bzl
+++ b/repositories/images.bzl
@@ -136,3 +136,13 @@
             registry = "l.gcr.io",
             repository = "google/clang-ubuntu",
         )
+
+    # Note that we pull trusty base from "index.docker.io" registry and not from
+    # "marketplace.gcr.io" as we do for other base images.
+    if "trusty" not in excludes:
+        container_pull(
+            name = "trusty",
+            registry = "index.docker.io",
+            repository = "library/ubuntu",
+            tag = "14.04",
+        )
diff --git a/repositories/repositories.bzl b/repositories/repositories.bzl
index e689bc0..8f47e79 100644
--- a/repositories/repositories.bzl
+++ b/repositories/repositories.bzl
@@ -116,6 +116,14 @@
             urls = ["https://packages.cloud.google.com/apt/doc/apt-key.gpg"],
         )
 
+    # Launchpad OpenJDK key used when install java in trusty.
+    if "launchpad_openjdk_gpg" not in excludes:
+        native.http_file(
+            name = "launchpad_openjdk_gpg",
+            sha256 = "54b6274820df34a936ccc6f5cb725a9b7bb46075db7faf0ef7e2d86452fa09fd",
+            url = "http://keyserver.ubuntu.com/pks/lookup?op=get&fingerprint=on&search=0xEB9B1D8886F44E2A",
+        )
+
     # =============================== Toolchains ===============================
     # Golang
     if "golang_release" not in excludes: