Google Git
Sign in
opensecura/3p/openxla/iree/f941efb95dafb3ef4ba5cf6fbff0e247318b39de^!/./build_tools/docker
commit
f941efb95dafb3ef4ba5cf6fbff0e247318b39de
[log] [tgz]
author
Geoffrey Martin-Noble <gcmn@google.com>
Tue Sep 15 13:16:05 2020 -0700
committer
GitHub <noreply@github.com>
Tue Sep 15 13:16:05 2020 -0700
tree
b3a7f6c4af2f3c38ff0d1c904b32015d7922ec2e
parent
b7d57107257fa97b286333a85caca2da86f90b10 [diff]
Multistage docker containers with RBE swiftshader support (#3065)

Refactors Docker setup to enable multistage builds and fully support
Vulkan.

1. Vulkan is now supported in all our build configurations and
IREE_VULKAN_DISABLE is set to false in all build scripts.
2. Our docker containers use multi-stage builds to reduce duplication
and image size.
3. Directory names match image names rather than having arbitrary
underscore/dash distinction (I kept mistyping this).

New vs old images:
https://gist.github.com/GMNGeoffrey/6ea51a6035f3eb8fac11ff4bdbd6edc0

Fixes https://github.com/google/iree/issues/2651
diff --git a/build_tools/docker/README.md b/build_tools/docker/README.md
new file mode 100644
index 0000000..f6fabef
--- /dev/null
+++ b/build_tools/docker/README.md

@@ -0,0 +1,107 @@
+# IREE Docker Configuration
+
+This directory contains the Dockerfiles that specify the container images used
+for IREE. Images are uploaded to
+[Google Container Registry (GCR)](https://cloud.google.com/container-registry).
+
+To build an image, use `docker build`, e.g.:
+
+```shell
+docker build build_tools/docker/cmake --tag cmake
+```
+
+To explore an image interactively, use `docker run`, e.g.
+
+```shell
+docker run --interactive --tty --rm cmake
+```
+
+You can find more information in the
+[official Docker docs](https://docs.docker.com/get-started/overview/).
+
+
+## Multi-stage Builds
+
+We use
+[multi-stage builds](https://docs.docker.com/develop/develop-images/multistage-build/)
+to limit duplication in our Dockerfiles and reduce the final image size. There
+is still duplication in cases where it's difficult to determine the correct
+files to copy.
+
+
+## Dependencies Between Images
+
+IREE images follow a consistent structure. The image defined by
+`build_tools/docker/foo-bar/Dockerfile` is uploaded to GCR as
+`gcr.io/iree-oss/foo-bar`. It may be tagged as `latest` or `prod`, e.g.
+`gcr.io/iree-oss/foo-bar:latest`. Dockerfile image definitions should list their
+dependencies based on these image names.
+
+We use a helper python script to manage the Docker image deployment. It lists
+all images and their dependencies and manages their canonical registry
+location. When creating a new image, add it to this mapping. To build an image
+and all images it depends on:
+
+```shell
+python3 build_tools/docker/manage_images.py --build --image cmake
+```
+
+To build multiple images
+
+```shell
+python3 build_tools/docker/manage_images.py --build --image cmake --image bazel
+```
+
+There is also the special option `--image all` to build all registered images.
+
+Pushing images to GCR requires the `Storage Admin` role in the `iree-oss` GCP
+project. To push these images to GCR with the `latest` tag:
+
+```shell
+python3 build_tools/docker/manage_images.py --image cmake --push
+```
+
+Kokoro build scripts and RBE configuration refer to images by their repository
+digest. You can update references to the digest:
+
+```shell
+python3 build_tools/docker/manage_images.py --images all --tag latest --update_references
+```
+
+This requires that the tagged image have a repository digest, which means it was
+pushed to or pulled from GCR.
+
+
+## Deploying New Images
+
+1. Modify the Dockerfiles as desired.
+2. Update `manage_images.py` to include the new image and its dependencies.
+3. Build and push the new image to GCR and update references to it:
+
+  ```shell
+  python3 build_tools/docker/manage_images.py --image "${IMAGE?}" --build --push --update_references
+  ```
+
+4. Commit changes and send a PR for review.
+5. Merge your PR after is approved and all builds pass.
+6. Kokoro builds preload images tagged with `prod` on VM creation, so after
+   changing the images used, you should also update the images tagged as `prod`
+   in GCR. Update your local reference to the `prod` tag to point at the new
+   image:
+
+  ```shell
+  python3 build_tools/docker/manage_images.py --image "${IMAGE?}" --tag prod --build --update_references
+  ```
+
+  The build steps here should all be cache hits and no references should
+  actually be changed. If they are, that indicates the images you've just built
+  are different from the ones that are being referenced. Stop and fix this
+  before proceeding. This relies on you keeping your local copy of the Docker
+  images. If you didn't, you'll have to manually pull the missing images by
+  their digest.
+
+7. Push the new images with the `prod` tag to GCR.
+
+   ```shell
+  python3 build_tools/docker/manage_images.py --image "${IMAGE?}" --tag prod --push
+  ```

diff --git a/build_tools/docker/base/Dockerfile b/build_tools/docker/base/Dockerfile
new file mode 100644
index 0000000..ea85143
--- /dev/null
+++ b/build_tools/docker/base/Dockerfile

@@ -0,0 +1,29 @@
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+FROM ubuntu:18.04 AS final
+
+# Environment variables for IREE.
+ENV CC /usr/bin/clang
+ENV CXX /usr/bin/clang++
+ENV IREE_LLVMAOT_LINKER_PATH /usr/bin/ld
+
+RUN apt-get update \
+  && apt-get install -y \
+    # For updating IREE's submodules.
+    git \
+    # Core IREE dependencies.
+    clang \
+    libsdl2-dev \
+    libssl-dev

diff --git a/build_tools/docker/bazel_bindings/Dockerfile b/build_tools/docker/bazel-python/Dockerfile
similarity index 63%
rename from build_tools/docker/bazel_bindings/Dockerfile
rename to build_tools/docker/bazel-python/Dockerfile
index 8f07958..11c35ab 100644
--- a/build_tools/docker/bazel_bindings/Dockerfile
+++ b/build_tools/docker/bazel-python/Dockerfile

@@ -12,19 +12,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# An image for building IREE with python bindings using bazel.
+# An image for building IREE with Python bindings using Bazel.
 
-# Build using:
-# docker build --tag gcr.io/iree-oss/bazel-bindings \
-#   build_tools/docker/bazel_bindings/
-
-# Run interactively using the following, where IREE_WORKDIR is the path to your
-# local dev environment:
-# docker run -it --rm --entrypoint bash --volume ${IREE_WORKDIR}:/usr/src/iree/ \
-#   gcr.io/iree-oss/bazel-bindings
-
-# Set up the image and working directory.
-FROM gcr.io/iree-oss/bazel
+FROM gcr.io/iree-oss/bazel AS final
 
 # Install python3 and numpy.
 RUN apt-get update \
@@ -35,3 +25,5 @@
     python3-setuptools \
   && python3 -m pip install --upgrade pip \
   && python3 -m pip install numpy
+
+ENV PYTHON_BIN /usr/bin/python3

diff --git a/build_tools/docker/bazel-tensorflow-nvidia/Dockerfile b/build_tools/docker/bazel-tensorflow-nvidia/Dockerfile
new file mode 100644
index 0000000..a9b4cf4
--- /dev/null
+++ b/build_tools/docker/bazel-tensorflow-nvidia/Dockerfile

@@ -0,0 +1,21 @@
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# An image for building IREE with TensorFlow integrations using Bazel and
+# running Vulkan tests on an Nvidia GPU.
+
+FROM gcr.io/iree-oss/bazel-tensorflow-vulkan AS final
+
+RUN apt-get update \
+  && DEBIAN_FRONTEND=noninteractive apt-get install -y vulkan-sdk nvidia-driver-440

diff --git a/build_tools/docker/bazel-tensorflow-swiftshader/Dockerfile b/build_tools/docker/bazel-tensorflow-swiftshader/Dockerfile
new file mode 100644
index 0000000..b2c16e3
--- /dev/null
+++ b/build_tools/docker/bazel-tensorflow-swiftshader/Dockerfile

@@ -0,0 +1,23 @@
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# An image for building IREE with TensorFlow integrations using Bazel and
+# running Vulkan tests on SwiftShader.
+
+FROM gcr.io/iree-oss/bazel-tensorflow-vulkan AS final
+
+COPY --from=gcr.io/iree-oss/swiftshader swiftshader/ swiftshader/
+
+# Set VK_ICD_FILENAMES so Vulkan loader can find the SwiftShader ICD.
+ENV VK_ICD_FILENAMES /swiftshader/vk_swiftshader_icd.json

diff --git a/build_tools/docker/cmake_vulkan/Dockerfile b/build_tools/docker/bazel-tensorflow-vulkan/Dockerfile
similarity index 67%
copy from build_tools/docker/cmake_vulkan/Dockerfile
copy to build_tools/docker/bazel-tensorflow-vulkan/Dockerfile
index f2cdee6..849a32c 100644
--- a/build_tools/docker/cmake_vulkan/Dockerfile
+++ b/build_tools/docker/bazel-tensorflow-vulkan/Dockerfile

@@ -12,24 +12,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# An image with Vulkan SDK for building IREE using CMake.
+# A base image for building IREE with TensorFlow integrations using Bazel and
+# running Vulkan tests. Requires a child image to provide a Vulkan ICD.
 
-# Build using:
-# docker build --tag gcr.io/iree-oss/cmake-vulkan \
-#   build_tools/docker/cmake_vulkan/
+FROM gcr.io/iree-oss/bazel-tensorflow AS final
 
-# Run interactively using the following, where IREE_WORKDIR is the path to your
-# local dev environment:
-# docker run -it --rm --entrypoint bash \
-#   --volume "${IREE_WORKDIR?}:/usr/src/iree/" \
-#   --gpus all \
-#   gcr.io/iree-oss/cmake-vulkan
-
-# Set up the image and working directory by inheriting the base
-# CMake configuration.
-FROM gcr.io/iree-oss/cmake
-
-# Additionally, we need to install the Vulkan SDK.
+RUN apt-get update && apt-get install -y wget
 
 ARG VULKAN_SDK_VERSION=1.2.141
 

diff --git a/build_tools/docker/bazel-tensorflow/Dockerfile b/build_tools/docker/bazel-tensorflow/Dockerfile
new file mode 100644
index 0000000..a9dd7fb
--- /dev/null
+++ b/build_tools/docker/bazel-tensorflow/Dockerfile

@@ -0,0 +1,20 @@
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# An image for building IREE with TensorFlow integrations using Bazel.
+
+FROM gcr.io/iree-oss/bazel-python AS final
+
+# Install tensorflow.
+RUN python3 -m pip install tf-nightly

diff --git a/build_tools/docker/bazel/Dockerfile b/build_tools/docker/bazel/Dockerfile
index c42521a..a012e71 100644
--- a/build_tools/docker/bazel/Dockerfile
+++ b/build_tools/docker/bazel/Dockerfile

@@ -14,36 +14,14 @@
 
 # An image for building IREE using bazel.
 
-# Build using:
-# docker build --tag gcr.io/iree-oss/bazel build_tools/docker/bazel/
+ARG BAZEL_VERSION=3.3.1
+# Change to a new version if upgrading Bazel.
+ARG NEW_BAZEL_VERSION=3.3.1
 
-# Run interactively using the following, where IREE_WORKDIR is the path to your
-# local dev environment:
-# docker run -it --rm --entrypoint bash \
-#   --volume "${IREE_WORKDIR?}:/usr/src/iree/" \
-#   gcr.io/iree-oss/bazel
-
-# Set up the image and working directory.
-FROM ubuntu:18.04
-WORKDIR /usr/src/iree
-
-# Set environment variables.
-ENV CXX clang++
-ENV CC clang
-ENV PYTHON_BIN /usr/bin/python3
-ENV IREE_LLVMAOT_LINKER_PATH /usr/bin/ld
-
-RUN apt-get update \
-  && apt-get install -y \
-    # git for updating IREE's submodules.
-    git \
-    # utilities for later installations
-    unzip \
-    zip \
-    wget \
-    # core IREE dependencies.
-    clang \
-    libsdl2-dev
+FROM gcr.io/iree-oss/util AS install-bazel
+WORKDIR /install-bazel
+ARG BAZEL_VERSION
+ARG NEW_BAZEL_VERSION
 
 # Disable apt-key parse waring. If someone knows how to do whatever the "proper"
 # thing is then feel free. The warning complains about parsing apt-key output,
@@ -52,9 +30,6 @@
 
 # Install Bazel.
 # https://docs.bazel.build/versions/master/install-ubuntu.html
-ARG BAZEL_VERSION=3.3.1
-# Change to a new version if upgrading Bazel.
-ARG NEW_BAZEL_VERSION=3.3.1
 RUN wget -qO - https://bazel.build/bazel-release.pub.gpg | apt-key add - \
   && echo "deb [arch=amd64] https://storage.googleapis.com/bazel-apt stable jdk1.8" \
     | tee /etc/apt/sources.list.d/bazel.list \
@@ -65,7 +40,17 @@
   # your .bazelversion file. When upgrading, we therefore need to have both the
   # old and new version. When the versions are the same this second installation
   # is effectively a noop.
-  && apt-get install "bazel=${BAZEL_VERSION?}" "bazel-${NEW_BAZEL_VERSION?}"
+  && apt-get install -y "bazel=${BAZEL_VERSION?}" "bazel-${NEW_BAZEL_VERSION?}"
+
+FROM gcr.io/iree-oss/base AS final
+ARG BAZEL_VERSION
+ARG NEW_BAZEL_VERSION
+COPY --from=install-bazel \
+  /usr/bin/bazel \
+  "/usr/bin/bazel-${BAZEL_VERSION}" \
+  "/usr/bin/bazel-${NEW_BAZEL_VERSION}" \
+  /usr/bin/bazel-real \
+  /usr/bin/
 
 # TF requires python2 numpy at configure time...
 # TODO(#1737): Remove this

diff --git a/build_tools/docker/bazel_nvidia/Dockerfile b/build_tools/docker/bazel_nvidia/Dockerfile
deleted file mode 100644
index 86305c4..0000000
--- a/build_tools/docker/bazel_nvidia/Dockerfile
+++ /dev/null

@@ -1,46 +0,0 @@
-# Copyright 2020 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# An image for building IREE's tensorflow integrations using bazel and vulkan.
-
-# Build using:
-# docker build --tag gcr.io/iree-oss/bazel-nvidia \
-#   build_tools/docker/bazel_nvidia/
-
-# Run interactively using the following, where IREE_WORKDIR is the path to your
-# local dev environment:
-# docker run -it --rm --entrypoint bash --volume ${IREE_WORKDIR}:/usr/src/iree/ \
-#   gcr.io/iree-oss/bazel-nvidia
-
-# Set up the image and working directory.
-# We start from bazel-nvidia so this image can be used to testing TensorFlow
-# integrations.
-FROM gcr.io/iree-oss/bazel-tensorflow
-
-# Additionally, we need to install the Vulkan SDK and the NVIDIA Vulkan driver.
-
-ARG VULKAN_SDK_VERSION=1.2.141
-
-# Disable apt-key parse waring. If someone knows how to do whatever the "proper"
-# thing is then feel free. The warning complains about parsing apt-key output,
-# which we're not even doing.
-ARG APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=1
-
-RUN wget -qO - http://packages.lunarg.com/lunarg-signing-key-pub.asc \
-    | apt-key add - \
-  && wget -qO \
-    "/etc/apt/sources.list.d/lunarg-vulkan-${VULKAN_SDK_VERSION?}-bionic.list" \
-    "http://packages.lunarg.com/vulkan/${VULKAN_SDK_VERSION?}/lunarg-vulkan-${VULKAN_SDK_VERSION?}-bionic.list" \
-  && apt-get update \
-  && DEBIAN_FRONTEND=noninteractive apt-get install -y vulkan-sdk nvidia-driver-440

diff --git a/build_tools/docker/bazel_swiftshader/Dockerfile b/build_tools/docker/bazel_swiftshader/Dockerfile
deleted file mode 100644
index 2af027d..0000000
--- a/build_tools/docker/bazel_swiftshader/Dockerfile
+++ /dev/null

@@ -1,92 +0,0 @@
-# Copyright 2020 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# An image for building IREE with tensorflow integrations using bazel and
-# running Vulkan tests on SwiftShader.
-
-# Build using:
-# docker build --tag gcr.io/iree-oss/bazel-swiftshader \
-#   build_tools/docker/bazel_swiftshader/
-
-# Run interactively using the following, where IREE_WORKDIR is the path to your
-# local dev environment:
-# docker run -it --rm --entrypoint bash --volume ${IREE_WORKDIR}:/usr/src/iree/ \
-#   gcr.io/iree-oss/bazel-swiftshader
-
-# Set up the image and working directory.
-FROM gcr.io/iree-oss/bazel-tensorflow
-
-# TODO(#2651): The following steps are copied from cmake, cmake-vulkan, and
-# cmake-swiftshader. We might want to consider using docker multi-stage
-# builds to factor them out.
-
-# Additionally, we need to install the Vulkan SDK.
-
-ARG VULKAN_SDK_VERSION=1.2.141
-
-# Disable apt-key parse waring. If someone knows how to do whatever the "proper"
-# thing is then feel free. The warning complains about parsing apt-key output,
-# which we're not even doing.
-ARG APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=1
-
-RUN wget -qO - http://packages.lunarg.com/lunarg-signing-key-pub.asc \
-    | apt-key add - \
-  && wget -qO \
-    "/etc/apt/sources.list.d/lunarg-vulkan-${VULKAN_SDK_VERSION?}-bionic.list" \
-    "http://packages.lunarg.com/vulkan/${VULKAN_SDK_VERSION?}/lunarg-vulkan-${VULKAN_SDK_VERSION?}-bionic.list" \
-  && apt-get update \
-  && apt-get install -y vulkan-sdk
-
-ARG SWIFTSHADER_COMMIT=6a8a74986c357b0c6fa0dfd2b4b9230af8d39d1a
-
-# Then compile and install SwiftShader.
-
-# cmake, ninja, and zlib is needed for compiling SwiftShader.
-RUN apt-get update && apt-get install -y cmake ninja-build zlib1g-dev
-
-# Update cmake to v3.13+, which is ahead of apt-get's version (3.10.2).
-ENV CMAKE_VERSION 3.13.5
-RUN apt-get update \
-  && mkdir ./cmake_install \
-  && cd cmake_install \
-  && wget "https://github.com/Kitware/CMake/releases/download/v${CMAKE_VERSION?}/cmake-${CMAKE_VERSION?}.tar.gz" \
-  && tar -xzvf "cmake-${CMAKE_VERSION?}.tar.gz" \
-  && cd "cmake-${CMAKE_VERSION?}/" \
-  && cmake . \
-  && make \
-  && make install
-
-RUN git clone https://github.com/google/swiftshader \
-  && cd swiftshader && git checkout "${SWIFTSHADER_COMMIT?}" && cd .. \
-  # Only build SwiftShader Vulkan ICD.
-  && cmake -S swiftshader/ -B build-swiftshader/ \
-           -GNinja \
-           -DSWIFTSHADER_BUILD_VULKAN=ON \
-           -DSWIFTSHADER_BUILD_EGL=OFF \
-           -DSWIFTSHADER_BUILD_GLESv2=OFF \
-           -DSWIFTSHADER_BUILD_GLES_CM=OFF \
-           -DSWIFTSHADER_BUILD_PVR=OFF \
-           -DSWIFTSHADER_BUILD_TESTS=OFF \
-  && cmake --build build-swiftshader/ \
-           --config Release \
-           --target vk_swiftshader \
-  # Copy the ICD JSON and .so to a known place.
-  && cp -rf build-swiftshader/Linux /swiftshader \
-  # Keep track of the commit we are using.
-  && echo "${SWIFTSHADER_COMMIT?}" > /swiftshader/git-commit \
-  # Clean up everything.
-  && rm -rf swiftshader build-swiftshader
-
-# Set VK_ICD_FILENAMES so Vulkan loader can find the SwiftShader ICD.
-ENV VK_ICD_FILENAMES /swiftshader/vk_swiftshader_icd.json

diff --git a/build_tools/docker/bazel_tensorflow/Dockerfile b/build_tools/docker/bazel_tensorflow/Dockerfile
deleted file mode 100644
index 0c37354..0000000
--- a/build_tools/docker/bazel_tensorflow/Dockerfile
+++ /dev/null

@@ -1,30 +0,0 @@
-# Copyright 2020 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# An image for building IREE with tensorflow integrations using bazel.
-
-# Build using:
-# docker build --tag gcr.io/iree-oss/bazel-tensorflow \
-#   build_tools/docker/bazel_tensorflow/
-
-# Run interactively using the following, where IREE_WORKDIR is the path to your
-# local dev environment:
-# docker run -it --rm --entrypoint bash --volume ${IREE_WORKDIR}:/usr/src/iree/ \
-#   gcr.io/iree-oss/bazel-tensorflow
-
-# Set up the image and working directory.
-FROM gcr.io/iree-oss/bazel-bindings
-
-# Install tensorflow.
-RUN python3 -m pip install tf-nightly

diff --git a/build_tools/docker/cmake-android/Dockerfile b/build_tools/docker/cmake-android/Dockerfile
new file mode 100644
index 0000000..cb7ef82
--- /dev/null
+++ b/build_tools/docker/cmake-android/Dockerfile

@@ -0,0 +1,30 @@
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# An image for cross-compiling IREE towards Android using CMake.
+
+ARG NDK_VERSION=r21d
+
+FROM gcr.io/iree-oss/util AS install-ndk
+ARG NDK_VERSION
+WORKDIR /install-ndk
+
+RUN wget "https://dl.google.com/android/repository/android-ndk-${NDK_VERSION?}-linux-x86_64.zip"
+
+RUN unzip "android-ndk-${NDK_VERSION?}-linux-x86_64.zip" -d /usr/src/
+
+FROM gcr.io/iree-oss/cmake AS final
+ARG NDK_VERSION
+COPY --from=install-ndk "/usr/src/android-ndk-${NDK_VERSION}" "/usr/src/android-ndk-${NDK_VERSION}"
+ENV ANDROID_NDK "/usr/src/android-ndk-${NDK_VERSION}"

diff --git a/build_tools/docker/cmake-python-nvidia/Dockerfile b/build_tools/docker/cmake-python-nvidia/Dockerfile
new file mode 100644
index 0000000..cce8d2f
--- /dev/null
+++ b/build_tools/docker/cmake-python-nvidia/Dockerfile

@@ -0,0 +1,31 @@
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# An image for building IREE using CMake and testing IREE with NVIDIA GPUs.
+
+# To use the host GPUs, `docker run` must be called with the `--gpus all` flag.
+
+# Set up the image and working directory by inheriting the vulkan CMake
+# configuration.
+# Note that we don't start from NVIDIA's docker base:
+# - nvidia/cuda (https://hub.docker.com/r/nvidia/cuda):
+#     it's.. for CUDA.
+# - nvidia/vulkan (https://hub.docker.com/r/nvidia/vulkan):
+#      does not support Ubuntu 18.04.
+# This allows to share configuration with base CMake, but it also means we need
+# to MATCH the driver version between the host machine and the docker image.
+FROM gcr.io/iree-oss/cmake-python-vulkan AS final
+
+RUN apt-get update \
+  && apt-get install -y nvidia-driver-440

diff --git a/build_tools/docker/cmake-python-swiftshader/Dockerfile b/build_tools/docker/cmake-python-swiftshader/Dockerfile
new file mode 100644
index 0000000..28af929
--- /dev/null
+++ b/build_tools/docker/cmake-python-swiftshader/Dockerfile

@@ -0,0 +1,22 @@
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# An image for building IREE using CMake and testing IREE with SwiftShader
+# Vulkan implementation.
+
+FROM gcr.io/iree-oss/cmake-python-vulkan AS final
+COPY --from=gcr.io/iree-oss/swiftshader /swiftshader /swiftshader
+
+# Set VK_ICD_FILENAMES so Vulkan loader can find the SwiftShader ICD.
+ENV VK_ICD_FILENAMES /swiftshader/vk_swiftshader_icd.json

diff --git a/build_tools/docker/cmake_vulkan/Dockerfile b/build_tools/docker/cmake-python-vulkan/Dockerfile
similarity index 67%
rename from build_tools/docker/cmake_vulkan/Dockerfile
rename to build_tools/docker/cmake-python-vulkan/Dockerfile
index f2cdee6..a20221b 100644
--- a/build_tools/docker/cmake_vulkan/Dockerfile
+++ b/build_tools/docker/cmake-python-vulkan/Dockerfile

@@ -12,27 +12,16 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# An image with Vulkan SDK for building IREE using CMake.
+# A base image for building IREE using CMake and running Vulkan tests. Requires
+# a child image to provide a Vulkan ICD.
 
-# Build using:
-# docker build --tag gcr.io/iree-oss/cmake-vulkan \
-#   build_tools/docker/cmake_vulkan/
+FROM gcr.io/iree-oss/cmake-python AS final
 
-# Run interactively using the following, where IREE_WORKDIR is the path to your
-# local dev environment:
-# docker run -it --rm --entrypoint bash \
-#   --volume "${IREE_WORKDIR?}:/usr/src/iree/" \
-#   --gpus all \
-#   gcr.io/iree-oss/cmake-vulkan
-
-# Set up the image and working directory by inheriting the base
-# CMake configuration.
-FROM gcr.io/iree-oss/cmake
-
-# Additionally, we need to install the Vulkan SDK.
+# It would be nice to have a separate install vulkan image and copy from that,
+# but I don't know all the files that installing the vulkan-sdk adds.
+RUN apt-get update && apt-get install -y wget
 
 ARG VULKAN_SDK_VERSION=1.2.141
-
 # Disable apt-key parse waring. If someone knows how to do whatever the "proper"
 # thing is then feel free. The warning complains about parsing apt-key output,
 # which we're not even doing.
@@ -45,3 +34,5 @@
     "http://packages.lunarg.com/vulkan/${VULKAN_SDK_VERSION?}/lunarg-vulkan-${VULKAN_SDK_VERSION?}-bionic.list" \
   && apt-get update \
   && apt-get install -y vulkan-sdk
+
+RUN rm /usr/bin/wget

diff --git a/build_tools/docker/cmake-python/Dockerfile b/build_tools/docker/cmake-python/Dockerfile
new file mode 100644
index 0000000..d206097
--- /dev/null
+++ b/build_tools/docker/cmake-python/Dockerfile

@@ -0,0 +1,31 @@
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# An image for building IREE and its Python bindings using CMake.
+
+ARG CMAKE_MAJOR_VERSION=3
+ARG CMAKE_MINOR_VERSION=13
+ARG CMAKE_PATCH_VERSION=5
+
+FROM gcr.io/iree-oss/cmake AS final
+# Dependencies for the python bindings tests.
+RUN apt-get update \
+  && apt-get install -y \
+    python3 \
+    python3-pip \
+    python3-setuptools \
+  && python3 -m pip install --upgrade pip \
+  && python3 -m pip install numpy absl-py
+
+ENV PYTHON_BIN /usr/bin/python3

diff --git a/build_tools/docker/cmake/Dockerfile b/build_tools/docker/cmake/Dockerfile
index bde1f4d..00088ac 100644
--- a/build_tools/docker/cmake/Dockerfile
+++ b/build_tools/docker/cmake/Dockerfile

@@ -14,57 +14,32 @@
 
 # An image for building IREE using CMake.
 
-# Build using:
-# docker build --tag gcr.io/iree-oss/cmake build_tools/docker/cmake/
+# These are separate args because there's no way to strip the patch version off
+# to get the /usr/share path.
+# See https://github.com/moby/moby/issues/41383
+ARG CMAKE_MAJOR_VERSION=3
+ARG CMAKE_MINOR_VERSION=13
+ARG CMAKE_PATCH_VERSION=5
 
-# Run interactively using the following, where IREE_WORKDIR is the path to your
-# local dev environment:
-# docker run -it --rm --entrypoint bash \
-#   --volume "${IREE_WORKDIR?}:/usr/src/iree/" \
-#   gcr.io/iree-oss/cmake
+FROM gcr.io/iree-oss/util AS install-cmake
+ARG CMAKE_MAJOR_VERSION
+ARG CMAKE_MINOR_VERSION
+ARG CMAKE_PATCH_VERSION
+ENV CMAKE_VERSION="${CMAKE_MAJOR_VERSION}.${CMAKE_MINOR_VERSION}.${CMAKE_PATCH_VERSION}"
+WORKDIR /install-cmake
 
-# Set up the image and working directory.
-FROM ubuntu:18.04
-WORKDIR /usr/src/iree/
+# Install CMake v3.13, which is ahead of apt-get's version (3.10.2).
+RUN wget "https://github.com/Kitware/CMake/releases/download/v${CMAKE_VERSION?}/cmake-${CMAKE_VERSION?}-Linux-x86_64.sh"
+RUN chmod +x "./cmake-${CMAKE_VERSION?}-Linux-x86_64.sh"
+RUN "./cmake-${CMAKE_VERSION?}-Linux-x86_64.sh" --skip-license --prefix=/usr/
 
-RUN apt-get update \
-  && apt-get install -y \
-    # git for updating IREE's submodules.
-    git \
-    # For later installations
-    wget \
-    # For building with ninja
-    ninja-build \
-    # For bootstrapping the cmake installation
-    cmake \
-    # core IREE dependencies.
-    clang \
-    libsdl2-dev \
-    libssl-dev
+FROM gcr.io/iree-oss/base AS final
+ARG CMAKE_MAJOR_VERSION
+ARG CMAKE_MINOR_VERSION
 
-# Update cmake to v3.13+, which is ahead of apt-get's version (3.10.2).
-# Install dependencies, including an old version of cmake to bootstrap.
-ENV CMAKE_VERSION 3.13.5
-RUN apt-get update \
-  && mkdir ./cmake_install \
-  && cd cmake_install \
-  && wget "https://github.com/Kitware/CMake/releases/download/v${CMAKE_VERSION?}/cmake-${CMAKE_VERSION?}.tar.gz" \
-  && tar -xzvf "cmake-${CMAKE_VERSION?}.tar.gz" \
-  && cd "cmake-${CMAKE_VERSION?}/" \
-  && cmake . \
-  && make \
-  && make install
+COPY --from=install-cmake /usr/bin/cmake /usr/bin/ctest /usr/bin/
+COPY --from=install-cmake \
+  "/usr/share/cmake-${CMAKE_MAJOR_VERSION}.${CMAKE_MINOR_VERSION}" \
+  "/usr/share/cmake-${CMAKE_MAJOR_VERSION}.${CMAKE_MINOR_VERSION}"
 
-# Dependencies for the python bindings tests.
-RUN apt-get update \
-  && apt-get install -y \
-    python3 \
-    python3-pip \
-    python3-setuptools \
-  && python3 -m pip install --upgrade pip \
-  && python3 -m pip install numpy absl-py
-
-# Environment variables for IREE.
-ENV CC /usr/bin/clang
-ENV CXX /usr/bin/clang++
-ENV IREE_LLVMAOT_LINKER_PATH /usr/bin/ld
+RUN apt-get update && apt-get install -y ninja-build

diff --git a/build_tools/docker/cmake_android/Dockerfile b/build_tools/docker/cmake_android/Dockerfile
deleted file mode 100644
index 4349106..0000000
--- a/build_tools/docker/cmake_android/Dockerfile
+++ /dev/null

@@ -1,40 +0,0 @@
-# Copyright 2020 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# An image for cross-compiling IREE towards Android using CMake.
-
-# Build using:
-# docker build --tag gcr.io/iree-oss/cmake-android \
-#              build_tools/docker/cmake_android/
-
-# Run interactively using the following, where IREE_WORKDIR is the path to your
-# local dev environment:
-# docker run -it --rm --entrypoint bash \
-#   --volume "${IREE_WORKDIR?}:/usr/src/iree/" \
-#   gcr.io/iree-oss/cmake-android
-
-# Set up the image and working directory by inheriting the base
-# CMake configuration.
-FROM gcr.io/iree-oss/cmake
-
-# Additionally, we need the Android NDK for cross compiling IREE towards
-# Android. Download Android NDK r21d and set up environment variable.
-
-ADD https://dl.google.com/android/repository/android-ndk-r21d-linux-x86_64.zip /usr/src/
-
-RUN apt-get install -y unzip \
-  && unzip /usr/src/android-ndk-r21d-linux-x86_64.zip -d /usr/src/ \
-  && rm -f /usr/src/android-ndk-r21d-linux-x86_64.zip
-
-ENV ANDROID_NDK /usr/src/android-ndk-r21d

diff --git a/build_tools/docker/cmake_nvidia/Dockerfile b/build_tools/docker/cmake_nvidia/Dockerfile
deleted file mode 100644
index 1fdeaee..0000000
--- a/build_tools/docker/cmake_nvidia/Dockerfile
+++ /dev/null

@@ -1,55 +0,0 @@
-# Copyright 2020 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# An image for building IREE using CMake and testing IREE with NVIDIA GPUs.
-
-# Build using:
-# docker build --tag gcr.io/iree-oss/cmake-nvidia \
-#              build_tools/docker/cmake_nvidia/
-
-# Run interactively using the following, where IREE_WORKDIR is the path to your
-# local dev environment:
-# docker run -it --rm --entrypoint bash \
-#   --volume "${IREE_WORKDIR?}:/usr/src/iree/" \
-#   --gpus all \
-#   gcr.io/iree-oss/cmake-nvidia
-
-# Set up the image and working directory by inheriting the base
-# CMake configuration.
-# Note that we don't start from NVIDIA's docker base:
-# - nvidia/cuda (https://hub.docker.com/r/nvidia/cuda):
-#     it's.. for CUDA.
-# - nvidia/vulkan (https://hub.docker.com/r/nvidia/vulkan):
-#      does not support Ubuntu 18.04.
-# This allows to share configuration with base CMake, but it also means we need
-# to MATCH the driver version between the host machine and the docker image.
-# TODO: use cmake-vulkan as the base.
-FROM gcr.io/iree-oss/cmake
-
-# Additionally, we need to install the Vulkan SDK and the NVIDIA Vulkan driver.
-
-ARG VULKAN_SDK_VERSION=1.2.141
-
-# Disable apt-key parse waring. If someone knows how to do whatever the "proper"
-# thing is then feel free. The warning complains about parsing apt-key output,
-# which we're not even doing.
-ARG APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=1
-
-RUN wget -qO - http://packages.lunarg.com/lunarg-signing-key-pub.asc \
-    | apt-key add - \
-  && wget -qO \
-    "/etc/apt/sources.list.d/lunarg-vulkan-${VULKAN_SDK_VERSION?}-bionic.list" \
-    "http://packages.lunarg.com/vulkan/${VULKAN_SDK_VERSION?}/lunarg-vulkan-${VULKAN_SDK_VERSION?}-bionic.list" \
-  && apt-get update \
-  && apt-get install -y vulkan-sdk nvidia-driver-440

diff --git a/build_tools/docker/cmake_swiftshader/Dockerfile b/build_tools/docker/cmake_swiftshader/Dockerfile
deleted file mode 100644
index b92ce02..0000000
--- a/build_tools/docker/cmake_swiftshader/Dockerfile
+++ /dev/null

@@ -1,60 +0,0 @@
-# Copyright 2020 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# An image for building IREE using CMake and testing IREE with SwiftShader
-# Vulkan implementation.
-
-# Build using:
-# docker build --tag gcr.io/iree-oss/cmake-swiftshader \
-#   build_tools/docker/cmake_swiftshader/
-
-# Run interactively using the following, where IREE_WORKDIR is the path to your
-# local dev environment:
-# docker run -it --rm --entrypoint bash \
-#   --volume "${IREE_WORKDIR?}:/usr/src/iree/" \
-#   --gpus all \
-#   gcr.io/iree-oss/cmake-swiftshader
-
-# Set up the image and working directory by inheriting the base
-# CMake configuration.
-FROM gcr.io/iree-oss/cmake-vulkan
-
-ARG SWIFTSHADER_COMMIT=6a8a74986c357b0c6fa0dfd2b4b9230af8d39d1a
-
-# zlib is needed for compiling SwiftShader.
-RUN apt-get update && apt-get install zlib1g-dev
-
-RUN git clone https://github.com/google/swiftshader \
-  && cd swiftshader && git checkout "${SWIFTSHADER_COMMIT?}" && cd .. \
-  # Only build SwiftShader Vulkan ICD.
-  && cmake -S swiftshader/ -B build-swiftshader/ \
-           -GNinja \
-           -DSWIFTSHADER_BUILD_VULKAN=ON \
-           -DSWIFTSHADER_BUILD_EGL=OFF \
-           -DSWIFTSHADER_BUILD_GLESv2=OFF \
-           -DSWIFTSHADER_BUILD_GLES_CM=OFF \
-           -DSWIFTSHADER_BUILD_PVR=OFF \
-           -DSWIFTSHADER_BUILD_TESTS=OFF \
-  && cmake --build build-swiftshader/ \
-           --config Release \
-           --target vk_swiftshader \
-  # Copy the ICD JSON and .so to a known place.
-  && cp -rf build-swiftshader/Linux /swiftshader \
-  # Keep track of the commit we are using.
-  && echo "${SWIFTSHADER_COMMIT?}" > /swiftshader/git-commit \
-  # Clean up everything.
-  && rm -rf swiftshader build-swiftshader
-
-# Set VK_ICD_FILENAMES so Vulkan loader can find the SwiftShader ICD.
-ENV VK_ICD_FILENAMES /swiftshader/vk_swiftshader_icd.json

diff --git a/build_tools/docker/manage_images.py b/build_tools/docker/manage_images.py
index 9e7b7e3..468313d 100755
--- a/build_tools/docker/manage_images.py
+++ b/build_tools/docker/manage_images.py

@@ -48,17 +48,22 @@
 
 # Map from image names to images that they depend on.
 IMAGES_TO_DEPENDENCIES = {
-    'bazel': [],
-    'bazel-bindings': ['bazel'],
-    'bazel-tensorflow': ['bazel-bindings'],
-    'bazel-nvidia': ['bazel-tensorflow'],
-    'bazel-swiftshader': ['bazel-tensorflow'],
-    'cmake': [],
-    'cmake-android': ['cmake'],
-    'cmake-nvidia': ['cmake'],
-    'cmake-vulkan': ['cmake'],
-    'cmake-swiftshader': ['cmake-vulkan'],
+    'base': [],
+    'bazel': ['base', 'util'],
+    'bazel-python': ['bazel'],
+    'bazel-tensorflow': ['bazel-python'],
+    'bazel-tensorflow-nvidia': ['bazel-tensorflow-vulkan'],
+    'bazel-tensorflow-swiftshader': ['bazel-tensorflow-vulkan', 'swiftshader'],
+    'bazel-tensorflow-vulkan': ['bazel-tensorflow'],
+    'cmake': ['base', 'util'],
+    'cmake-android': ['cmake', 'util'],
+    'cmake-python': ['cmake'],
+    'cmake-python-nvidia': ['cmake-python-vulkan'],
+    'cmake-python-swiftshader': ['cmake-python-vulkan', 'swiftshader'],
+    'cmake-python-vulkan': ['cmake-python'],
     'rbe-toolchain': [],
+    'swiftshader': ['cmake'],
+    'util': [],
 }
 
 IMAGES_TO_DEPENDENT_IMAGES = {k: [] for k in IMAGES_TO_DEPENDENCIES}
@@ -252,7 +257,7 @@
     print(f'Processing image {image}')
     image_name = posixpath.join(IREE_GCR_URL, image)
     image_tag = f'{image_name}:{args.tag}'
-    image_path = os.path.join(DOCKER_DIR, image.replace('-', '_'))
+    image_path = os.path.join(DOCKER_DIR, image)
 
     if args.pull:
       check_stream_command(['docker', 'pull', image_tag], dry_run=args.dry_run)

diff --git a/build_tools/docker/rbe-toolchain/Dockerfile b/build_tools/docker/rbe-toolchain/Dockerfile
new file mode 100755
index 0000000..ffb0f0f
--- /dev/null
+++ b/build_tools/docker/rbe-toolchain/Dockerfile

@@ -0,0 +1,123 @@
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# An image for building IREE in RBE's remmote execution environments.
+# The parent image requires gcloud authorization to download (run
+# `gcloud auth configure-docker`)
+
+# Note that this doesn't reuse anything from our other docker images because it
+# is based on Ubuntu 16.04, which is the only image that RBE provides toolchains
+# for. There are also Ubuntu 18.04 images, but we'd have to construct all our
+# own toolchains.
+
+######################## Install Swiftshader ###################################
+FROM ubuntu:16.04 AS install-swiftshader
+WORKDIR /install-swiftshader
+
+RUN apt-get update && apt-get install -y wget
+
+ARG CMAKE_VERSION=3.13.5
+# Install CMake v3.13, which is ahead of apt-get's version (3.10.2).
+RUN wget "https://github.com/Kitware/CMake/releases/download/v${CMAKE_VERSION?}/cmake-${CMAKE_VERSION?}-Linux-x86_64.sh" \
+  && chmod +x "./cmake-${CMAKE_VERSION?}-Linux-x86_64.sh" \
+  && "./cmake-${CMAKE_VERSION?}-Linux-x86_64.sh" --skip-license --prefix=/usr/ \
+  && rm "./cmake-${CMAKE_VERSION?}-Linux-x86_64.sh"
+
+RUN apt-get update && apt-get install -y \
+  clang \
+  git \
+  ninja-build \
+  python3 \
+  zlib1g-dev
+
+# This commit fixed support for the max version of libstdc++6 available through
+# Ubuntu 16.04 apt.
+ARG SWIFTSHADER_COMMIT=6287c18b1d249152563f0cb2d5cb0c6d0eb9e3d6
+
+RUN git clone https://github.com/google/swiftshader
+RUN cd swiftshader && git checkout "${SWIFTSHADER_COMMIT?}" && cd ..
+# Only build SwiftShader Vulkan ICD.
+RUN cmake -S swiftshader/ -B build-swiftshader/ \
+  -GNinja \
+  -DSWIFTSHADER_BUILD_VULKAN=ON \
+  -DSWIFTSHADER_BUILD_EGL=OFF \
+  -DSWIFTSHADER_BUILD_GLESv2=OFF \
+  -DSWIFTSHADER_BUILD_GLES_CM=OFF \
+  -DSWIFTSHADER_BUILD_PVR=OFF \
+  -DSWIFTSHADER_BUILD_TESTS=OFF
+RUN cmake --build build-swiftshader/ \
+  --config Release \
+  --target vk_swiftshader
+
+# Copy the ICD JSON and .so to a known place.
+RUN cp -rf build-swiftshader/Linux /swiftshader
+# Keep track of the commit we are using.
+RUN echo "${SWIFTSHADER_COMMIT?}" > /swiftshader/git-commit
+
+
+
+######################## Final Image ###########################################
+FROM gcr.io/cloud-marketplace/google/rbe-ubuntu16-04@sha256:1a8ed713f40267bb51fe17de012fa631a20c52df818ccb317aaed2ee068dfc61 AS final
+
+######################## Python 3 ##############################################
+RUN apt-get update \
+  && apt-get install -y \
+    python3 \
+    python3-pip \
+  && python3 -m pip install --upgrade pip \
+  && python3 -m pip install numpy
+
+######################## Vulkan SDK ############################################
+ARG VULKAN_SDK_VERSION=1.2.141
+
+# Disable apt-key parse waring. If someone knows how to do whatever the "proper"
+# thing is then feel free. The warning complains about parsing apt-key output,
+# which we're not even doing.
+ARG APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=1
+
+RUN apt-get update \
+  && apt-get install apt-transport-https
+
+# Note that this image is based on Ubuntu 16.04 (xenial) as opposed to
+# Ubuntu 18.04 (bionic), which we use for our other images.
+RUN wget -qO - http://packages.lunarg.com/lunarg-signing-key-pub.asc \
+    | apt-key add - \
+  && wget -qO \
+    "/etc/apt/sources.list.d/lunarg-vulkan-${VULKAN_SDK_VERSION?}-xenial.list" \
+    "http://packages.lunarg.com/vulkan/${VULKAN_SDK_VERSION?}/lunarg-vulkan-${VULKAN_SDK_VERSION?}-xenial.list" \
+  && apt-get update \
+  && apt-get install -y vulkan-sdk
+
+######################## Swiftshader ###########################################
+COPY --from=install-swiftshader /swiftshader /swiftshader
+# Set VK_ICD_FILENAMES so Vulkan loader can find the SwiftShader ICD.
+ENV VK_ICD_FILENAMES /swiftshader/vk_swiftshader_icd.json
+
+RUN apt-get update && apt-get install -y software-properties-common
+
+# apt-add-repository requires a version of python with the softwareproperties
+# module. To use this command, we:
+#   1. remove the symlink to python3 from python3.6 and symlink it to python3.5
+#   2. run apt-add-repository with python3 = python3.5
+#   3. resymlink python3 to /opt/python3.6/bin/python3.6
+# See https://github.com/google/iree/issues/1966 for more information.
+RUN rm /usr/bin/python3 \
+  && ln -s /usr/bin/python3.5 /usr/bin/python3 \
+  && add-apt-repository ppa:deadsnakes/ppa \
+  && rm /usr/bin/python3 \
+  && ln -s /opt/python3.6/bin/python3.6 /usr/bin/python3
+
+# Install python3.6-dev
+RUN apt-get update \
+  && apt-get install -y python3.6 python3.6-dev

diff --git a/build_tools/docker/rbe_toolchain/Dockerfile b/build_tools/docker/rbe_toolchain/Dockerfile
deleted file mode 100755
index 878aca3..0000000
--- a/build_tools/docker/rbe_toolchain/Dockerfile
+++ /dev/null

@@ -1,49 +0,0 @@
-# Copyright 2020 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# An image for building IREE in RBE's remmote execution environments.
-# The parent image requires gcloud authorization to download
-
-# Build using:
-# gcloud auth configure-docker
-# docker build --tag gcr.io/iree-oss/rbe-toolchain build_tools/docker/rbe_toolchain/
-
-FROM gcr.io/cloud-marketplace/google/rbe-ubuntu16-04@sha256:1a8ed713f40267bb51fe17de012fa631a20c52df818ccb317aaed2ee068dfc61
-
-RUN apt-get update \
-    && apt-get install -y \
-        python3 \
-        python3-pip \
-    && python3 -m pip install --upgrade pip \
-    && python3 -m pip install numpy
-
-# Dependency for python3.6-dev. Needs to be installed separately from the above
-# for... some reason
-RUN apt-get update && apt-get install -y software-properties-common
-
-# apt-add-repository requires a version of python with the softwareproperties
-# module. To use this command, we:
-#   1. remove the symlink to python3 from python3.6 and symlink it to python3.5
-#   2. run apt-add-repository with python3 = python3.5
-#   3. resymlink python3 to /opt/python3.6/bin/python3.6
-# See https://github.com/google/iree/issues/1966 for more information.
-RUN rm /usr/bin/python3 \
-    && ln -s /usr/bin/python3.5 /usr/bin/python3 \
-    && add-apt-repository ppa:deadsnakes/ppa \
-    && rm /usr/bin/python3 \
-    && ln -s /opt/python3.6/bin/python3.6 /usr/bin/python3
-
-# Install python3.6-dev
-RUN apt-get update \
-  && apt-get install -y python3.6 python3.6-dev

diff --git a/build_tools/docker/swiftshader/Dockerfile b/build_tools/docker/swiftshader/Dockerfile
new file mode 100644
index 0000000..562874b
--- /dev/null
+++ b/build_tools/docker/swiftshader/Dockerfile

@@ -0,0 +1,44 @@
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+FROM gcr.io/iree-oss/cmake AS install-swiftshader
+WORKDIR /install-swiftshader
+
+RUN apt-get update && apt-get install -y git
+
+ARG SWIFTSHADER_COMMIT=6287c18b1d249152563f0cb2d5cb0c6d0eb9e3d6
+
+# zlib is needed for compiling SwiftShader.
+RUN apt-get update && apt-get install -y zlib1g-dev
+RUN git clone https://github.com/google/swiftshader
+RUN cd swiftshader && git checkout "${SWIFTSHADER_COMMIT?}" && cd ..
+# Only build SwiftShader Vulkan ICD.
+RUN cmake -S swiftshader/ -B build-swiftshader/ \
+           -GNinja \
+           -DSWIFTSHADER_BUILD_VULKAN=ON \
+           -DSWIFTSHADER_BUILD_EGL=OFF \
+           -DSWIFTSHADER_BUILD_GLESv2=OFF \
+           -DSWIFTSHADER_BUILD_GLES_CM=OFF \
+           -DSWIFTSHADER_BUILD_PVR=OFF \
+           -DSWIFTSHADER_BUILD_TESTS=OFF
+RUN cmake --build build-swiftshader/ \
+           --config Release \
+           --target vk_swiftshader
+# Copy the ICD JSON and .so to a known place.
+RUN cp -rf build-swiftshader/Linux /swiftshader
+# Keep track of the commit we are using.
+RUN echo "${SWIFTSHADER_COMMIT?}" > /swiftshader/git-commit
+
+FROM ubuntu:18.04 AS final
+COPY --from=install-swiftshader /swiftshader /swiftshader

diff --git a/build_tools/docker/util/Dockerfile b/build_tools/docker/util/Dockerfile
new file mode 100644
index 0000000..1b34d25
--- /dev/null
+++ b/build_tools/docker/util/Dockerfile

@@ -0,0 +1,26 @@
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# An image containing utilities useful for setting up docker images, but not
+# needed in the final images. Intermediate stages can inherit from this image,
+# but final stages should not.
+
+FROM ubuntu:18.04 AS final
+
+RUN apt-get update \
+  && apt-get install -y \
+  git \
+  unzip \
+  wget \
+  gnupg2