diff --git a/WORKSPACE b/WORKSPACE
index 48b6657..dcf8f28 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -22,9 +22,9 @@
 # https://docs.bazel.build/versions/master/be/workspace.html#git_repository
 http_archive(
     name = "io_bazel_rules_docker",
-    sha256 = "bc2182a51e19bf1fe5c3c33636b3e2827fac7be34af07690f9d612ca9bf31c3b",
-    strip_prefix = "rules_docker-4d49182a85c745065e621c145238c5e9420ed91b",
-    urls = ["https://github.com/bazelbuild/rules_docker/archive/4d49182a85c745065e621c145238c5e9420ed91b.tar.gz"],
+    sha256 = "d2e6408b8f8b03ad1f2172acadf979204dedd0423c5194a82a1301cc6d1c224b",
+    strip_prefix = "rules_docker-17f2587dc58642cd494b9d56890e6210f406380d",
+    urls = ["https://github.com/bazelbuild/rules_docker/archive/17f2587dc58642cd494b9d56890e6210f406380d.tar.gz"],
 )
 
 load(
diff --git a/container/debian8-clang-fully-loaded/BUILD b/container/debian8-clang-fully-loaded/BUILD
index a16aa31..7080e11 100644
--- a/container/debian8-clang-fully-loaded/BUILD
+++ b/container/debian8-clang-fully-loaded/BUILD
@@ -43,9 +43,9 @@
     env = {
         # PATH envvar is a special case, and currently only the one in the
         # topmost layer is set. So that we override it here to include all.
-        "PATH": "/usr/local/go/bin:/opt/python3.6/bin:$PATH",
+        "PATH": "/opt/python3.6/bin:/usr/local/go/bin:$PATH",
     },
-    layers = [
+    language_layers = [
         "base-ltl",
         "clang-ltl",
         "go-ltl",
@@ -118,6 +118,6 @@
 
 container_test(
     name = "fl-toolchain-test",
-    configs = ["test.yaml"],
+    configs = ["//container/test:rbe-debian8.yaml"],
     image = ":fl-toolchain",
 )
diff --git a/container/experimental/rbe-debian8/BUILD b/container/experimental/rbe-debian8/BUILD
new file mode 100644
index 0000000..92b0437
--- /dev/null
+++ b/container/experimental/rbe-debian8/BUILD
@@ -0,0 +1,113 @@
+# Copyright 2017 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+licenses(["notice"])  # Apache 2.0
+
+package(default_visibility = ["//visibility:public"])
+
+load("@distroless//cacerts:cacerts.bzl", "cacerts")
+load("@jessie_package_bundle//file:packages.bzl", "packages")
+load(
+    "//skylib:packages.bzl",
+    "base_layer_packages",
+    "clang_layer_packages",
+    "java_layer_packages",
+    "python_layer_packages",
+)
+load("@io_bazel_rules_docker//contrib:test.bzl", "container_test")
+load(
+    "@io_bazel_rules_docker//container:container.bzl",
+    "container_image",
+    "container_layer",
+)
+
+cacerts(
+    name = "cacerts",
+    deb = packages["ca-certificates"],
+)
+
+container_image(
+    name = "fl-toolchain",
+    base = "@debian8//image",
+    layers = [
+        "base-ltl",
+        "clang-ltl",
+        "go-ltl",
+        "java-ltl",
+        "python-ltl",
+    ],
+    tags = ["manual"],
+)
+
+container_layer(
+    name = "base-ltl",
+    debs = base_layer_packages(),
+    tags = ["manual"],
+    tars = [
+        ":cacerts.tar",
+    ],
+)
+
+container_layer(
+    name = "clang-ltl",
+    debs = clang_layer_packages(),
+    env = {
+        "CC": "/usr/local/bin/clang",
+    },
+    tags = ["manual"],
+    tars = ["//third_party/clang:tar"],
+)
+
+container_layer(
+    name = "go-ltl",
+    env = {
+        "GOPATH": "/go",
+        "PATH": "/usr/local/go/bin:$PATH",
+    },
+    tags = ["manual"],
+    tars = ["//third_party/golang:tar"],
+)
+
+container_layer(
+    name = "java-ltl",
+    debs = java_layer_packages(),
+    env = {
+        "JAVA_HOME": "/usr/lib/jvm/java-8-openjdk-amd64",
+    },
+    symlinks = {
+        "/usr/bin/java": "/usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java",
+    },
+    tags = ["manual"],
+)
+
+container_layer(
+    name = "python-ltl",
+    debs = python_layer_packages(),
+    env = {
+        "PATH": "/opt/python3.6/bin:$PATH",
+    },
+    symlinks = {
+        "/usr/bin/python": "/usr/bin/python2.7",
+        "/opt/python3.6/bin/python3": "/opt/python3.6/bin/python3.6",
+        "/opt/python3.6/bin/pip3": "/opt/python3.6/bin/pip3.6",
+    },
+    tags = ["manual"],
+    tars = ["//third_party/python:tar"],
+)
+
+container_test(
+    name = "fl-toolchain-test",
+    configs = ["//container/test:rbe-debian8.yaml"],
+    image = ":fl-toolchain",
+)
diff --git a/container/rules/docker_toolchains.bzl b/container/rules/docker_toolchains.bzl
index 418ded8..468430b 100644
--- a/container/rules/docker_toolchains.bzl
+++ b/container/rules/docker_toolchains.bzl
@@ -76,7 +76,7 @@
   symlinks = {}
   # TODO(ngiraldo): we rewrite env and symlinks if there are conficts,
   # warn the user of conflicts or error out.
-  for layer in ctx.attr.layers:
+  for layer in ctx.attr.language_layers:
     debs.extend(layer.debs)
     tars.extend(layer.tars)
     files.extend(layer.input_files)
@@ -92,7 +92,7 @@
 
 toolchain_container_ = rule(
     attrs = _container.image.attrs + {
-        "layers": attr.label_list(),
+        "language_layers": attr.label_list(),
     },
     executable = True,
     outputs = _container.image.outputs,
diff --git a/container/test/BUILD b/container/test/BUILD
new file mode 100644
index 0000000..263db40
--- /dev/null
+++ b/container/test/BUILD
@@ -0,0 +1,19 @@
+# Copyright 2017 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+licenses(["notice"])  # Apache 2.0
+
+package(default_visibility = ["//visibility:public"])
+
+exports_files(glob(["**"]))
diff --git a/container/debian8-clang-fully-loaded/test.yaml b/container/test/rbe-debian8.yaml
similarity index 82%
rename from container/debian8-clang-fully-loaded/test.yaml
rename to container/test/rbe-debian8.yaml
index 6f8ee0c..7a34884 100644
--- a/container/debian8-clang-fully-loaded/test.yaml
+++ b/container/test/rbe-debian8.yaml
@@ -1,9 +1,21 @@
 schemaVersion: "1.0.0"
 
 commandTests:
-- name: 'path'
+- name: 'path-envvar'
   command: ['sh', '-c', 'echo $PATH']
-  expectedOutput: ['/usr/local/go/bin:/opt/python3.6/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin']
+  expectedOutput: ['/opt/python3.6/bin:/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin']
+- name: 'cc-envvar'
+  command: ['sh', '-c', 'echo $CC']
+  expectedOutput: ['/usr/local/bin/clang']
+- name: 'javahome-envvar'
+  command: ['sh', '-c', 'echo $JAVA_HOME']
+  expectedOutput: ['/usr/lib/jvm/java-8-openjdk-amd64']
+- name: 'gopath-envvar'
+  command: ['sh', '-c', 'echo $GOPATH']
+  expectedOutput: ['/go']
+- name: 'python3-version'
+  command: ['python3', '-V']
+  expectedOutput: ['Python 3.6.2']
 
 fileExistenceTests:
 - name: 'Root'