Revert "Break the cos-customizer dependency on snapshot.debian.org"

This reverts commit 2b9990703a7cea3aeea16808c3da6795698d4c80.

Reason for revert: postsubmit failed

Change-Id: I82ef7d4886b19b7a058720ec12950e5eb8225816
Reviewed-on: https://cos-review.googlesource.com/c/cos/tools/+/57069
Tested-by: Robert Kolchmeyer <rkolchmeyer@google.com>
Reviewed-by: Arnav Kansal <rnv@google.com>
Cloud-Build: GCB Service account <228075978874@cloudbuild.gserviceaccount.com>
Reviewed-by: Nandhini Rengaraj <nrengaraj@google.com>
diff --git a/BUILD.bazel b/BUILD.bazel
index f0cdbe3..93e78a0 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -13,6 +13,120 @@
 # limitations under the License.
 
 load("@bazel_gazelle//:def.bzl", "gazelle")
+load("@io_bazel_rules_docker//go:image.bzl", "go_image")
+load("@io_bazel_rules_docker//container:container.bzl", "container_image")
+load("@package_bundle_amd64//file:packages.bzl", packages_amd64 = "packages")
+load("@package_bundle_arm64//file:packages.bzl", packages_arm64 = "packages")
+load("@rules_pkg//:pkg.bzl", "pkg_deb", "pkg_tar")
 
 # gazelle:prefix cos.googlesource.com/cos/tools.git
 gazelle(name = "gazelle")
+
+exports_files(glob(["src/data/**"]))
+
+genrule(
+    name = "workspace_dir",
+    outs = ["workspace"],
+    cmd = "mkdir $@",
+)
+
+genrule(
+    name = "tmp_dir",
+    outs = ["tmp"],
+    cmd = "mkdir $@",
+)
+
+container_image(
+    name = "veritysetup_amd64",
+    architecture = "amd64",
+    debs = [
+        packages_amd64["coreutils"],
+        packages_amd64["tar"],
+        packages_amd64["libacl1"],
+        packages_amd64["libattr1"],
+        packages_amd64["libc6"],
+        packages_amd64["libselinux1"],
+        packages_amd64["libpcre3"],
+        packages_amd64["cryptsetup-bin"],
+        packages_amd64["libcryptsetup4"],
+        packages_amd64["libpopt0"],
+        packages_amd64["libuuid1"],
+        packages_amd64["libdevmapper1.02.1"],
+        packages_amd64["libgcrypt20"],
+        packages_amd64["libargon2-0"],
+        packages_amd64["libjson-c3"],
+        packages_amd64["libudev1"],
+        packages_amd64["libpthread-stubs0-dev"],
+        packages_amd64["libm17n-0"],
+        packages_amd64["libgpg-error0"],
+    ],
+    repository = "veritysetup",
+    visibility = ["//visibility:public"],
+)
+
+container_image(
+    name = "veritysetup_arm64",
+    architecture = "arm64",
+    debs = [
+        packages_arm64["coreutils"],
+        packages_arm64["tar"],
+        packages_arm64["libacl1"],
+        packages_arm64["libattr1"],
+        packages_arm64["libc6"],
+        packages_arm64["libselinux1"],
+        packages_arm64["libpcre3"],
+        packages_arm64["cryptsetup-bin"],
+        packages_arm64["libcryptsetup4"],
+        packages_arm64["libpopt0"],
+        packages_arm64["libuuid1"],
+        packages_arm64["libdevmapper1.02.1"],
+        packages_arm64["libgcrypt20"],
+        packages_arm64["libargon2-0"],
+        packages_arm64["libjson-c3"],
+        packages_arm64["libudev1"],
+        packages_arm64["libpthread-stubs0-dev"],
+        packages_arm64["libm17n-0"],
+        packages_arm64["libgpg-error0"],
+    ],
+    repository = "veritysetup",
+    visibility = ["//visibility:public"],
+)
+
+pkg_tar(
+    name = "data_tar",
+    srcs = glob(["src/data/**"]),
+    strip_prefix = "src/",
+)
+
+container_image(
+    name = "cos_customizer_base",
+    base = "@daisy//image",
+    data_path = ".",
+    debs = [
+        packages_amd64["coreutils"],
+        packages_amd64["tar"],
+        packages_amd64["libacl1"],
+        packages_amd64["libattr1"],
+        packages_amd64["libc6"],
+        packages_amd64["libselinux1"],
+        packages_amd64["libpcre3"],
+        packages_amd64["mtools"],
+    ],
+    files = [
+        ":tmp_dir",
+        ":workspace_dir",
+    ],
+    tars = [
+        ":data_tar",
+    ],
+)
+
+go_image(
+    name = "cos_customizer",
+    base = ":cos_customizer_base",
+    embed = ["//src/cmd/cos_customizer:cos_customizer_lib"],
+    goarch = "amd64",
+    goos = "linux",
+    pure = "on",
+    visibility = ["//visibility:public"],
+)
diff --git a/WORKSPACE b/WORKSPACE
index e914758..8b5ffbc 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -35,11 +35,32 @@
 )
 
 http_archive(
+    name = "io_bazel_rules_docker",
+    sha256 = "07ee8ca536080f5ebab6377fc6e8920e9a761d2ee4e64f0f6d919612f6ab56aa",
+    strip_prefix = "rules_docker-0.25.0",
+    urls = ["https://github.com/bazelbuild/rules_docker/archive/v0.25.0.tar.gz"],
+)
+
+http_archive(
+    name = "distroless",
+    sha256 = "14834aaf9e005b9175de2cfa2b420c80778880ee4d9f9a9f7f385d3b177abff7",
+    strip_prefix = "distroless-fa0765cc86064801e42a3b35f50ff2242aca9998",
+    urls = ["https://github.com/GoogleContainerTools/distroless/archive/fa0765cc86064801e42a3b35f50ff2242aca9998.tar.gz"],
+)
+
+http_archive(
     name = "rules_pkg",
     sha256 = "aeca78988341a2ee1ba097641056d168320ecc51372ef7ff8e64b139516a4937",
     urls = ["https://github.com/bazelbuild/rules_pkg/releases/download/0.2.6-1/rules_pkg-0.2.6.tar.gz"],
 )
 
+http_archive(
+    name = "rules_foreign_cc",
+    sha256 = "ab805b9e00747ba9b184790cbe2d4d19b672770fcac437f01d8c101ae60df996",
+    strip_prefix = "rules_foreign_cc-c309ec13192f69a46aaaba39587c3d7ff684eb35",
+    urls = ["https://github.com/bazelbuild/rules_foreign_cc/archive/c309ec13192f69a46aaaba39587c3d7ff684eb35.zip"],
+)
+
 git_repository(
     name = "com_google_protobuf",
     commit = "31ebe2ac71400344a5db91ffc13c4ddfb7589f92",
@@ -79,3 +100,131 @@
 load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies")
 
 gazelle_dependencies()
+
+load(
+    "@io_bazel_rules_docker//repositories:repositories.bzl",
+    container_repositories = "repositories",
+)
+
+container_repositories()
+
+load("@io_bazel_rules_docker//repositories:deps.bzl", container_deps = "deps")
+
+container_deps()
+
+load(
+    "@io_bazel_rules_docker//container:container.bzl",
+    "container_pull",
+)
+
+container_pull(
+    name = "daisy",
+    digest = "sha256:a23774074d5941ed9e25f64ee7e02f96d2f8e09a4d7cee7131b49664267c33c7",
+    registry = "gcr.io",
+    repository = "compute-image-tools/daisy",
+)
+
+load(
+    "@io_bazel_rules_docker//go:image.bzl",
+    _go_image_repos = "repositories",
+)
+
+_go_image_repos()
+
+load(
+    "@distroless//package_manager:package_manager.bzl",
+    "package_manager_repositories",
+)
+
+package_manager_repositories()
+
+load(
+    "@distroless//package_manager:dpkg.bzl",
+    "dpkg_src",
+    "dpkg_list",
+)
+
+dpkg_src(
+    name = "debian_stretch_amd64",
+    arch = "amd64",
+    distro = "stretch",
+    sha256 = "79a66cd92ba9096fce679e15d0b5feb9effcf618b0a6d065eb32684dbffd0311",
+    snapshot = "20190328T105444Z",
+    url = "http://snapshot.debian.org/archive",
+)
+
+dpkg_src(
+    name = "debian_stretch_arm64",
+    arch = "arm64",
+    distro = "stretch",
+    sha256 = "ec05c9109c0a6aef4509091b9ccf10939583e56b7ce53be9d8ef38ec5e0ce9d2",
+    snapshot = "20190328T105444Z",
+    url = "http://snapshot.debian.org/archive",
+)
+
+dpkg_list(
+    name = "package_bundle_amd64",
+    packages = [
+        "coreutils",
+        "libacl1",
+        "libattr1",
+        "libc6",
+        "libpcre3",
+        "libselinux1",
+        "tar",
+        "cryptsetup-bin",
+        "libcryptsetup4",
+        "libpopt0",
+        "libuuid1",
+        "libdevmapper1.02.1",
+        "libgcrypt20",
+        "libargon2-0",
+        "libjson-c3",
+        "libudev1",
+        "libpthread-stubs0-dev",
+        "libm17n-0",
+        "libgpg-error0",
+        "mtools",
+    ],
+    sources = [
+        "@debian_stretch_amd64//file:Packages.json",
+    ],
+)
+
+dpkg_list(
+    name = "package_bundle_arm64",
+    packages = [
+        "coreutils",
+        "libacl1",
+        "libattr1",
+        "libc6",
+        "libpcre3",
+        "libselinux1",
+        "tar",
+        "cryptsetup-bin",
+        "libcryptsetup4",
+        "libpopt0",
+        "libuuid1",
+        "libdevmapper1.02.1",
+        "libgcrypt20",
+        "libargon2-0",
+        "libjson-c3",
+        "libudev1",
+        "libpthread-stubs0-dev",
+        "libm17n-0",
+        "libgpg-error0",
+        "mtools",
+    ],
+    sources = [
+        "@debian_stretch_arm64//file:Packages.json",
+    ],
+)
+
+load("@rules_foreign_cc//:workspace_definitions.bzl", "rules_foreign_cc_dependencies")
+rules_foreign_cc_dependencies()
+
+load("//src/third_party/dosfstools:dosfstools_repositories.bzl", "dosfstools_repositories")
+dosfstools_repositories()
+
+load("//src/third_party/mtools:mtools_repositories.bzl", "mtools_repositories")
+mtools_repositories()
diff --git a/deps.bzl b/deps.bzl
index 77e1fc0..0e4bb16 100644
--- a/deps.bzl
+++ b/deps.bzl
@@ -451,9 +451,3 @@
         sum = "h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=",
         version = "v0.0.0-20200804184101-5ec99f83aff1",
     )
-    go_repository(
-        name = "com_github_pkg_errors",
-        importpath = "github.com/pkg/errors",
-        sum = "h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=",
-        version = "v0.9.1",
-    )
diff --git a/src/cmd/cos_customizer/Dockerfile b/src/cmd/cos_customizer/Dockerfile
deleted file mode 100644
index 7e73347..0000000
--- a/src/cmd/cos_customizer/Dockerfile
+++ /dev/null
@@ -1,137 +0,0 @@
-# Step 1: build all bundled programs built with Bazel
-FROM gcr.io/cloud-builders/bazel AS bazel_builder
-ARG _BUILD_TOOLS_CACHE
-
-ADD . /workspace
-WORKDIR /workspace
-RUN bazel build \
-  --remote_cache=$_BUILD_TOOLS_CACHE \
-  //src/cmd/cos_customizer:cos_customizer \
-  //src/cmd/provisioner:provisioner_amd64 \
-  //src/cmd/provisioner:provisioner_arm64 \
-  //src/cmd/metadata_watcher:metadata_watcher_amd64 \
-  //src/cmd/metadata_watcher:metadata_watcher_arm64 \
-  //src/cmd/handle_disk_layout:handle_disk_layout_bin_amd64 \
-  //src/cmd/handle_disk_layout:handle_disk_layout_bin_arm64 \
-  @com_github_googlecloudplatform_docker_credential_gcr//:docker-credential-gcr_amd64 \
-  @com_github_googlecloudplatform_docker_credential_gcr//:docker-credential-gcr_arm64; \
-  mkdir -p _out/amd64; \
-  cp \
-    $(bazel cquery --output=files //src/cmd/cos_customizer:cos_customizer) \
-    $(bazel cquery --output=files //src/cmd/provisioner:provisioner_amd64) \
-    $(bazel cquery --output=files //src/cmd/metadata_watcher:metadata_watcher_amd64) \
-    $(bazel cquery --output=files //src/cmd/handle_disk_layout:handle_disk_layout_bin_amd64) \
-    $(bazel cquery --output=files @com_github_googlecloudplatform_docker_credential_gcr//:docker-credential-gcr_amd64) \
-    _out/amd64; \
-  mkdir -p _out/arm64; \
-  cp \
-    $(bazel cquery --output=files //src/cmd/provisioner:provisioner_arm64) \
-    $(bazel cquery --output=files //src/cmd/metadata_watcher:metadata_watcher_arm64) \
-    $(bazel cquery --output=files //src/cmd/handle_disk_layout:handle_disk_layout_bin_arm64) \
-    $(bazel cquery --output=files @com_github_googlecloudplatform_docker_credential_gcr//:docker-credential-gcr_arm64) \
-    _out/arm64
-
-# Step 2: build CIDATA and SCRATCH images
-FROM debian:bookworm AS cidata_builder
-
-RUN dpkg --add-architecture arm64; apt-get update; \
-  apt-get install -y --no-install-recommends dosfstools mtools
-
-# Output in /opt/veritysetup_amd64/veritysetup_amd64.tar.gz
-RUN mkdir -p /opt/veritysetup_amd64/{root,debs}
-WORKDIR /opt/veritysetup_amd64/debs
-RUN apt-get download \
-  coreutils:amd64 \
-  tar:amd64 \
-  libacl1:amd64 \
-  libattr1:amd64 \
-  libc6:amd64 \
-  libselinux1:amd64 \
-  libpcre3:amd64 \
-  cryptsetup-bin:amd64 \
-  libblkid1:amd64 \
-  libcryptsetup12:amd64 \
-  libpopt0:amd64 \
-  libuuid1:amd64 \
-  libdevmapper1.02.1:amd64 \
-  libgcrypt20:amd64 \
-  libargon2-1:amd64 \
-  libjson-c5:amd64 \
-  libudev1:amd64 \
-  libssl3:amd64 \
-  libpcre2-8-0:amd64
-WORKDIR /opt/veritysetup_amd64
-RUN for f in debs/*.deb; do dpkg-deb --extract $f root; done; \
-  tar czf veritysetup_amd64.tar.gz -C root .
-
-# Output in /opt/veritysetup_arm64/veritysetup_arm64.tar.gz
-RUN mkdir -p /opt/veritysetup_arm64/{root,debs}
-WORKDIR /opt/veritysetup_arm64/debs
-RUN apt-get download \
-  coreutils:arm64 \
-  tar:arm64 \
-  libacl1:arm64 \
-  libattr1:arm64 \
-  libc6:arm64 \
-  libselinux1:arm64 \
-  libpcre3:arm64 \
-  cryptsetup-bin:arm64 \
-  libblkid1:arm64 \
-  libcryptsetup12:arm64 \
-  libpopt0:arm64 \
-  libuuid1:arm64 \
-  libdevmapper1.02.1:arm64 \
-  libgcrypt20:arm64 \
-  libargon2-1:arm64 \
-  libjson-c5:arm64 \
-  libudev1:arm64 \
-  libssl3:arm64 \
-  libpcre2-8-0:arm64
-WORKDIR /opt/veritysetup_arm64
-RUN for f in debs/*.deb; do dpkg-deb --extract $f root; done; \
-  tar czf veritysetup_arm64.tar.gz -C root .
-
-# Output in /opt/cidata/cidata.img
-RUN mkdir -p /opt/cidata/deps
-WORKDIR /opt/cidata
-COPY --from=bazel_builder /workspace/src/data/startup.yaml deps/user-data
-COPY --from=bazel_builder /workspace/_out/amd64 deps/amd64
-COPY --from=bazel_builder /workspace/_out/arm64 deps/arm64
-RUN mkfs.fat -n CIDATA -S 512 -s 8 -C cidata.img 131072; \
-  touch meta-data; \
-  mcopy -i cidata.img deps/user-data ::/user-data; \
-  mcopy -i cidata.img meta-data ::/meta-data; \
-  mcopy -i cidata.img deps/amd64/provisioner_amd64 ::/provisioner_amd64; \
-  mcopy -i cidata.img deps/arm64/provisioner_arm64 ::/provisioner_arm64; \
-  mcopy -i cidata.img deps/amd64/metadata_watcher_amd64 ::/metadata_watcher_amd64; \
-  mcopy -i cidata.img deps/arm64/metadata_watcher_arm64 ::/metadata_watcher_arm64; \
-  mcopy -i cidata.img deps/amd64/docker-credential-gcr_amd64 ::/docker-credential-gcr_amd64; \
-  mcopy -i cidata.img deps/arm64/docker-credential-gcr_arm64 ::/docker-credential-gcr_arm64; \
-  mcopy -i cidata.img deps/amd64/handle_disk_layout_bin_amd64 ::/handle_disk_layout_bin_amd64; \
-  mcopy -i cidata.img deps/arm64/handle_disk_layout_bin_arm64 ::/handle_disk_layout_bin_arm64; \
-  mcopy -i cidata.img /opt/veritysetup_amd64/veritysetup_amd64.tar.gz ::/veritysetup_amd64.tar.gz; \
-  mcopy -i cidata.img /opt/veritysetup_arm64/veritysetup_arm64.tar.gz ::/veritysetup_arm64.tar.gz
-
-# Output in /opt/scratch/scratch.img
-RUN mkdir -p /opt/scratch
-WORKDIR /opt/scratch
-RUN fallocate -l 512M scratch.img; \
-  mkfs.ext4 scratch.img; \
-  tune2fs -c0 -i0 scratch.img; \
-  e2label scratch.img SCRATCH
-
-# Step 3: build the cos-customizer container image
-FROM gcr.io/compute-image-tools/daisy@sha256:a23774074d5941ed9e25f64ee7e02f96d2f8e09a4d7cee7131b49664267c33c7 AS daisy
-FROM debian:bookworm-slim
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-  tar \
-  mtools \
-  ca-certificates
-RUN mkdir -p /tmp; mkdir -p /workspace
-COPY --from=bazel_builder /workspace/src/data /data
-COPY --from=bazel_builder /workspace/_out/amd64/cos_customizer /cos_customizer
-COPY --from=daisy /daisy /daisy
-COPY --from=cidata_builder /opt/cidata/cidata.img /cidata.img
-COPY --from=cidata_builder /opt/scratch/scratch.img /scratch.img
-ENTRYPOINT ["/cos_customizer"]
diff --git a/src/cmd/cos_customizer/cloudbuild.yaml b/src/cmd/cos_customizer/cloudbuild.yaml
index 9de1966..b13cb0e 100644
--- a/src/cmd/cos_customizer/cloudbuild.yaml
+++ b/src/cmd/cos_customizer/cloudbuild.yaml
@@ -20,17 +20,16 @@
   - |
     cat <<EOF | docker build -t bazel -
     FROM gcr.io/cloud-builders/bazel
-    RUN apt-get update && apt-get install -y mtools dosfstools
+    RUN apt-get update && apt-get install -y mtools
     EOF
 - name: 'bazel'
   args: ['test', '--remote_cache=${_BUILD_TOOLS_CACHE}', '--google_default_credentials', '--spawn_strategy=standalone','--','...','-//src/pkg/tools/...']
+- name: 'bazel'
+  args: ['run', '--remote_cache=${_BUILD_TOOLS_CACHE}', '--google_default_credentials', '--spawn_strategy=standalone', ':cos_customizer', '--', '--norun']
 - name: 'gcr.io/cloud-builders/docker'
-  args: ['build',
-         '-t', 'gcr.io/${_OUTPUT_PROJECT}/cos-customizer:${TAG_NAME}',
-         '-t', 'gcr.io/${_OUTPUT_PROJECT}/cos-customizer:latest',
-         '-f', 'src/cmd/cos_customizer/Dockerfile',
-         '--build-arg', '_BUILD_TOOLS_CACHE=${_BUILD_TOOLS_CACHE}',
-         '.']
+  args: ['tag', 'bazel:cos_customizer', 'gcr.io/${_OUTPUT_PROJECT}/cos-customizer:${TAG_NAME}']
+- name: 'gcr.io/cloud-builders/docker'
+  args: ['tag', 'bazel:cos_customizer', 'gcr.io/${_OUTPUT_PROJECT}/cos-customizer:latest']
 options:
   machineType: 'N1_HIGHCPU_8'
   substitutionOption: 'MUST_MATCH'
diff --git a/src/cmd/cos_customizer/finish_image_build_test.go b/src/cmd/cos_customizer/finish_image_build_test.go
index 71cafc9..c812062 100644
--- a/src/cmd/cos_customizer/finish_image_build_test.go
+++ b/src/cmd/cos_customizer/finish_image_build_test.go
@@ -20,13 +20,11 @@
 	"fmt"
 	"io/ioutil"
 	"os"
-	"path/filepath"
 	"testing"
 
 	"cos.googlesource.com/cos/tools.git/src/pkg/config"
 	"cos.googlesource.com/cos/tools.git/src/pkg/fakes"
 	"cos.googlesource.com/cos/tools.git/src/pkg/fs"
-	"cos.googlesource.com/cos/tools.git/src/pkg/utils"
 
 	"cloud.google.com/go/storage"
 	"github.com/google/subcommands"
@@ -106,16 +104,6 @@
 		os.RemoveAll(tmpDir)
 		return "", nil, err
 	}
-	files.CIDataImg = filepath.Join(tmpDir, "cidata.img")
-	if err := utils.RunCommand([]string{"mkfs.fat", "-n", "CIDATA", "-S", "512", "-s", "8", "-C", files.CIDataImg, "131072"}, tmpDir, nil); err != nil {
-		os.RemoveAll(tmpDir)
-		return "", nil, err
-	}
-	files.ScratchImg, err = createTempFile(tmpDir)
-	if err != nil {
-		os.RemoveAll(tmpDir)
-		return "", nil, err
-	}
 	return tmpDir, files, nil
 }
 
diff --git a/src/cmd/provisioner/BUILD.bazel b/src/cmd/provisioner/BUILD.bazel
index 3f0a0d0..3c2c3be 100644
--- a/src/cmd/provisioner/BUILD.bazel
+++ b/src/cmd/provisioner/BUILD.bazel
@@ -13,6 +13,53 @@
 # limitations under the License.
 
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@io_bazel_rules_go//extras:embed_data.bzl", "go_embed_data")
+
+# Our goal is for this program to be embedded into this Go package. Go embed
+# only allows files in the same package directory to be embedded. So we need to
+# use a "no-op" genrule to place this binary in the same directory as the
+# package source.
+genrule(
+    name = "handle_disk_layout_amd64.bin",
+    srcs = ["//src/cmd/handle_disk_layout:handle_disk_layout_bin_amd64"],
+    outs = ["_handle_disk_layout_amd64.bin"],
+    cmd = "cp $< $@",
+)
+
+genrule(
+    name = "handle_disk_layout_arm64.bin",
+    srcs = ["//src/cmd/handle_disk_layout:handle_disk_layout_bin_arm64"],
+    outs = ["_handle_disk_layout_arm64.bin"],
+    cmd = "cp $< $@",
+)
+
+genrule(
+    name = "veritysetup_amd64.img",
+    srcs = ["//:veritysetup_amd64.tar"],
+    outs = ["_veritysetup_amd64.img"],
+    cmd = "cp $< $@",
+)
+
+genrule(
+    name = "veritysetup_arm64.img",
+    srcs = ["//:veritysetup_arm64.tar"],
+    outs = ["_veritysetup_arm64.img"],
+    cmd = "cp $< $@",
+)
+
+genrule(
+    name = "docker_credential_gcr_amd64",
+    srcs = ["@com_github_googlecloudplatform_docker_credential_gcr//:docker-credential-gcr_amd64"],
+    outs = ["docker-credential-gcr_amd64"],
+    cmd = "cp $< $@",
+)
+
+genrule(
+    name = "docker_credential_gcr_arm64",
+    srcs = ["@com_github_googlecloudplatform_docker_credential_gcr//:docker-credential-gcr_arm64"],
+    outs = ["docker-credential-gcr_arm64"],
+    cmd = "cp $< $@",
+)
 
 go_library(
     name = "provisioner_lib",
@@ -20,7 +67,21 @@
         "main.go",
         "resume.go",
         "run.go",
+        "embeds_linux_amd64.go",
+        "embeds_linux_arm64.go",
     ],
+    embedsrcs = select({
+        "@io_bazel_rules_go//go/toolchain:amd64": [
+            ":handle_disk_layout_amd64.bin",
+            ":veritysetup_amd64.img",
+            ":docker_credential_gcr_amd64",
+        ],
+        "@io_bazel_rules_go//go/toolchain:arm64": [
+            ":handle_disk_layout_arm64.bin",
+            ":veritysetup_arm64.img",
+            ":docker_credential_gcr_arm64",
+        ],
+    }),
     importpath = "cos.googlesource.com/cos/tools.git/src/cmd/provisioner",
     visibility = ["//visibility:private"],
     deps = [
diff --git a/src/cmd/provisioner/embeds_linux_amd64.go b/src/cmd/provisioner/embeds_linux_amd64.go
new file mode 100644
index 0000000..427f337
--- /dev/null
+++ b/src/cmd/provisioner/embeds_linux_amd64.go
@@ -0,0 +1,26 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import _ "embed"
+
+//go:embed _handle_disk_layout_amd64.bin
+var handleDiskLayoutBin []byte
+
+//go:embed _veritysetup_amd64.img
+var veritySetupImage []byte
+
+//go:embed docker-credential-gcr_amd64
+var dockerCredentialGCR []byte
diff --git a/src/cmd/provisioner/embeds_linux_arm64.go b/src/cmd/provisioner/embeds_linux_arm64.go
new file mode 100644
index 0000000..b3c56b2
--- /dev/null
+++ b/src/cmd/provisioner/embeds_linux_arm64.go
@@ -0,0 +1,26 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import _ "embed"
+
+//go:embed _handle_disk_layout_arm64.bin
+var handleDiskLayoutBin []byte
+
+//go:embed _veritysetup_arm64.img
+var veritySetupImage []byte
+
+//go:embed docker-credential-gcr_arm64
+var dockerCredentialGCR []byte
diff --git a/src/cmd/provisioner/main.go b/src/cmd/provisioner/main.go
index 966ebfb..ef889b2 100644
--- a/src/cmd/provisioner/main.go
+++ b/src/cmd/provisioner/main.go
@@ -32,9 +32,6 @@
 	stateDir = flag.String("state-dir", "/var/lib/.cos-customizer", "Absolute path to the directory to use for provisioner state. "+
 		"This directory is used for persisting internal state across reboots, unpacking inputs, and running provisioning scripts. "+
 		"The size of the directory scales with the size of the inputs.")
-	dockerCredentialGCR = flag.String("docker-credential-gcr", "", "Path to the docker-credential-gcr executable to use during provisioning.")
-	veritySetupImage    = flag.String("veritysetup-image", "", "Path to the veritysetup file system tarball to use as a Docker container during provisioning.")
-	handleDiskLayoutBin = flag.String("handle-disk-layout-bin", "", "Path to the handle_disk_layout executable to use during provisioning.")
 )
 
 func main() {
@@ -59,9 +56,9 @@
 		Resize2fsCmd:        "resize2fs",
 		E2fsckCmd:           "e2fsck",
 		RootDir:             "/",
-		DockerCredentialGCR: *dockerCredentialGCR,
-		VeritySetupImage:    *veritySetupImage,
-		HandleDiskLayoutBin: *handleDiskLayoutBin,
+		DockerCredentialGCR: dockerCredentialGCR,
+		VeritySetupImage:    veritySetupImage,
+		HandleDiskLayoutBin: handleDiskLayoutBin,
 	}
 	var exitCode int
 	ret := subcommands.Execute(ctx, deps, &exitCode)
diff --git a/src/data/startup.yaml b/src/data/startup.yaml
index 9f55be1..20b8958 100644
--- a/src/data/startup.yaml
+++ b/src/data/startup.yaml
@@ -101,17 +101,9 @@
       status mkdir -p /mnt/disks/cidata
       status mount /dev/disk/by-label/CIDATA /mnt/disks/cidata
       if [[ ! -d /var/lib/.cos-customizer ]]; then
-        run_provisioner /mnt/disks/cidata/provisioner_${ARCH} \
-          --docker-credential-gcr=/mnt/disks/cidata/docker-credential-gcr_${ARCH} \
-          --veritysetup-image=/mnt/disks/cidata/veritysetup_${ARCH}.tar.gz \
-          --handle-disk-layout-bin=/mnt/disks/cidata/handle_disk_layout_bin_${ARCH} \
-          run --config=/mnt/disks/cidata/config.json
+        run_provisioner /mnt/disks/cidata/provisioner_${ARCH} run --config=/mnt/disks/cidata/config.json
       else
-        run_provisioner /mnt/disks/cidata/provisioner_${ARCH} \
-          --docker-credential-gcr=/mnt/disks/cidata/docker-credential-gcr_${ARCH} \
-          --veritysetup-image=/mnt/disks/cidata/veritysetup_${ARCH}.tar.gz \
-          --handle-disk-layout-bin=/mnt/disks/cidata/handle_disk_layout_bin_${ARCH} \
-          resume
+        run_provisioner /mnt/disks/cidata/provisioner_${ARCH} resume
       fi
     }
 
diff --git a/src/pkg/fs/file_system.go b/src/pkg/fs/file_system.go
index d7dd49f..e9139b7 100644
--- a/src/pkg/fs/file_system.go
+++ b/src/pkg/fs/file_system.go
@@ -61,12 +61,6 @@
 	DaisyWorkflow string
 	// DaisyBin points to the Daisy binary.
 	DaisyBin string
-	// CIDataImg points to the vfat image that delivers the provisioner and its
-	// dependencies to the build VM.
-	CIDataImg string
-	// ScratchImg points to an empty ext4 file system image that is used by the
-	// provisioner for scratch space.
-	ScratchImg string
 }
 
 // DefaultFiles builds a Files struct with a default file layout.
@@ -80,8 +74,6 @@
 		ProvConfig:              filepath.Join(persistentDir, provConfig),
 		DaisyWorkflow:           filepath.Join(volatileDir, daisyWorkflow),
 		DaisyBin:                daisyBin,
-		CIDataImg:               "/cidata.img",
-		ScratchImg:              "/scratch.img",
 	}
 }
 
diff --git a/src/pkg/preloader/BUILD.bazel b/src/pkg/preloader/BUILD.bazel
index 3fb01ca..021204a 100644
--- a/src/pkg/preloader/BUILD.bazel
+++ b/src/pkg/preloader/BUILD.bazel
@@ -14,12 +14,51 @@
 
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
+genrule(
+    name = "scratch",
+    outs = ["scratch.img"],
+    cmd = "\
+fallocate -l 512M $@;\
+mkfs.ext4 $@;\
+tune2fs -c0 -i0 $@;\
+e2label $@ SCRATCH",
+)
+
+genrule(
+    name = "cidata",
+    srcs = [
+        "//:src/data/startup.yaml",
+        "//src/cmd/provisioner:provisioner_amd64",
+        "//src/cmd/provisioner:provisioner_arm64",
+        "//src/cmd/metadata_watcher:metadata_watcher_amd64",
+        "//src/cmd/metadata_watcher:metadata_watcher_arm64",
+    ],
+    outs = ["cidata.img"],
+    cmd = "\
+$(location @dosfstools//:mkfs.fat) -n CIDATA -S 512 -s 8 -C $@ 131072;\
+touch meta-data;\
+$(location @mtools//:mcopy) -i $@ $(location //:src/data/startup.yaml) ::/user-data;\
+$(location @mtools//:mcopy) -i $@ meta-data ::/meta-data;\
+$(location @mtools//:mcopy) -i $@ $(location //src/cmd/provisioner:provisioner_amd64) ::/provisioner_amd64;\
+$(location @mtools//:mcopy) -i $@ $(location //src/cmd/provisioner:provisioner_arm64) ::/provisioner_arm64;\
+$(location @mtools//:mcopy) -i $@ $(location //src/cmd/metadata_watcher:metadata_watcher_amd64) ::/metadata_watcher_amd64;\
+$(location @mtools//:mcopy) -i $@ $(location //src/cmd/metadata_watcher:metadata_watcher_arm64) ::/metadata_watcher_arm64;",
+    tools = [
+        "@dosfstools//:mkfs.fat",
+        "@mtools//:mcopy",
+    ],
+)
+
 go_library(
     name = "preloader",
     srcs = [
         "gcs.go",
         "preload.go",
     ],
+    embedsrcs = [
+        ":cidata",
+	":scratch"
+    ],
     importpath = "cos.googlesource.com/cos/tools.git/src/pkg/preloader",
     visibility = ["//visibility:public"],
     deps = [
diff --git a/src/pkg/preloader/preload.go b/src/pkg/preloader/preload.go
index dba5e9e..23dccbf 100644
--- a/src/pkg/preloader/preload.go
+++ b/src/pkg/preloader/preload.go
@@ -18,6 +18,7 @@
 
 import (
 	"context"
+	_ "embed"
 	"encoding/json"
 	"fmt"
 	"io/ioutil"
@@ -39,6 +40,12 @@
 	"cloud.google.com/go/storage"
 )
 
+//go:embed cidata.img
+var ciDataImg []byte
+
+//go:embed scratch.img
+var scratchImg []byte
+
 // storeInGCS stores the given files in GCS using the given gcsManager.
 // Files to store are provided in a map where each key is a file on the local
 // file system and each value is the relative path in GCS at which to store the
@@ -196,16 +203,18 @@
 	return utils.RunCommand([]string{"mcopy", "-i", path, files.ProvConfig, "::/config.json"}, "", nil)
 }
 
-func writeImage(fileName string) (path string, err error) {
+func writeImage(imgData *[]byte) (path string, err error) {
 	img, err := ioutil.TempFile(fs.ScratchDir, "img-")
 	if err != nil {
 		return "", err
 	}
-	if err := img.Close(); err != nil {
-		return "", err
+	_, writeErr := img.Write(*imgData)
+	closeErr := img.Close()
+	if writeErr != nil {
+		return "", writeErr
 	}
-	if err := utils.CopyFile(fileName, img.Name()); err != nil {
-		return "", err
+	if closeErr != nil {
+		return "", closeErr
 	}
 	return img.Name(), err
 }
@@ -296,7 +305,7 @@
 	if err := updateProvConfig(provConfig, buildSpec, buildContexts, gcs, files); err != nil {
 		return nil, err
 	}
-	ciDataFile, err := writeImage(files.CIDataImg)
+	ciDataFile, err := writeImage(&ciDataImg)
 	if err != nil {
 		return nil, err
 	}
@@ -307,7 +316,11 @@
 	if err != nil {
 		return nil, err
 	}
-	scratchImgFileTar, err := tarImage(files.ScratchImg)
+	scratchImgFile, err := writeImage(&scratchImg)
+	if err != nil {
+		return nil, err
+	}
+	scratchImgFileTar, err := tarImage(scratchImgFile)
 	if err != nil {
 		return nil, err
 	}
diff --git a/src/pkg/preloader/preload_test.go b/src/pkg/preloader/preload_test.go
index bd14663..045a8bc 100644
--- a/src/pkg/preloader/preload_test.go
+++ b/src/pkg/preloader/preload_test.go
@@ -28,7 +28,6 @@
 	"cos.googlesource.com/cos/tools.git/src/pkg/fakes"
 	"cos.googlesource.com/cos/tools.git/src/pkg/fs"
 	"cos.googlesource.com/cos/tools.git/src/pkg/provisioner"
-	"cos.googlesource.com/cos/tools.git/src/pkg/utils"
 
 	"github.com/google/go-cmp/cmp"
 	compute "google.golang.org/api/compute/v1"
@@ -66,16 +65,6 @@
 		os.RemoveAll(tmpDir)
 		return "", nil, err
 	}
-	files.CIDataImg = filepath.Join(tmpDir, "cidata.img")
-	if err := utils.RunCommand([]string{"mkfs.fat", "-n", "CIDATA", "-S", "512", "-s", "8", "-C", files.CIDataImg, "131072"}, tmpDir, nil); err != nil {
-		os.RemoveAll(tmpDir)
-		return "", nil, err
-	}
-	files.ScratchImg, err = createTempFile(tmpDir)
-	if err != nil {
-		os.RemoveAll(tmpDir)
-		return "", nil, err
-	}
 	return tmpDir, files, nil
 }
 
diff --git a/src/pkg/provisioner/config.go b/src/pkg/provisioner/config.go
index adb1191..a0ccf09 100644
--- a/src/pkg/provisioner/config.go
+++ b/src/pkg/provisioner/config.go
@@ -94,9 +94,9 @@
 type stepDeps struct {
 	// GCSClient is used to access Google Cloud Storage.
 	GCSClient *storage.Client
-	// VeritySetupImage is a path to a file system tarball (can be imported as a
-	// Docker image) that contains the "veritysetup" tool.
-	VeritySetupImage string
+	// VeritySetupImage is an embedded Docker image that contains the
+	// "veritysetup" tool.
+	VeritySetupImage []byte
 }
 
 type step interface {
diff --git a/src/pkg/provisioner/disk_layout.go b/src/pkg/provisioner/disk_layout.go
index 7950700..5cb418a 100644
--- a/src/pkg/provisioner/disk_layout.go
+++ b/src/pkg/provisioner/disk_layout.go
@@ -101,11 +101,7 @@
 	if err := mountFunc("", filepath.Join(deps.RootDir, "tmp"), "", unix.MS_REMOUNT|unix.MS_NOSUID|unix.MS_NODEV, ""); err != nil {
 		return fmt.Errorf("error remounting /tmp as exec: %v", err)
 	}
-	out := filepath.Join(deps.RootDir, "tmp", "handle_disk_layout.bin")
-	if err := utils.CopyFile(deps.HandleDiskLayoutBin, out); err != nil {
-		return err
-	}
-	if err := os.Chmod(out, 755); err != nil {
+	if err := ioutil.WriteFile(filepath.Join(deps.RootDir, "tmp", "handle_disk_layout.bin"), deps.HandleDiskLayoutBin, 0744); err != nil {
 		return err
 	}
 	data := fmt.Sprintf(`[Unit]
diff --git a/src/pkg/provisioner/provisioner.go b/src/pkg/provisioner/provisioner.go
index 48f9f28..954a5eb 100644
--- a/src/pkg/provisioner/provisioner.go
+++ b/src/pkg/provisioner/provisioner.go
@@ -115,10 +115,7 @@
 		}
 	}
 	if _, err := os.Stat(dockerCredentialGCRPath); os.IsNotExist(err) {
-		if err := utils.CopyFile(deps.DockerCredentialGCR, dockerCredentialGCRPath); err != nil {
-			return err
-		}
-		if err := os.Chmod(dockerCredentialGCRPath, 0755); err != nil {
+		if err := ioutil.WriteFile(dockerCredentialGCRPath, deps.DockerCredentialGCR, 0744); err != nil {
 			return err
 		}
 	}
@@ -337,15 +334,15 @@
 	// RootDir is the path to the root file system. Should be "/" in all real
 	// runtime situations.
 	RootDir string
-	// DockerCredentialGCR is a path to a docker-credential-gcr program to use as a Docker
+	// DockerCredentialGCR is an embedded docker-credential-gcr program to use as a Docker
 	// credential helper.
-	DockerCredentialGCR string
-	// VeritySetupImage is a path to a file system tarball (which can be imported
-	// as a Docker image) that contains the "veritysetup" tool.
-	VeritySetupImage string
-	// HandleDiskLayoutBin is a path to a program for reformatting a COS disk
+	DockerCredentialGCR []byte
+	// VeritySetupImage is an embedded Docker image that contains the
+	// "veritysetup" tool.
+	VeritySetupImage []byte
+	// HandleDiskLayoutBin is an embedded program for reformatting a COS disk
 	// image.
-	HandleDiskLayoutBin string
+	HandleDiskLayoutBin []byte
 }
 
 func run(ctx context.Context, deps Deps, runState *state) (err error) {
diff --git a/src/pkg/provisioner/provisioner_test.go b/src/pkg/provisioner/provisioner_test.go
index a4172c2..92af977 100644
--- a/src/pkg/provisioner/provisioner_test.go
+++ b/src/pkg/provisioner/provisioner_test.go
@@ -27,6 +27,8 @@
 	"golang.org/x/sys/unix"
 )
 
+const trueExecutable = "#!/bin/bash\ntrue"
+
 func testDataDir(t *testing.T) string {
 	t.Helper()
 	path, err := filepath.Abs("testdata")
@@ -71,9 +73,9 @@
 		GCSClient:           nil,
 		TarCmd:              "",
 		SystemctlCmd:        "",
-		DockerCredentialGCR: "/bin/true",
-		VeritySetupImage:    "/bin/true",
-		HandleDiskLayoutBin: "/bin/true",
+		DockerCredentialGCR: []byte(trueExecutable),
+		VeritySetupImage:    []byte(trueExecutable),
+		HandleDiskLayoutBin: []byte(trueExecutable),
 	}
 	config := Config{}
 	if err := Run(ctx, deps, dir, config); err != errStateAlreadyExists {
@@ -116,9 +118,9 @@
 				TarCmd:              "tar",
 				SystemctlCmd:        "/bin/true",
 				RootDir:             tempDir,
-				DockerCredentialGCR: "/bin/true",
-				VeritySetupImage:    "/bin/true",
-				HandleDiskLayoutBin: "/bin/true",
+				DockerCredentialGCR: []byte(trueExecutable),
+				VeritySetupImage:    []byte(trueExecutable),
+				HandleDiskLayoutBin: []byte(trueExecutable),
 			}
 			stateDir := filepath.Join(tempDir, "var", "lib", ".cos-customizer")
 			if err := stubMountInfo(filepath.Join(tempDir, "proc", "self", "mountinfo"), filepath.Join(stateDir, "bin")); err != nil {
@@ -191,9 +193,9 @@
 				TarCmd:              "tar",
 				SystemctlCmd:        "/bin/true",
 				RootDir:             tempDir,
-				DockerCredentialGCR: "/bin/true",
-				VeritySetupImage:    "/bin/true",
-				HandleDiskLayoutBin: "/bin/true",
+				DockerCredentialGCR: []byte(trueExecutable),
+				VeritySetupImage:    []byte(trueExecutable),
+				HandleDiskLayoutBin: []byte(trueExecutable),
 			}
 			stateDir := filepath.Join(tempDir, "var", "lib", ".cos-customizer")
 			if err := stubMountInfo(filepath.Join(tempDir, "proc", "self", "mountinfo"), filepath.Join(stateDir, "bin")); err != nil {
@@ -274,9 +276,9 @@
 				TarCmd:              "tar",
 				SystemctlCmd:        "/bin/true",
 				RootDir:             tempDir,
-				DockerCredentialGCR: "/bin/true",
-				VeritySetupImage:    "/bin/true",
-				HandleDiskLayoutBin: "/bin/true",
+				DockerCredentialGCR: []byte(trueExecutable),
+				VeritySetupImage:    []byte(trueExecutable),
+				HandleDiskLayoutBin: []byte(trueExecutable),
 			}
 			stateDir := filepath.Join(tempDir, "var", "lib", ".cos-customizer")
 			if err := stubMountInfo(filepath.Join(tempDir, "proc", "self", "mountinfo"), filepath.Join(stateDir, "bin")); err != nil {
diff --git a/src/pkg/provisioner/seal_oem_step.go b/src/pkg/provisioner/seal_oem_step.go
index 22e8795..9c1415e 100644
--- a/src/pkg/provisioner/seal_oem_step.go
+++ b/src/pkg/provisioner/seal_oem_step.go
@@ -16,12 +16,12 @@
 
 import (
 	"context"
+	"io/ioutil"
 	"log"
 	"os"
 	"path/filepath"
 
 	"cos.googlesource.com/cos/tools.git/src/pkg/tools"
-	"cos.googlesource.com/cos/tools.git/src/pkg/utils"
 )
 
 type SealOEMStep struct{}
@@ -30,7 +30,7 @@
 	log.Println("Sealing the OEM partition with dm-verity")
 	veritysetupImgPath := filepath.Join(runState.dir, "veritysetup.img")
 	if _, err := os.Stat(veritysetupImgPath); os.IsNotExist(err) {
-		if err := utils.CopyFile(deps.VeritySetupImage, veritysetupImgPath); err != nil {
+		if err := ioutil.WriteFile(veritysetupImgPath, deps.VeritySetupImage, 0644); err != nil {
 			return err
 		}
 	}
diff --git a/src/pkg/tools/seal_oem_partition.go b/src/pkg/tools/seal_oem_partition.go
index 604bc75..cd86cf6 100644
--- a/src/pkg/tools/seal_oem_partition.go
+++ b/src/pkg/tools/seal_oem_partition.go
@@ -73,14 +73,13 @@
 // loadVeritysetupImage loads the docker image of veritysetup.
 // return the image ID.
 func loadVeritysetupImage(imgPath string) (string, error) {
-	tag := "veritysetup:veritysetup_" + runtime.GOARCH
-	cmd := exec.Command("sudo", "docker", "import", imgPath, tag)
+	cmd := exec.Command("sudo", "docker", "load", "-i", imgPath)
 	if err := cmd.Run(); err != nil {
 		return "", fmt.Errorf("error in loading docker image, "+
 			"input: imgPath=%q, error msg: (%v)", imgPath, err)
 	}
 	var idBuf bytes.Buffer
-	cmd = exec.Command("sudo", "docker", "images", tag, "-q")
+	cmd = exec.Command("sudo", "docker", "images", "veritysetup:veritysetup_"+runtime.GOARCH, "-q")
 	cmd.Stdout = &idBuf
 	cmd.Stderr = os.Stderr
 	if err := cmd.Run(); err != nil {
@@ -200,7 +199,7 @@
 	dmVersion := 0
 	for idx, line := range lines {
 		if !strings.Contains(line, "dm=") &&
-			!strings.Contains(line, "dm-mod.create=") {
+		   !strings.Contains(line, "dm-mod.create=") {
 			continue
 		}
 		var startPos = strings.Index(line, "dm=")
@@ -215,7 +214,7 @@
 			lineBuf[startPos+4] = '2'
 			lines[idx] = strings.Join(append(strings.Split(string(lineBuf), ","), entryStringV0), ",")
 		} else {
-			configs := []string{string(lineBuf), entryStringV1}
+			configs := []string {string(lineBuf), entryStringV1}
 			lines[idx] = strings.Join(configs, ";")
 		}
 	}
diff --git a/src/third_party/dosfstools/BUILD.bazel b/src/third_party/dosfstools/BUILD.bazel
new file mode 100644
index 0000000..8e71575
--- /dev/null
+++ b/src/third_party/dosfstools/BUILD.bazel
@@ -0,0 +1,13 @@
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the License);
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an AS IS BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
diff --git a/src/third_party/dosfstools/BUILD.dosfstools.bazel b/src/third_party/dosfstools/BUILD.dosfstools.bazel
new file mode 100644
index 0000000..98ee6e8
--- /dev/null
+++ b/src/third_party/dosfstools/BUILD.dosfstools.bazel
@@ -0,0 +1,49 @@
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the License);
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an AS IS BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+load("@rules_foreign_cc//tools/build_defs:configure.bzl", "configure_make")
+
+package(default_visibility = ["//visibility:public"])
+
+filegroup(
+    name = "all_srcs",
+    srcs = glob(["**"]),
+)
+
+configure_make(
+    name = "dosfstools_pkg",
+    lib_source = ":all_srcs",
+    configure_options = ["--disable-dependency-tracking"],
+    make_commands = [
+        # dosfstools requires the path to 'make' be present in the MAKE
+        # variable. Since the configure_make() rule doesn't do this for us, some
+        # magic is needed.
+        # 1. Set MAKE to the output of a 'shell' function that reads the path of
+        # the parent process. The parent process of the 'shell' function is the
+        # make process, run by configure_make() using the correct make program.
+        # 2. Write "$$PID" as "$$$PID$$". We do this because the
+        # configure_make() rule has a substitution that does "$$PID$$" ->
+        # "$PID".
+        "make MAKE='$(shell realpath /proc/$$$PPID$$/exe)'",
+        "make MAKE='$(shell realpath /proc/$$$PPID$$/exe)' install",
+    ],
+    out_bin_dir = "sbin",
+    binaries = ["mkfs.fat"],
+)
+
+filegroup(
+    name = "mkfs.fat",
+    srcs = [":dosfstools_pkg"],
+    output_group = "mkfs.fat",
+)
diff --git a/src/third_party/dosfstools/dosfstools_repositories.bzl b/src/third_party/dosfstools/dosfstools_repositories.bzl
new file mode 100644
index 0000000..1c839ca
--- /dev/null
+++ b/src/third_party/dosfstools/dosfstools_repositories.bzl
@@ -0,0 +1,28 @@
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the License);
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an AS IS BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load("@bazel_tools//tools/build_defs/repo:utils.bzl", "maybe")
+
+def dosfstools_repositories():
+    """Load all repositories needed for dosfstools."""
+
+    maybe(
+        http_archive,
+        name = "dosfstools",
+        build_file = Label("//src/third_party/dosfstools:BUILD.dosfstools.bazel"),
+        strip_prefix = "dosfstools-4.2",
+        urls = ["https://github.com/dosfstools/dosfstools/releases/download/v4.2/dosfstools-4.2.tar.gz"],
+        sha256 = "64926eebf90092dca21b14259a5301b7b98e7b1943e8a201c7d726084809b527",
+    )
diff --git a/src/third_party/mtools/BUILD.bazel b/src/third_party/mtools/BUILD.bazel
new file mode 100644
index 0000000..8e71575
--- /dev/null
+++ b/src/third_party/mtools/BUILD.bazel
@@ -0,0 +1,13 @@
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the License);
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an AS IS BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
diff --git a/src/third_party/mtools/BUILD.mtools.bazel b/src/third_party/mtools/BUILD.mtools.bazel
new file mode 100644
index 0000000..9b0f74d
--- /dev/null
+++ b/src/third_party/mtools/BUILD.mtools.bazel
@@ -0,0 +1,34 @@
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the License);
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an AS IS BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+load("@rules_foreign_cc//tools/build_defs:configure.bzl", "configure_make")
+
+package(default_visibility = ["//visibility:public"])
+
+filegroup(
+    name = "all_srcs",
+    srcs = glob(["**"]),
+)
+
+configure_make(
+    name = "mtools_pkg",
+    lib_source = ":all_srcs",
+    binaries = ["mcopy"],
+)
+
+filegroup(
+    name = "mcopy",
+    srcs = [":mtools_pkg"],
+    output_group = "mcopy",
+)
diff --git a/src/third_party/mtools/mtools_repositories.bzl b/src/third_party/mtools/mtools_repositories.bzl
new file mode 100644
index 0000000..79064d9
--- /dev/null
+++ b/src/third_party/mtools/mtools_repositories.bzl
@@ -0,0 +1,31 @@
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the License);
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an AS IS BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load("@bazel_tools//tools/build_defs/repo:utils.bzl", "maybe")
+
+def mtools_repositories():
+    """Load all repositories needed for mtools."""
+
+    maybe(
+        http_archive,
+        name = "mtools",
+        build_file = Label("//src/third_party/mtools:BUILD.mtools.bazel"),
+        strip_prefix = "mtools-4.0.26",
+        urls = [
+            "https://mirror.bazel.build/ftp.gnu.org/gnu/mtools/mtools-4.0.26.tar.gz",
+            "http://ftp.gnu.org/gnu/mtools/mtools-4.0.26.tar.gz",
+        ],
+        sha256 = "b1adb6973d52b3b70b16047e682f96ef1b669d6b16894c9056a55f407e71cd0f",
+    )
diff --git a/testing/deprecate_test.yaml b/testing/deprecate_test.yaml
index 572cd18..93dfa34 100644
--- a/testing/deprecate_test.yaml
+++ b/testing/deprecate_test.yaml
@@ -13,38 +13,38 @@
 # limitations under the License.
 
 substitutions:
-  '_TEST': 'deprecate_test'
-  '_INPUT_IMAGE': 'cos-93-16623-461-15'
-  '_INPUT_PROJECT': 'cos-cloud'
+  "_TEST": "deprecate_test"
+  "_INPUT_IMAGE": "cos-dev-69-10895-0-0"
+  "_INPUT_PROJECT": "cos-cloud"
 steps:
-- name: 'gcr.io/cloud-builders/docker'
-  args: ['build', '-f', 'src/cmd/cos_customizer/Dockerfile', '-t', 'cos_customizer', '.']
+- name: 'gcr.io/cloud-builders/bazel'
+  args: ["run", "--spawn_strategy=standalone", ":cos_customizer", "--", "--norun"]
 - name: 'gcr.io/cloud-builders/gcloud'
-  args: ['compute', 'images', 'create', 'preload-test-$BUILD_ID-old',
-         '--source-image=${_INPUT_IMAGE}', '--source-image-project=${_INPUT_PROJECT}',
-         '--family=test-family']
-- name: 'cos_customizer'
-  args: ['start-image-build',
-         '-build-context=testing/${_TEST}',
-         '-image-name=${_INPUT_IMAGE}',
-         '-image-project=${_INPUT_PROJECT}',
-         '-gcs-bucket=${PROJECT_ID}_cloudbuild',
-         '-gcs-workdir=customizer-$BUILD_ID']
-- name: 'cos_customizer'
-  args: ['finish-image-build',
-         '-zone=us-west1-b',
-         '-project=$PROJECT_ID',
-         '-image-name=preload-test-$BUILD_ID',
-         '-image-family=test-family',
-         '-deprecate-old-images',
-         '-image-project=$PROJECT_ID']
+  args: ["compute", "images", "create", "preload-test-$BUILD_ID-old",
+         "--source-image=${_INPUT_IMAGE}", "--source-image-project=${_INPUT_PROJECT}",
+         "--family=test-family"]
+- name: 'bazel:cos_customizer'
+  args: ["start-image-build",
+         "-build-context=testing/${_TEST}",
+         "-image-name=${_INPUT_IMAGE}",
+         "-image-project=${_INPUT_PROJECT}",
+         "-gcs-bucket=${PROJECT_ID}_cloudbuild",
+         "-gcs-workdir=customizer-$BUILD_ID"]
+- name: 'bazel:cos_customizer'
+  args: ["finish-image-build",
+         "-zone=us-west1-b",
+         "-project=$PROJECT_ID",
+         "-image-name=preload-test-$BUILD_ID",
+         "-image-family=test-family",
+         "-deprecate-old-images",
+         "-image-project=$PROJECT_ID"]
 - name: 'gcr.io/cloud-builders/gcloud'
   entrypoint: '/bin/bash'
   env:
-  - 'OLD_IMAGE=preload-test-$BUILD_ID-old'
-  - 'IMAGE=preload-test-$BUILD_ID'
-  - 'PROJECT=$PROJECT_ID'
-  args: ['/workspace/testing/${_TEST}/run_test.sh']
+  - "OLD_IMAGE=preload-test-$BUILD_ID-old"
+  - "IMAGE=preload-test-$BUILD_ID"
+  - "PROJECT=$PROJECT_ID"
+  args: ["/workspace/testing/${_TEST}/run_test.sh"]
 options:
   machineType: 'N1_HIGHCPU_8'
-timeout: '7200s'
+timeout: "7200s"
diff --git a/testing/disable_auto_update_test.yaml b/testing/disable_auto_update_test.yaml
index 5a724b5..4231a0e 100644
--- a/testing/disable_auto_update_test.yaml
+++ b/testing/disable_auto_update_test.yaml
@@ -13,34 +13,34 @@
 # limitations under the License.
 
 substitutions:
-  '_TEST': 'disable_auto_update_test'
-  '_INPUT_IMAGE': 'cos-81-12871-148-0'
-  '_INPUT_PROJECT': 'cos-cloud'
+  "_TEST": "disable_auto_update_test"
+  "_INPUT_IMAGE": "cos-81-12871-148-0"
+  "_INPUT_PROJECT": "cos-cloud"
 steps:
-- name: 'gcr.io/cloud-builders/docker'
-  args: ['build', '-f', 'src/cmd/cos_customizer/Dockerfile', '-t', 'cos_customizer', '.']
-- name: 'cos_customizer'
-  args: ['start-image-build',
-         '-build-context=testing/${_TEST}',
-         '-image-name=${_INPUT_IMAGE}',
-         '-image-project=${_INPUT_PROJECT}',
-         '-gcs-bucket=${PROJECT_ID}_cloudbuild',
-         '-gcs-workdir=customizer-$BUILD_ID']
-- name: 'cos_customizer'
-  args: ['run-script',
-         '-script=preload.sh']
-- name: 'cos_customizer'
-  args: ['disable-auto-update']
-- name: 'cos_customizer'
-  args: ['finish-image-build',
-         '-zone=us-west1-b',
-         '-project=$PROJECT_ID',
-         '-image-name=preload-test-$BUILD_ID',
-         '-image-project=$PROJECT_ID']
+- name: 'gcr.io/cloud-builders/bazel'
+  args: ["run", "--spawn_strategy=standalone", ":cos_customizer", "--", "--norun"]
+- name: 'bazel:cos_customizer'
+  args: ["start-image-build",
+         "-build-context=testing/${_TEST}",
+         "-image-name=${_INPUT_IMAGE}",
+         "-image-project=${_INPUT_PROJECT}",
+         "-gcs-bucket=${PROJECT_ID}_cloudbuild",
+         "-gcs-workdir=customizer-$BUILD_ID"]
+- name: 'bazel:cos_customizer'
+  args: ["run-script",
+         "-script=preload.sh"]
+- name: 'bazel:cos_customizer'
+  args: ["disable-auto-update"]        
+- name: 'bazel:cos_customizer'
+  args: ["finish-image-build",
+         "-zone=us-west1-b",
+         "-project=$PROJECT_ID",
+         "-image-name=preload-test-$BUILD_ID",
+         "-image-project=$PROJECT_ID"]
 - name: 'gcr.io/compute-image-tools/daisy'
-  args: ['-project=$PROJECT_ID', '-zone=us-west1-b', '-var:image_name',
-         'preload-test-$BUILD_ID', '-var:image_project', '$PROJECT_ID',
-         '-var:test_cfg', '../${_TEST}/preload_test.cfg', 'testing/util/run_test.wf.json']
+  args: ["-project=$PROJECT_ID", "-zone=us-west1-b", "-var:image_name",
+         "preload-test-$BUILD_ID", "-var:image_project", "$PROJECT_ID",
+         "-var:test_cfg", "../${_TEST}/preload_test.cfg", "testing/util/run_test.wf.json"]
 options:
   machineType: 'N1_HIGHCPU_32'
-timeout: '7200s'
+timeout: "7200s"
diff --git a/testing/env_test.yaml b/testing/env_test.yaml
index 11b1a8e..dad5b19 100644
--- a/testing/env_test.yaml
+++ b/testing/env_test.yaml
@@ -13,33 +13,33 @@
 # limitations under the License.
 
 substitutions:
-  '_TEST': 'env_test'
-  '_INPUT_IMAGE': 'cos-93-16623-461-15'
-  '_INPUT_PROJECT': 'cos-cloud'
+  "_TEST": "env_test"
+  "_INPUT_IMAGE": "cos-dev-69-10895-0-0"
+  "_INPUT_PROJECT": "cos-cloud"
 steps:
-- name: 'gcr.io/cloud-builders/docker'
-  args: ['build', '-f', 'src/cmd/cos_customizer/Dockerfile', '-t', 'cos_customizer', '.']
-- name: 'cos_customizer'
-  args: ['start-image-build',
-         '-build-context=testing/${_TEST}',
-         '-image-name=${_INPUT_IMAGE}',
-         '-image-project=${_INPUT_PROJECT}',
-         '-gcs-bucket=${PROJECT_ID}_cloudbuild',
-         '-gcs-workdir=customizer-$BUILD_ID']
-- name: 'cos_customizer'
-  args: ['run-script',
-         '-script=preload.sh',
-         '-env=HELLO=hello']
-- name: 'cos_customizer'
-  args: ['finish-image-build',
-         '-zone=us-west1-b',
-         '-project=$PROJECT_ID',
-         '-image-name=preload-test-$BUILD_ID',
-         '-image-project=$PROJECT_ID']
+- name: 'gcr.io/cloud-builders/bazel'
+  args: ["run", "--spawn_strategy=standalone", ":cos_customizer", "--", "--norun"]
+- name: 'bazel:cos_customizer'
+  args: ["start-image-build",
+         "-build-context=testing/${_TEST}",
+         "-image-name=${_INPUT_IMAGE}",
+         "-image-project=${_INPUT_PROJECT}",
+         "-gcs-bucket=${PROJECT_ID}_cloudbuild",
+         "-gcs-workdir=customizer-$BUILD_ID"]
+- name: 'bazel:cos_customizer'
+  args: ["run-script",
+         "-script=preload.sh",
+         "-env=HELLO=hello"]
+- name: 'bazel:cos_customizer'
+  args: ["finish-image-build",
+         "-zone=us-west1-b",
+         "-project=$PROJECT_ID",
+         "-image-name=preload-test-$BUILD_ID",
+         "-image-project=$PROJECT_ID"]
 - name: 'gcr.io/compute-image-tools/daisy'
-  args: ['-project=$PROJECT_ID', '-zone=us-west1-b', '-var:image_name',
-         'preload-test-$BUILD_ID', '-var:image_project', '$PROJECT_ID',
-         '-var:test_cfg', '../${_TEST}/preload_test.cfg', 'testing/util/run_test.wf.json']
+  args: ["-project=$PROJECT_ID", "-zone=us-west1-b", "-var:image_name",
+         "preload-test-$BUILD_ID", "-var:image_project", "$PROJECT_ID",
+         "-var:test_cfg", "../${_TEST}/preload_test.cfg", "testing/util/run_test.wf.json"]
 options:
   machineType: 'N1_HIGHCPU_8'
-timeout: '7200s'
+timeout: "7200s"
diff --git a/testing/extend_oem_test/extend_oem_test.yaml b/testing/extend_oem_test/extend_oem_test.yaml
index dea2b5a..5516179 100644
--- a/testing/extend_oem_test/extend_oem_test.yaml
+++ b/testing/extend_oem_test/extend_oem_test.yaml
@@ -13,40 +13,40 @@
 # limitations under the License.
 
 substitutions:
-  '_TEST': 'extend_oem_test'
-  '_INPUT_IMAGE': 'cos-81-12871-148-0'
-  '_INPUT_PROJECT': 'cos-cloud'
-  '_OEM_SIZE': ''
-  '_DISK_SIZE': ''
-  '_OEM_SIZE_TH': ''
+  "_TEST": "extend_oem_test"
+  "_INPUT_IMAGE": "cos-81-12871-148-0"
+  "_INPUT_PROJECT": "cos-cloud"
+  "_OEM_SIZE": ""
+  "_DISK_SIZE": ""
+  "_OEM_SIZE_TH": ""
 steps:
-- name: 'gcr.io/cloud-builders/docker'
-  args: ['build', '-f', 'src/cmd/cos_customizer/Dockerfile', '-t', 'cos_customizer', '.']
+- name: 'gcr.io/cloud-builders/bazel'
+  args: ["run", "--spawn_strategy=standalone", ":cos_customizer", "--", "--norun"]
 - name: 'busybox'
-  args: ['sed', '-i', '-e', 's|%s|"${_OEM_SIZE_TH}"|',
-         'testing/${_TEST}/preload_test.cfg']
-- name: 'cos_customizer'
-  args: ['start-image-build',
-         '-build-context=testing/${_TEST}',
-         '-image-name=${_INPUT_IMAGE}',
-         '-image-project=${_INPUT_PROJECT}',
-         '-gcs-bucket=${PROJECT_ID}_cloudbuild',
-         '-gcs-workdir=customizer-$BUILD_ID']
-- name: 'cos_customizer'
-  args: ['run-script',
-         '-script=preload.sh']
-- name: 'cos_customizer'
-  args: ['finish-image-build',
-         '-zone=us-west1-b',
-         '-project=$PROJECT_ID',
-         '-image-name=preload-test-$BUILD_ID',
-         '-image-project=$PROJECT_ID',
-         '-disk-size-gb=${_DISK_SIZE}',
-         '-oem-size=${_OEM_SIZE}']
+  args: ["sed", "-i", "-e", "s|%s|'${_OEM_SIZE_TH}'|",
+         "testing/${_TEST}/preload_test.cfg"]
+- name: 'bazel:cos_customizer'
+  args: ["start-image-build",
+         "-build-context=testing/${_TEST}",
+         "-image-name=${_INPUT_IMAGE}",
+         "-image-project=${_INPUT_PROJECT}",
+         "-gcs-bucket=${PROJECT_ID}_cloudbuild",
+         "-gcs-workdir=customizer-$BUILD_ID"]
+- name: 'bazel:cos_customizer'
+  args: ["run-script",
+         "-script=preload.sh"]
+- name: 'bazel:cos_customizer'
+  args: ["finish-image-build",
+         "-zone=us-west1-b",
+         "-project=$PROJECT_ID",
+         "-image-name=preload-test-$BUILD_ID",
+         "-image-project=$PROJECT_ID",
+         "-disk-size-gb=${_DISK_SIZE}",
+         "-oem-size=${_OEM_SIZE}"]
 - name: 'gcr.io/compute-image-tools/daisy'
-  args: ['-project=$PROJECT_ID', '-zone=us-west1-b', '-var:image_name',
-         'preload-test-$BUILD_ID', '-var:image_project', '$PROJECT_ID',
-         '-var:test_cfg', '../${_TEST}/preload_test.cfg', 'testing/util/run_test.wf.json']
+  args: ["-project=$PROJECT_ID", "-zone=us-west1-b", "-var:image_name",
+         "preload-test-$BUILD_ID", "-var:image_project", "$PROJECT_ID",
+         "-var:test_cfg", "../${_TEST}/preload_test.cfg", "testing/util/run_test.wf.json"]
 options:
   machineType: 'N1_HIGHCPU_32'
-timeout: '7200s'
+timeout: "7200s"
diff --git a/testing/gpu_test/gpu_test.yaml b/testing/gpu_test/gpu_test.yaml
index d97fe5c..c9f49de 100644
--- a/testing/gpu_test/gpu_test.yaml
+++ b/testing/gpu_test/gpu_test.yaml
@@ -13,16 +13,16 @@
 # limitations under the License.
 
 substitutions:
-  '_TEST': 'gpu_test'
-  '_INPUT_IMAGE': 'cos-89-16108-798-1'
-  '_INPUT_PROJECT': 'cos-cloud'
-  '_DRIVER_VERSION': ''
-  '_DEPS_DIR': ''
+  "_TEST": "gpu_test"
+  "_INPUT_IMAGE": "cos-89-16108-798-1"
+  "_INPUT_PROJECT": "cos-cloud"
+  "_DRIVER_VERSION": ""
+  "_DEPS_DIR": ""
 steps:
-- name: 'gcr.io/cloud-builders/docker'
-  args: ['build', '-f', 'src/cmd/cos_customizer/Dockerfile', '-t', 'cos_customizer', '.']
+- name: 'gcr.io/cloud-builders/bazel'
+  args: ["run", "--spawn_strategy=standalone", ":cos_customizer", "--", "--norun"]
 - name: 'ubuntu'
-  args:
+  args: 
   - bash
   - -c
   - |
@@ -33,32 +33,32 @@
       sub="${ver}"
     fi
     sed -i -e "s|%s|'${sub}'|" testing/${_TEST}/preload_test.cfg
-- name: 'cos_customizer'
-  args: ['start-image-build',
-         '-build-context=testing/${_TEST}',
-         '-image-name=${_INPUT_IMAGE}',
-         '-image-project=${_INPUT_PROJECT}',
-         '-gcs-bucket=${PROJECT_ID}_cloudbuild',
-         '-gcs-workdir=customizer-$BUILD_ID']
-- name: 'cos_customizer'
-  args: ['install-gpu',
-         '-version=${_DRIVER_VERSION}',
-         '-gpu-type=nvidia-tesla-t4',
-         '-deps-dir=${_DEPS_DIR}']
-- name: 'cos_customizer'
-  args: ['run-script',
-         '-script=preload.sh']
-- name: 'cos_customizer'
-  args: ['finish-image-build',
-         '-zone=us-west1-b',
-         '-project=$PROJECT_ID',
-         '-image-name=preload-test-$BUILD_ID',
-         '-image-project=$PROJECT_ID']
+- name: 'bazel:cos_customizer'
+  args: ["start-image-build",
+         "-build-context=testing/${_TEST}",
+         "-image-name=${_INPUT_IMAGE}",
+         "-image-project=${_INPUT_PROJECT}",
+         "-gcs-bucket=${PROJECT_ID}_cloudbuild",
+         "-gcs-workdir=customizer-$BUILD_ID"]
+- name: 'bazel:cos_customizer'
+  args: ["install-gpu",
+         "-version=${_DRIVER_VERSION}",
+         "-gpu-type=nvidia-tesla-t4",
+         "-deps-dir=${_DEPS_DIR}"]
+- name: 'bazel:cos_customizer'
+  args: ["run-script",
+         "-script=preload.sh"]
+- name: 'bazel:cos_customizer'
+  args: ["finish-image-build",
+         "-zone=us-west1-b",
+         "-project=$PROJECT_ID",
+         "-image-name=preload-test-$BUILD_ID",
+         "-image-project=$PROJECT_ID"]
 - name: 'gcr.io/compute-image-tools/daisy'
-  args: ['-project=$PROJECT_ID', '-zone=us-west1-b', '-var:image_name',
-         'preload-test-$BUILD_ID', '-var:image_project', '$PROJECT_ID',
-         '-var:test_cfg', '../${_TEST}/preload_test.cfg', '-var:vm_workflow',
-         './gpu_vm.wf.json', 'testing/util/run_test.wf.json']
+  args: ["-project=$PROJECT_ID", "-zone=us-west1-b", "-var:image_name",
+         "preload-test-$BUILD_ID", "-var:image_project", "$PROJECT_ID",
+         "-var:test_cfg", "../${_TEST}/preload_test.cfg", "-var:vm_workflow",
+         "./gpu_vm.wf.json", "testing/util/run_test.wf.json"]
 options:
   machineType: 'N1_HIGHCPU_32'
-timeout: '7200s'
+timeout: "7200s"
diff --git a/testing/image_test.yaml b/testing/image_test.yaml
index cb82e30..6eaeb9e 100644
--- a/testing/image_test.yaml
+++ b/testing/image_test.yaml
@@ -13,39 +13,39 @@
 # limitations under the License.
 
 substitutions:
-  '_TEST': 'image_test'
-  '_INPUT_IMAGE': 'cos-93-16623-461-15'
-  '_INPUT_PROJECT': 'cos-cloud'
+  "_TEST": "image_test"
+  "_INPUT_IMAGE": "cos-dev-69-10895-0-0"
+  "_INPUT_PROJECT": "cos-cloud"
 steps:
-- name: 'gcr.io/cloud-builders/docker'
-  args: ['build', '-f', 'src/cmd/cos_customizer/Dockerfile', '-t', 'cos_customizer', '.']
-- name: 'cos_customizer'
-  args: ['start-image-build',
-         '-build-context=testing/${_TEST}',
-         '-image-name=${_INPUT_IMAGE}',
-         '-image-project=${_INPUT_PROJECT}',
-         '-gcs-bucket=${PROJECT_ID}_cloudbuild',
-         '-gcs-workdir=customizer-$BUILD_ID']
-- name: 'cos_customizer'
-  args: ['finish-image-build',
-         '-zone=us-west1-b',
-         '-labels=hello=world,test_key=test_value',
-         '-licenses=projects/cos-cloud/global/licenses/cos-gpu',
-         '-disk-size-gb=50',
-         '-project=$PROJECT_ID',
-         '-image-name=preload-test-$BUILD_ID',
-         '-image-family=test-family',
-         '-image-project=$PROJECT_ID']
+- name: 'gcr.io/cloud-builders/bazel'
+  args: ["run", "--spawn_strategy=standalone", ":cos_customizer", "--", "--norun"]
+- name: 'bazel:cos_customizer'
+  args: ["start-image-build",
+         "-build-context=testing/${_TEST}",
+         "-image-name=${_INPUT_IMAGE}",
+         "-image-project=${_INPUT_PROJECT}",
+         "-gcs-bucket=${PROJECT_ID}_cloudbuild",
+         "-gcs-workdir=customizer-$BUILD_ID"]
+- name: 'bazel:cos_customizer'
+  args: ["finish-image-build",
+         "-zone=us-west1-b",
+         "-labels=hello=world,test_key=test_value",
+         "-licenses=projects/cos-cloud/global/licenses/cos-gpu",
+         "-disk-size-gb=50",
+         "-project=$PROJECT_ID",
+         "-image-name=preload-test-$BUILD_ID",
+         "-image-family=test-family",
+         "-image-project=$PROJECT_ID"]
 - name: 'gcr.io/cloud-builders/gcloud'
   entrypoint: '/bin/bash'
   env:
-  - 'IMAGE=preload-test-$BUILD_ID'
-  - 'PROJECT=$PROJECT_ID'
-  - 'LABELS=hello=world;test_key=test_value'
-  - 'FAMILY=test-family'
-  - 'DISK_SIZE_GB=50'
-  - 'LICENSES=https://www.googleapis.com/compute/v1/projects/cos-cloud-shielded/global/licenses/shielded-cos;https://www.googleapis.com/compute/v1/projects/cos-cloud/global/licenses/cos-pcid;https://www.googleapis.com/compute/v1/projects/cos-cloud/global/licenses/cos;https://www.googleapis.com/compute/v1/projects/cos-cloud/global/licenses/cos-gpu'
-  args: ['/workspace/testing/${_TEST}/run_test.sh']
+  - "IMAGE=preload-test-$BUILD_ID"
+  - "PROJECT=$PROJECT_ID"
+  - "LABELS=hello=world;test_key=test_value"
+  - "FAMILY=test-family"
+  - "DISK_SIZE_GB=50"
+  - "LICENSES=https://www.googleapis.com/compute/v1/projects/cos-cloud/global/licenses/cos-gpu;https://www.googleapis.com/compute/v1/projects/cos-cloud/global/licenses/cos"
+  args: ["/workspace/testing/${_TEST}/run_test.sh"]
 options:
   machineType: 'N1_HIGHCPU_8'
-timeout: '7200s'
+timeout: "7200s"
diff --git a/testing/install_packages_remote_pkgspec_test.yaml b/testing/install_packages_remote_pkgspec_test.yaml
index 66bcfac..04a7ea6 100644
--- a/testing/install_packages_remote_pkgspec_test.yaml
+++ b/testing/install_packages_remote_pkgspec_test.yaml
@@ -20,21 +20,21 @@
   '_INPUT_PKGSPEC': 'testing/install_packages_remote_pkgspec_test/kubernetes_pkg_spec.tar.gz'
 
 steps:
-- name: 'gcr.io/cloud-builders/docker'
-  args: ['build', '-f', 'src/cmd/cos_customizer/Dockerfile', '-t', 'cos_customizer', '.']
+- name: 'gcr.io/cloud-builders/bazel'
+  args: ['run', '--spawn_strategy=standalone', ':cos_customizer', '--', '--norun']
 - name: 'gcr.io/cloud-builders/gsutil'
-  args: [ '-m', 'cp', '${_INPUT_PKGSPEC}', 'gs://${PROJECT_ID}_cloudbuild/' ]
-- name: 'cos_customizer'
+  args: [ "-m", "cp", "${_INPUT_PKGSPEC}", "gs://${PROJECT_ID}_cloudbuild/" ]
+- name: 'bazel:cos_customizer'
   args: ['start-image-build',
          '-build-context=testing/${_TEST}',
          '-image-name=${_INPUT_IMAGE}',
          '-image-project=${_INPUT_PROJECT}',
          '-gcs-bucket=${PROJECT_ID}_cloudbuild',
          '-gcs-workdir=customizer-$BUILD_ID']
-- name: 'cos_customizer'
+- name: 'bazel:cos_customizer'
   args: ['anthos-installer-install',
          '-pkgspec-url=gs://${PROJECT_ID}_cloudbuild/${_INPUT_PKGSPEC_FILE}']
-- name: 'cos_customizer'
+- name: 'bazel:cos_customizer'
   args: ['finish-image-build',
          '-zone=us-west1-b',
          '-project=$PROJECT_ID',
@@ -42,11 +42,11 @@
          '-image-project=$PROJECT_ID',
          '-timeout=5m']
 - name: 'gcr.io/compute-image-tools/daisy'
-  args: ['-project=$PROJECT_ID', '-zone=us-west1-b', '-var:image_name',
-         'preload-test-$BUILD_ID', '-var:image_project', '$PROJECT_ID',
-         '-var:test_cfg', '../${_TEST}/preload_test.cfg', 'testing/util/run_test.wf.json']
+  args: ["-project=$PROJECT_ID", "-zone=us-west1-b", "-var:image_name",
+         "preload-test-$BUILD_ID", "-var:image_project", "$PROJECT_ID",
+         "-var:test_cfg", "../${_TEST}/preload_test.cfg", "testing/util/run_test.wf.json"]
 - name: 'gcr.io/cloud-builders/gsutil'
-  args: ['rm', 'gs://${PROJECT_ID}_cloudbuild/kubernetes_pkg_spec.tar.gz' ]
+  args: ["rm", "gs://${PROJECT_ID}_cloudbuild/kubernetes_pkg_spec.tar.gz" ]
 options:
   machineType: 'N1_HIGHCPU_32'
 timeout: '7200s'
diff --git a/testing/install_packages_test.yaml b/testing/install_packages_test.yaml
index 20e4535..bc52b33 100644
--- a/testing/install_packages_test.yaml
+++ b/testing/install_packages_test.yaml
@@ -17,19 +17,19 @@
   '_INPUT_IMAGE': 'cos-85-13310-1260-8'
   '_INPUT_PROJECT': 'cos-cloud'
 steps:
-- name: 'gcr.io/cloud-builders/docker'
-  args: ['build', '-f', 'src/cmd/cos_customizer/Dockerfile', '-t', 'cos_customizer', '.']
-- name: 'cos_customizer'
+- name: 'gcr.io/cloud-builders/bazel'
+  args: ['run', '--spawn_strategy=standalone', ':cos_customizer', '--', '--norun']
+- name: 'bazel:cos_customizer'
   args: ['start-image-build',
          '-build-context=testing/${_TEST}',
          '-image-name=${_INPUT_IMAGE}',
          '-image-project=${_INPUT_PROJECT}',
          '-gcs-bucket=${PROJECT_ID}_cloudbuild',
          '-gcs-workdir=customizer-$BUILD_ID']
-- name: 'cos_customizer'
+- name: 'bazel:cos_customizer'
   args: ['anthos-installer-install',
          '-pkgspec-url=pkgspec']
-- name: 'cos_customizer'
+- name: 'bazel:cos_customizer'
   args: ['finish-image-build',
          '-zone=us-west1-b',
          '-project=$PROJECT_ID',
@@ -37,9 +37,9 @@
          '-image-project=$PROJECT_ID',
          '-timeout=5m']
 - name: 'gcr.io/compute-image-tools/daisy'
-  args: ['-project=$PROJECT_ID', '-zone=us-west1-b', '-var:image_name',
-         'preload-test-$BUILD_ID', '-var:image_project', '$PROJECT_ID',
-         '-var:test_cfg', '../${_TEST}/preload_test.cfg', 'testing/util/run_test.wf.json']
+  args: ["-project=$PROJECT_ID", "-zone=us-west1-b", "-var:image_name",
+         "preload-test-$BUILD_ID", "-var:image_project", "$PROJECT_ID",
+         "-var:test_cfg", "../${_TEST}/preload_test.cfg", "testing/util/run_test.wf.json"]
 options:
   machineType: 'N1_HIGHCPU_32'
 timeout: '7200s'
diff --git a/testing/machine_type_test.yaml b/testing/machine_type_test.yaml
index 0ea2322..a230666 100644
--- a/testing/machine_type_test.yaml
+++ b/testing/machine_type_test.yaml
@@ -13,33 +13,33 @@
 # limitations under the License.
 
 substitutions:
-  '_TEST': 'machine_type_test'
-  '_INPUT_IMAGE': 'cos-93-16623-461-15'
-  '_INPUT_PROJECT': 'cos-cloud'
+  "_TEST": "machine_type_test"
+  "_INPUT_IMAGE": "cos-dev-69-10895-0-0"
+  "_INPUT_PROJECT": "cos-cloud"
 steps:
-- name: 'gcr.io/cloud-builders/docker'
-  args: ['build', '-f', 'src/cmd/cos_customizer/Dockerfile', '-t', 'cos_customizer', '.']
-- name: 'cos_customizer'
-  args: ['start-image-build',
-         '-build-context=testing/${_TEST}',
-         '-image-name=${_INPUT_IMAGE}',
-         '-image-project=${_INPUT_PROJECT}',
-         '-gcs-bucket=${PROJECT_ID}_cloudbuild',
-         '-gcs-workdir=customizer-$BUILD_ID']
-- name: 'cos_customizer'
-  args: ['run-script',
-         '-script=preload.sh']
-- name: 'cos_customizer'
-  args: ['finish-image-build',
-         '-machine-type=n1-standard-8',
-         '-zone=us-west1-b',
-         '-project=$PROJECT_ID',
-         '-image-name=preload-test-$BUILD_ID',
-         '-image-project=$PROJECT_ID']
-- name: 'gcr.io/compute-image-tools/daisy'
-  args: ['-project=$PROJECT_ID', '-zone=us-west1-b', '-var:image_name',
-         'preload-test-$BUILD_ID', '-var:image_project', '$PROJECT_ID',
-         '-var:test_cfg', '../${_TEST}/preload_test.cfg', 'testing/util/run_test.wf.json']
+- name: "gcr.io/cloud-builders/bazel"
+  args: ["run", "--spawn_strategy=standalone", ":cos_customizer", "--", "--norun"]
+- name: "bazel:cos_customizer"
+  args: ["start-image-build",
+         "-build-context=testing/${_TEST}",
+         "-image-name=${_INPUT_IMAGE}",
+         "-image-project=${_INPUT_PROJECT}",
+         "-gcs-bucket=${PROJECT_ID}_cloudbuild",
+         "-gcs-workdir=customizer-$BUILD_ID"]
+- name: "bazel:cos_customizer"
+  args: ["run-script",
+         "-script=preload.sh"]
+- name: "bazel:cos_customizer"
+  args: ["finish-image-build",
+         "-machine-type=n1-standard-8",
+         "-zone=us-west1-b",
+         "-project=$PROJECT_ID",
+         "-image-name=preload-test-$BUILD_ID",
+         "-image-project=$PROJECT_ID"]
+- name: "gcr.io/compute-image-tools/daisy"
+  args: ["-project=$PROJECT_ID", "-zone=us-west1-b", "-var:image_name",
+         "preload-test-$BUILD_ID", "-var:image_project", "$PROJECT_ID",
+         "-var:test_cfg", "../${_TEST}/preload_test.cfg", "testing/util/run_test.wf.json"]
 options:
-  machineType: 'N1_HIGHCPU_8'
-timeout: '7200s'
+  machineType: "N1_HIGHCPU_8"
+timeout: "7200s"
diff --git a/testing/milestone_test.yaml b/testing/milestone_test.yaml
index e74e31e..c1e4dbf 100644
--- a/testing/milestone_test.yaml
+++ b/testing/milestone_test.yaml
@@ -13,29 +13,29 @@
 # limitations under the License.
 
 substitutions:
-  '_TEST': 'milestone_test'
-  '_INPUT_IMAGE': '69'
-  '_INPUT_PROJECT': 'cos-cloud'
+  "_TEST": "milestone_test"
+  "_INPUT_IMAGE": "69"
+  "_INPUT_PROJECT": "cos-cloud"
 steps:
-- name: 'gcr.io/cloud-builders/docker'
-  args: ['build', '-f', 'src/cmd/cos_customizer/Dockerfile', '-t', 'cos_customizer', '.']
-- name: 'cos_customizer'
-  args: ['start-image-build',
-         '-build-context=testing/${_TEST}',
-         '-image-milestone=${_INPUT_IMAGE}',
-         '-image-project=${_INPUT_PROJECT}',
-         '-gcs-bucket=${PROJECT_ID}_cloudbuild',
-         '-gcs-workdir=customizer-$BUILD_ID']
-- name: 'cos_customizer'
-  args: ['finish-image-build',
-         '-zone=us-west1-b',
-         '-project=$PROJECT_ID',
-         '-image-name=preload-test-$BUILD_ID',
-         '-image-project=$PROJECT_ID']
+- name: 'gcr.io/cloud-builders/bazel'
+  args: ["run", "--spawn_strategy=standalone", ":cos_customizer", "--", "--norun"]
+- name: 'bazel:cos_customizer'
+  args: ["start-image-build",
+         "-build-context=testing/${_TEST}",
+         "-image-milestone=${_INPUT_IMAGE}",
+         "-image-project=${_INPUT_PROJECT}",
+         "-gcs-bucket=${PROJECT_ID}_cloudbuild",
+         "-gcs-workdir=customizer-$BUILD_ID"]
+- name: 'bazel:cos_customizer'
+  args: ["finish-image-build",
+         "-zone=us-west1-b",
+         "-project=$PROJECT_ID",
+         "-image-name=preload-test-$BUILD_ID",
+         "-image-project=$PROJECT_ID"]
 - name: 'gcr.io/compute-image-tools/daisy'
-  args: ['-project=$PROJECT_ID', '-zone=us-west1-b', '-var:image_name',
-         'preload-test-$BUILD_ID', '-var:image_project', '$PROJECT_ID',
-         '-var:test_cfg', '../${_TEST}/preload_test.cfg', 'testing/util/run_test.wf.json']
+  args: ["-project=$PROJECT_ID", "-zone=us-west1-b", "-var:image_name",
+         "preload-test-$BUILD_ID", "-var:image_project", "$PROJECT_ID",
+         "-var:test_cfg", "../${_TEST}/preload_test.cfg", "testing/util/run_test.wf.json"]
 options:
   machineType: 'N1_HIGHCPU_8'
-timeout: '7200s'
+timeout: "7200s"
diff --git a/testing/multi_script/preload_test.cfg b/testing/multi_script/preload_test.cfg
index 602f265..203cd15 100644
--- a/testing/multi_script/preload_test.cfg
+++ b/testing/multi_script/preload_test.cfg
@@ -60,7 +60,7 @@
       }
 
       testVersion() {
-        expected="16623.461.15"
+        expected="10895.0.0"
         actual=$(. /etc/os-release; echo "${BUILD_ID}")
         if [[ "${expected}" != "${actual}" ]]; then
           echo "expected version: ${expected}"
diff --git a/testing/multi_script_test.yaml b/testing/multi_script_test.yaml
index 9f30632..10afdeb 100644
--- a/testing/multi_script_test.yaml
+++ b/testing/multi_script_test.yaml
@@ -13,35 +13,35 @@
 # limitations under the License.
 
 substitutions:
-  '_TEST': 'multi_script'
-  '_INPUT_IMAGE': 'cos-93-16623-461-15'
-  '_INPUT_PROJECT': 'cos-cloud'
+  "_TEST": "multi_script"
+  "_INPUT_IMAGE": "cos-dev-69-10895-0-0"
+  "_INPUT_PROJECT": "cos-cloud"
 steps:
-- name: 'gcr.io/cloud-builders/docker'
-  args: ['build', '-f', 'src/cmd/cos_customizer/Dockerfile', '-t', 'cos_customizer', '.']
-- name: 'cos_customizer'
-  args: ['start-image-build',
-         '-build-context=testing/${_TEST}',
-         '-image-name=${_INPUT_IMAGE}',
-         '-image-project=${_INPUT_PROJECT}',
-         '-gcs-bucket=${PROJECT_ID}_cloudbuild',
-         '-gcs-workdir=customizer-$BUILD_ID']
-- name: 'cos_customizer'
-  args: ['run-script',
-         '-script=preload_1.sh']
-- name: 'cos_customizer'
-  args: ['run-script',
-         '-script=preload_2.sh']
-- name: 'cos_customizer'
-  args: ['finish-image-build',
-         '-zone=us-west1-b',
-         '-project=$PROJECT_ID',
-         '-image-name=preload-test-$BUILD_ID',
-         '-image-project=$PROJECT_ID']
+- name: 'gcr.io/cloud-builders/bazel'
+  args: ["run", "--spawn_strategy=standalone", ":cos_customizer", "--", "--norun"]
+- name: 'bazel:cos_customizer'
+  args: ["start-image-build",
+         "-build-context=testing/${_TEST}",
+         "-image-name=${_INPUT_IMAGE}",
+         "-image-project=${_INPUT_PROJECT}",
+         "-gcs-bucket=${PROJECT_ID}_cloudbuild",
+         "-gcs-workdir=customizer-$BUILD_ID"]
+- name: 'bazel:cos_customizer'
+  args: ["run-script",
+         "-script=preload_1.sh"]
+- name: 'bazel:cos_customizer'
+  args: ["run-script",
+         "-script=preload_2.sh"]
+- name: 'bazel:cos_customizer'
+  args: ["finish-image-build",
+         "-zone=us-west1-b",
+         "-project=$PROJECT_ID",
+         "-image-name=preload-test-$BUILD_ID",
+         "-image-project=$PROJECT_ID"]
 - name: 'gcr.io/compute-image-tools/daisy'
-  args: ['-project=$PROJECT_ID', '-zone=us-west1-b', '-var:image_name',
-         'preload-test-$BUILD_ID', '-var:image_project', '$PROJECT_ID',
-         '-var:test_cfg', '../${_TEST}/preload_test.cfg', 'testing/util/run_test.wf.json']
+  args: ["-project=$PROJECT_ID", "-zone=us-west1-b", "-var:image_name",
+         "preload-test-$BUILD_ID", "-var:image_project", "$PROJECT_ID",
+         "-var:test_cfg", "../${_TEST}/preload_test.cfg", "testing/util/run_test.wf.json"]
 options:
   machineType: 'N1_HIGHCPU_8'
-timeout: '7200s'
+timeout: "7200s"
diff --git a/testing/network_subnet_test.yaml b/testing/network_subnet_test.yaml
index 1304232..4c39fc6 100644
--- a/testing/network_subnet_test.yaml
+++ b/testing/network_subnet_test.yaml
@@ -16,43 +16,45 @@
 # This test uses subnetwork `cos-customizer-test` in default VPC for the preload VM.
 
 substitutions:
-  '_TEST': 'network_subnet_test'
-  '_INPUT_IMAGE': 'cos-85-13310-1260-8'
-  '_INPUT_PROJECT': 'cos-cloud'
+  "_TEST": "network_subnet_test"
+  "_INPUT_IMAGE": "cos-85-13310-1260-8"
+  "_INPUT_PROJECT": "cos-cloud"
 steps:
-- name: 'gcr.io/cloud-builders/docker'
-  args: ['build', '-f', 'src/cmd/cos_customizer/Dockerfile', '-t', 'cos_customizer', '.']
+- name: "gcr.io/cloud-builders/bazel"
+  args: ["run", "--spawn_strategy=standalone", ":cos_customizer", "--", "--norun"]
 - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
   args: [ 'gcloud', 'compute', 'networks', 'subnets',
           'create', 'cos-customizer-test',
           '--project', '${PROJECT_ID}', '--network', 'default', '--region', 'us-central1',
-          '--range', '10.124.0.0/20']
-- name: 'cos_customizer'
-  args: ['start-image-build',
-         '-build-context=testing/${_TEST}',
-         '-image-name=${_INPUT_IMAGE}',
-         '-image-project=${_INPUT_PROJECT}',
-         '-gcs-bucket=${PROJECT_ID}_cloudbuild',
-         '-gcs-workdir=customizer-$BUILD_ID']
-- name: 'cos_customizer'
-  args: ['run-script',
-         '-script=preload.sh']
-- name: 'cos_customizer'
-  args: ['finish-image-build',
-         '-machine-type=n1-standard-8',
-         '-zone=us-central1-a',
-         '-project=$PROJECT_ID',
-         '-subnet=regions/us-central1/subnetworks/cos-customizer-test',
-         '-image-name=preload-test-$BUILD_ID',
-         '-image-project=$PROJECT_ID']
-- name: 'gcr.io/compute-image-tools/daisy'
-  args: ['-project=$PROJECT_ID', '-zone=us-west1-b', '-var:image_name',
-         'preload-test-$BUILD_ID', '-var:image_project', '$PROJECT_ID',
-         '-var:test_cfg', '../${_TEST}/preload_test.cfg', 'testing/util/run_test.wf.json']
+          '--range', '10.124.0.0/20'
+  ]
+- name: "bazel:cos_customizer"
+  args: ["start-image-build",
+         "-build-context=testing/${_TEST}",
+         "-image-name=${_INPUT_IMAGE}",
+         "-image-project=${_INPUT_PROJECT}",
+         "-gcs-bucket=${PROJECT_ID}_cloudbuild",
+         "-gcs-workdir=customizer-$BUILD_ID"]
+- name: "bazel:cos_customizer"
+  args: ["run-script",
+         "-script=preload.sh"]
+- name: "bazel:cos_customizer"
+  args: ["finish-image-build",
+         "-machine-type=n1-standard-8",
+         "-zone=us-central1-a",
+         "-project=$PROJECT_ID",
+         "-subnet=regions/us-central1/subnetworks/cos-customizer-test",
+         "-image-name=preload-test-$BUILD_ID",
+         "-image-project=$PROJECT_ID"]
+- name: "gcr.io/compute-image-tools/daisy"
+  args: ["-project=$PROJECT_ID", "-zone=us-west1-b", "-var:image_name",
+         "preload-test-$BUILD_ID", "-var:image_project", "$PROJECT_ID",
+         "-var:test_cfg", "../${_TEST}/preload_test.cfg", "testing/util/run_test.wf.json"]
 - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
   args: [ 'gcloud', 'compute', 'networks', 'subnets',
           'delete', 'cos-customizer-test',
-          '--project', '${PROJECT_ID}', '--region', 'us-central1']
+          '--project', '${PROJECT_ID}', '--region', 'us-central1',
+  ]
 options:
-  machineType: 'N1_HIGHCPU_8'
-timeout: '7200s'
+  machineType: "N1_HIGHCPU_8"
+timeout: "7200s"
diff --git a/testing/parallel_test.yaml b/testing/parallel_test.yaml
index 5620f4e..598a901 100644
--- a/testing/parallel_test.yaml
+++ b/testing/parallel_test.yaml
@@ -13,90 +13,90 @@
 # limitations under the License.
 
 substitutions:
-  '_TEST_1': 'smoke_test'
-  '_INPUT_IMAGE_1': 'cos-93-16623-461-15'
-  '_TEST_2': 'gpu_test'
-  '_INPUT_IMAGE_2': 'cos-89-16108-798-1'
-  '_INPUT_PROJECT': 'cos-cloud'
+  "_TEST_1": "smoke_test"
+  "_INPUT_IMAGE_1": "cos-dev-69-10895-0-0"
+  "_TEST_2": "gpu_test"
+  "_INPUT_IMAGE_2": "cos-89-16108-798-1"
+  "_INPUT_PROJECT": "cos-cloud"
 steps:
-- name: 'gcr.io/cloud-builders/docker'
-  id: 'docker-build'
-  args: ['build', '-f', 'src/cmd/cos_customizer/Dockerfile', '-t', 'cos_customizer', '.']
+- name: 'gcr.io/cloud-builders/bazel'
+  id: "docker-build"
+  args: ["run", "--spawn_strategy=standalone", ":cos_customizer", "--", "--norun"]
 # TEST_1 workflow
-- name: 'cos_customizer'
-  waitFor: 'docker-build'
-  id: 'test-1-start-build'
-  args: ['-local-state-workdir=.${_TEST_1}',
-         'start-image-build',
-         '-build-context=testing/${_TEST_1}',
-         '-image-name=${_INPUT_IMAGE_1}',
-         '-image-project=${_INPUT_PROJECT}',
-         '-gcs-bucket=${PROJECT_ID}_cloudbuild',
-         '-gcs-workdir=customizer-${_TEST_1}-$BUILD_ID']
-- name: 'cos_customizer'
-  waitFor: 'test-1-start-build'
-  id: 'test-1-run-script'
-  args: ['-local-state-workdir=.${_TEST_1}',
-         'run-script',
-         '-script=preload.sh']
-- name: 'cos_customizer'
-  waitFor: 'test-1-run-script'
-  id: 'test-1-finish-build'
-  args: ['-local-state-workdir=.${_TEST_1}',
-         'finish-image-build',
-         '-zone=us-west1-b',
-         '-project=$PROJECT_ID',
-         '-image-name=preload-test-t1-$BUILD_ID',
-         '-image-project=$PROJECT_ID']
+- name: 'bazel:cos_customizer'
+  waitFor: "docker-build"
+  id: "test-1-start-build"
+  args: ["-local-state-workdir=.${_TEST_1}",
+         "start-image-build",
+         "-build-context=testing/${_TEST_1}",
+         "-image-name=${_INPUT_IMAGE_1}",
+         "-image-project=${_INPUT_PROJECT}",
+         "-gcs-bucket=${PROJECT_ID}_cloudbuild",
+         "-gcs-workdir=customizer-${_TEST_1}-$BUILD_ID"]
+- name: 'bazel:cos_customizer'
+  waitFor: "test-1-start-build"
+  id: "test-1-run-script"
+  args: ["-local-state-workdir=.${_TEST_1}",
+         "run-script",
+         "-script=preload.sh"]
+- name: 'bazel:cos_customizer'
+  waitFor: "test-1-run-script"
+  id: "test-1-finish-build"
+  args: ["-local-state-workdir=.${_TEST_1}",
+         "finish-image-build",
+         "-zone=us-west1-b",
+         "-project=$PROJECT_ID",
+         "-image-name=preload-test-t1-$BUILD_ID",
+         "-image-project=$PROJECT_ID"]
 - name: 'gcr.io/compute-image-tools/daisy'
-  waitFor: 'test-1-finish-build'
-  id: 'test-1-test-build'
-  args: ['-project=$PROJECT_ID', '-zone=us-west1-b', '-var:image_name',
-         'preload-test-t1-$BUILD_ID', '-var:image_project', '$PROJECT_ID',
-         '-var:test_cfg', '../${_TEST_1}/preload_test.cfg', 'testing/util/run_test.wf.json']
+  waitFor: "test-1-finish-build"
+  id: "test-1-test-build"
+  args: ["-project=$PROJECT_ID", "-zone=us-west1-b", "-var:image_name",
+         "preload-test-t1-$BUILD_ID", "-var:image_project", "$PROJECT_ID",
+         "-var:test_cfg", "../${_TEST_1}/preload_test.cfg", "testing/util/run_test.wf.json"]
 # TEST_2 workflow
 - name: 'busybox'
-  args: ['sed', '-i', '-e', 's|%s|"450.216.04"|',
-         'testing/${_TEST_2}/preload_test.cfg']
-- name: 'cos_customizer'
-  waitFor: 'docker-build'
-  id: 'test-2-start-build'
-  args: ['-local-state-workdir=.${_TEST_2}',
-         'start-image-build',
-         '-build-context=testing/${_TEST_2}',
-         '-image-name=${_INPUT_IMAGE_2}',
-         '-image-project=${_INPUT_PROJECT}',
-         '-gcs-bucket=${PROJECT_ID}_cloudbuild',
-         '-gcs-workdir=customizer-${_TEST_2}-$BUILD_ID']
-- name: 'cos_customizer'
-  waitFor: 'test-2-start-build'
-  id: 'test-2-install-gpu'
-  args: ['-local-state-workdir=.${_TEST_2}',
-         'install-gpu',
-         '-version=450.216.04',
-         '-gpu-type=nvidia-tesla-t4']
-- name: 'cos_customizer'
-  waitFor: 'test-2-install-gpu'
-  id: 'test-2-run-script'
-  args: ['-local-state-workdir=.${_TEST_2}',
-         'run-script',
-         '-script=preload.sh']
-- name: 'cos_customizer'
-  waitFor: 'test-2-run-script'
-  id: 'test-2-finish-build'
-  args: ['-local-state-workdir=.${_TEST_2}',
-         'finish-image-build',
-         '-zone=us-west1-b',
-         '-project=$PROJECT_ID',
-         '-image-name=preload-test-t2-$BUILD_ID',
-         '-image-project=$PROJECT_ID']
+  args: ["sed", "-i", "-e", "s|%s|'450.216.04'|",
+         "testing/${_TEST_2}/preload_test.cfg"]
+- name: 'bazel:cos_customizer'
+  waitFor: "docker-build"
+  id: "test-2-start-build"
+  args: ["-local-state-workdir=.${_TEST_2}",
+         "start-image-build",
+         "-build-context=testing/${_TEST_2}",
+         "-image-name=${_INPUT_IMAGE_2}",
+         "-image-project=${_INPUT_PROJECT}",
+         "-gcs-bucket=${PROJECT_ID}_cloudbuild",
+         "-gcs-workdir=customizer-${_TEST_2}-$BUILD_ID"]
+- name: 'bazel:cos_customizer'
+  waitFor: "test-2-start-build"
+  id: "test-2-install-gpu"
+  args: ["-local-state-workdir=.${_TEST_2}",
+         "install-gpu",
+         "-version=450.216.04",
+         "-gpu-type=nvidia-tesla-t4"]
+- name: 'bazel:cos_customizer'
+  waitFor: "test-2-install-gpu"
+  id: "test-2-run-script"
+  args: ["-local-state-workdir=.${_TEST_2}",
+         "run-script",
+         "-script=preload.sh"]
+- name: 'bazel:cos_customizer'
+  waitFor: "test-2-run-script"
+  id: "test-2-finish-build"
+  args: ["-local-state-workdir=.${_TEST_2}",
+         "finish-image-build",
+         "-zone=us-west1-b",
+         "-project=$PROJECT_ID",
+         "-image-name=preload-test-t2-$BUILD_ID",
+         "-image-project=$PROJECT_ID"]
 - name: 'gcr.io/compute-image-tools/daisy'
-  waitFor: 'test-2-finish-build'
-  id: 'test-2-test-build'
-  args: ['-project=$PROJECT_ID', '-zone=us-west1-b', '-var:image_name',
-         'preload-test-t2-$BUILD_ID', '-var:image_project', '$PROJECT_ID',
-         '-var:test_cfg', '../${_TEST_2}/preload_test.cfg', '-var:vm_workflow',
-         './gpu_vm.wf.json', 'testing/util/run_test.wf.json']
+  waitFor: "test-2-finish-build"
+  id: "test-2-test-build"
+  args: ["-project=$PROJECT_ID", "-zone=us-west1-b", "-var:image_name",
+         "preload-test-t2-$BUILD_ID", "-var:image_project", "$PROJECT_ID",
+         "-var:test_cfg", "../${_TEST_2}/preload_test.cfg", "-var:vm_workflow",
+         "./gpu_vm.wf.json", "testing/util/run_test.wf.json"]
 options:
   machineType: 'N1_HIGHCPU_32'
-timeout: '7200s'
+timeout: "7200s"
diff --git a/testing/seal_oem_test/seal_oem_test.yaml b/testing/seal_oem_test/seal_oem_test.yaml
index 7989337..373f90c 100644
--- a/testing/seal_oem_test/seal_oem_test.yaml
+++ b/testing/seal_oem_test/seal_oem_test.yaml
@@ -13,42 +13,42 @@
 # limitations under the License.
 
 substitutions:
-  '_TEST': 'seal_oem_test'
-  '_INPUT_IMAGE': 'cos-81-12871-148-0'
-  '_INPUT_PROJECT': 'cos-cloud'
-  '_OEM_SIZE': ''
-  '_DISK_SIZE': ''
-  '_OEM_SIZE_TH': ''
+  "_TEST": "seal_oem_test"
+  "_INPUT_IMAGE": "cos-81-12871-148-0"
+  "_INPUT_PROJECT": "cos-cloud"
+  "_OEM_SIZE": ""
+  "_DISK_SIZE": ""
+  "_OEM_SIZE_TH": ""
 steps:
-- name: 'gcr.io/cloud-builders/docker'
-  args: ['build', '-f', 'src/cmd/cos_customizer/Dockerfile', '-t', 'cos_customizer', '.']
+- name: 'gcr.io/cloud-builders/bazel'
+  args: ["run", "--spawn_strategy=standalone", ":cos_customizer", "--", "--norun"]
 - name: 'busybox'
-  args: ['sed', '-i', '-e', 's|%s|"${_OEM_SIZE_TH}"|',
-         'testing/${_TEST}/preload_test.cfg']
-- name: 'cos_customizer'
-  args: ['start-image-build',
-         '-build-context=testing/${_TEST}',
-         '-image-name=${_INPUT_IMAGE}',
-         '-image-project=${_INPUT_PROJECT}',
-         '-gcs-bucket=${PROJECT_ID}_cloudbuild',
-         '-gcs-workdir=customizer-$BUILD_ID']
-- name: 'cos_customizer'
-  args: ['run-script',
-         '-script=preload.sh']
-- name: 'cos_customizer'
-  args: ['seal-oem']
-- name: 'cos_customizer'
-  args: ['finish-image-build',
-         '-zone=us-west1-b',
-         '-project=$PROJECT_ID',
-         '-image-name=preload-test-$BUILD_ID',
-         '-image-project=$PROJECT_ID',
-         '-disk-size-gb=${_DISK_SIZE}',
-         '-oem-size=${_OEM_SIZE}']
+  args: ["sed", "-i", "-e", "s|%s|'${_OEM_SIZE_TH}'|",
+         "testing/${_TEST}/preload_test.cfg"]
+- name: 'bazel:cos_customizer'
+  args: ["start-image-build",
+         "-build-context=testing/${_TEST}",
+         "-image-name=${_INPUT_IMAGE}",
+         "-image-project=${_INPUT_PROJECT}",
+         "-gcs-bucket=${PROJECT_ID}_cloudbuild",
+         "-gcs-workdir=customizer-$BUILD_ID"]
+- name: 'bazel:cos_customizer'
+  args: ["run-script",
+         "-script=preload.sh"]
+- name: 'bazel:cos_customizer'
+  args: ["seal-oem"]        
+- name: 'bazel:cos_customizer'
+  args: ["finish-image-build",
+         "-zone=us-west1-b",
+         "-project=$PROJECT_ID",
+         "-image-name=preload-test-$BUILD_ID",
+         "-image-project=$PROJECT_ID",
+         "-disk-size-gb=${_DISK_SIZE}",
+         "-oem-size=${_OEM_SIZE}"]
 - name: 'gcr.io/compute-image-tools/daisy'
-  args: ['-default_timeout=15m', '-project=$PROJECT_ID', '-zone=us-west1-b', '-var:image_name',
-         'preload-test-$BUILD_ID', '-var:image_project', '$PROJECT_ID',
-         '-var:test_cfg', '../${_TEST}/preload_test.cfg', 'testing/util/run_test.wf.json']
+  args: ["-default_timeout=15m", "-project=$PROJECT_ID", "-zone=us-west1-b", "-var:image_name",
+         "preload-test-$BUILD_ID", "-var:image_project", "$PROJECT_ID",
+         "-var:test_cfg", "../${_TEST}/preload_test.cfg", "testing/util/run_test.wf.json"]
 options:
   machineType: 'N1_HIGHCPU_32'
-timeout: '7200s'
+timeout: "7200s"
diff --git a/testing/seal_oem_test_no_oem_size.yaml b/testing/seal_oem_test_no_oem_size.yaml
index e209a39..1974487 100644
--- a/testing/seal_oem_test_no_oem_size.yaml
+++ b/testing/seal_oem_test_no_oem_size.yaml
@@ -13,34 +13,34 @@
 # limitations under the License.
 
 substitutions:
-  '_TEST': 'seal_oem_test'
-  '_INPUT_IMAGE': 'cos-81-12871-148-0'
-  '_INPUT_PROJECT': 'cos-cloud'
+  "_TEST": "seal_oem_test"
+  "_INPUT_IMAGE": "cos-81-12871-148-0"
+  "_INPUT_PROJECT": "cos-cloud"
 steps:
-- name: 'gcr.io/cloud-builders/docker'
-  args: ['build', '-f', 'src/cmd/cos_customizer/Dockerfile', '-t', 'cos_customizer', '.']
-- name: 'cos_customizer'
-  args: ['start-image-build',
-         '-build-context=testing/${_TEST}',
-         '-image-name=${_INPUT_IMAGE}',
-         '-image-project=${_INPUT_PROJECT}',
-         '-gcs-bucket=${PROJECT_ID}_cloudbuild',
-         '-gcs-workdir=customizer-$BUILD_ID']
-- name: 'cos_customizer'
-  args: ['run-script',
-         '-script=preload.sh']
-- name: 'cos_customizer'
-  args: ['seal-oem']
-- name: 'cos_customizer'
-  args: ['finish-image-build',
-         '-zone=us-west1-b',
-         '-project=$PROJECT_ID',
-         '-image-name=preload-test-$BUILD_ID',
-         '-image-project=$PROJECT_ID']
+- name: 'gcr.io/cloud-builders/bazel'
+  args: ["run", "--spawn_strategy=standalone", ":cos_customizer", "--", "--norun"]
+- name: 'bazel:cos_customizer'
+  args: ["start-image-build",
+         "-build-context=testing/${_TEST}",
+         "-image-name=${_INPUT_IMAGE}",
+         "-image-project=${_INPUT_PROJECT}",
+         "-gcs-bucket=${PROJECT_ID}_cloudbuild",
+         "-gcs-workdir=customizer-$BUILD_ID"]
+- name: 'bazel:cos_customizer'
+  args: ["run-script",
+         "-script=preload.sh"]
+- name: 'bazel:cos_customizer'
+  args: ["seal-oem"]        
+- name: 'bazel:cos_customizer'
+  args: ["finish-image-build",
+         "-zone=us-west1-b",
+         "-project=$PROJECT_ID",
+         "-image-name=preload-test-$BUILD_ID",
+         "-image-project=$PROJECT_ID"]
 - name: 'gcr.io/compute-image-tools/daisy'
-  args: ['-default_timeout=15m', '-project=$PROJECT_ID', '-zone=us-west1-b', '-var:image_name',
-         'preload-test-$BUILD_ID', '-var:image_project', '$PROJECT_ID',
-         '-var:test_cfg', '../${_TEST}/preload_test.cfg', 'testing/util/run_test.wf.json']
+  args: ["-default_timeout=15m", "-project=$PROJECT_ID", "-zone=us-west1-b", "-var:image_name",
+         "preload-test-$BUILD_ID", "-var:image_project", "$PROJECT_ID",
+         "-var:test_cfg", "../${_TEST}/preload_test.cfg", "testing/util/run_test.wf.json"]
 options:
   machineType: 'N1_HIGHCPU_32'
-timeout: '7200s'
+timeout: "7200s"
diff --git a/testing/seal_oem_test_no_size.yaml b/testing/seal_oem_test_no_size.yaml
index 0f73214..051180b 100644
--- a/testing/seal_oem_test_no_size.yaml
+++ b/testing/seal_oem_test_no_size.yaml
@@ -13,35 +13,35 @@
 # limitations under the License.
 
 substitutions:
-  '_TEST': 'seal_oem_test'
-  '_INPUT_IMAGE': 'cos-81-12871-148-0'
-  '_INPUT_PROJECT': 'cos-cloud'
+  "_TEST": "seal_oem_test"
+  "_INPUT_IMAGE": "cos-81-12871-148-0"
+  "_INPUT_PROJECT": "cos-cloud"
 steps:
-- name: 'gcr.io/cloud-builders/docker'
-  args: ['build', '-f', 'src/cmd/cos_customizer/Dockerfile', '-t', 'cos_customizer', '.']
-- name: 'cos_customizer'
-  args: ['start-image-build',
-         '-build-context=testing/${_TEST}',
-         '-image-name=${_INPUT_IMAGE}',
-         '-image-project=${_INPUT_PROJECT}',
-         '-gcs-bucket=${PROJECT_ID}_cloudbuild',
-         '-gcs-workdir=customizer-$BUILD_ID']
-- name: 'cos_customizer'
-  args: ['run-script',
-         '-script=preload.sh']
-- name: 'cos_customizer'
-  args: ['seal-oem']
-- name: 'cos_customizer'
-  args: ['finish-image-build',
-         '-zone=us-west1-b',
-         '-project=$PROJECT_ID',
-         '-image-name=preload-test-$BUILD_ID',
-         '-image-project=$PROJECT_ID',
-         '-disk-size-gb=11']
+- name: 'gcr.io/cloud-builders/bazel'
+  args: ["run", "--spawn_strategy=standalone", ":cos_customizer", "--", "--norun"]
+- name: 'bazel:cos_customizer'
+  args: ["start-image-build",
+         "-build-context=testing/${_TEST}",
+         "-image-name=${_INPUT_IMAGE}",
+         "-image-project=${_INPUT_PROJECT}",
+         "-gcs-bucket=${PROJECT_ID}_cloudbuild",
+         "-gcs-workdir=customizer-$BUILD_ID"]
+- name: 'bazel:cos_customizer'
+  args: ["run-script",
+         "-script=preload.sh"]
+- name: 'bazel:cos_customizer'
+  args: ["seal-oem"]        
+- name: 'bazel:cos_customizer'
+  args: ["finish-image-build",
+         "-zone=us-west1-b",
+         "-project=$PROJECT_ID",
+         "-image-name=preload-test-$BUILD_ID",
+         "-image-project=$PROJECT_ID",
+         "-disk-size-gb=11"]
 - name: 'gcr.io/compute-image-tools/daisy'
-  args: ['-default_timeout=15m', '-project=$PROJECT_ID', '-zone=us-west1-b', '-var:image_name',
-         'preload-test-$BUILD_ID', '-var:image_project', '$PROJECT_ID',
-         '-var:test_cfg', '../${_TEST}/preload_test.cfg', 'testing/util/run_test.wf.json']
+  args: ["-default_timeout=15m", "-project=$PROJECT_ID", "-zone=us-west1-b", "-var:image_name",
+         "preload-test-$BUILD_ID", "-var:image_project", "$PROJECT_ID",
+         "-var:test_cfg", "../${_TEST}/preload_test.cfg", "testing/util/run_test.wf.json"]
 options:
   machineType: 'N1_HIGHCPU_32'
-timeout: '7200s'
+timeout: "7200s"
diff --git a/testing/seal_oem_test_timeout.yaml b/testing/seal_oem_test_timeout.yaml
index 4235840..2b6dcca 100644
--- a/testing/seal_oem_test_timeout.yaml
+++ b/testing/seal_oem_test_timeout.yaml
@@ -13,46 +13,46 @@
 # limitations under the License.
 
 substitutions:
-  '_TEST': 'seal_oem_test'
-  '_INPUT_IMAGE': 'cos-81-12871-148-0'
-  '_INPUT_PROJECT': 'cos-cloud'
+  "_TEST": "seal_oem_test"
+  "_INPUT_IMAGE": "cos-81-12871-148-0"
+  "_INPUT_PROJECT": "cos-cloud"
 steps:
-- name: 'gcr.io/cloud-builders/docker'
-  args: ['build', '-f', 'src/cmd/cos_customizer/Dockerfile', '-t', 'cos_customizer', '.']
-- name: 'cos_customizer'
-  args: ['start-image-build',
-         '-build-context=testing/${_TEST}',
-         '-image-name=${_INPUT_IMAGE}',
-         '-image-project=${_INPUT_PROJECT}',
-         '-gcs-bucket=${PROJECT_ID}_cloudbuild',
-         '-gcs-workdir=customizer-$BUILD_ID']
-- name: 'cos_customizer'
-  args: ['run-script',
-         '-script=preload.sh']
-- name: 'cos_customizer'
-  args: ['seal-oem']
-- name: 'cos_customizer'
-  args: ['run-script',
-         '-script=modify_oem.sh']
-- name: 'cos_customizer'
-  args: ['finish-image-build',
-         '-zone=us-west1-b',
-         '-project=$PROJECT_ID',
-         '-image-name=preload-test-$BUILD_ID',
-         '-image-project=$PROJECT_ID',
-         '-disk-size-gb=11']
-- name: 'gcr.io/cloud-builders/docker'
-  args: [ 'build', '-t', 'seal-oem-test-timeout-image', 'testing/${_TEST}' ]
-- name: 'seal-oem-test-timeout-image'
-  entrypoint: '/bin/bash'
-  args:
-  - '-c'
-  - |
+- name: 'gcr.io/cloud-builders/bazel'
+  args: ["run", "--spawn_strategy=standalone", ":cos_customizer", "--", "--norun"]
+- name: 'bazel:cos_customizer'
+  args: ["start-image-build",
+         "-build-context=testing/${_TEST}",
+         "-image-name=${_INPUT_IMAGE}",
+         "-image-project=${_INPUT_PROJECT}",
+         "-gcs-bucket=${PROJECT_ID}_cloudbuild",
+         "-gcs-workdir=customizer-$BUILD_ID"]
+- name: 'bazel:cos_customizer'
+  args: ["run-script",
+         "-script=preload.sh"]
+- name: 'bazel:cos_customizer'
+  args: ["seal-oem"]   
+- name: 'bazel:cos_customizer'
+  args: ["run-script",
+         "-script=modify_oem.sh"]       
+- name: 'bazel:cos_customizer'
+  args: ["finish-image-build",
+         "-zone=us-west1-b",
+         "-project=$PROJECT_ID",
+         "-image-name=preload-test-$BUILD_ID",
+         "-image-project=$PROJECT_ID",
+         "-disk-size-gb=11"]
+- name: 'gcr.io/cloud-builders/docker'    
+  args: [ 'build', '-t', 'seal-oem-test-timeout-image', 'testing/${_TEST}' ]    
+- name: 'seal-oem-test-timeout-image'     
+  entrypoint: '/bin/bash'    
+  args:    
+  - '-c'    
+  - |    
     /daisy -default_timeout=5m -project=$PROJECT_ID -zone=us-west1-b \
     -var:image_name preload-test-$BUILD_ID -var:image_project $PROJECT_ID \
-    -var:test_cfg /preload_test.cfg /run_test.wf.json | tee /build.log
+    -var:test_cfg /preload_test.cfg /run_test.wf.json | tee /build.log 
     if ( grep "did not complete within the specified timeout" /build.log > /dev/null ); \
     then exit 0; else echo "error: timemout expected"; exit 1; fi
 options:
   machineType: 'N1_HIGHCPU_32'
-timeout: '7200s'
+timeout: "7200s"
diff --git a/testing/smoke_test.yaml b/testing/smoke_test.yaml
index d412432..59950c6 100644
--- a/testing/smoke_test.yaml
+++ b/testing/smoke_test.yaml
@@ -13,32 +13,32 @@
 # limitations under the License.
 
 substitutions:
-  '_TEST': 'smoke_test'
-  '_INPUT_IMAGE': 'cos-93-16623-461-15'
-  '_INPUT_PROJECT': 'cos-cloud'
+  "_TEST": "smoke_test"
+  "_INPUT_IMAGE": "cos-dev-69-10895-0-0"
+  "_INPUT_PROJECT": "cos-cloud"
 steps:
-- name: 'gcr.io/cloud-builders/docker'
-  args: ['build', '-f', 'src/cmd/cos_customizer/Dockerfile', '-t', 'cos_customizer', '.']
-- name: 'cos_customizer'
-  args: ['start-image-build',
-         '-build-context=testing/${_TEST}',
-         '-image-name=${_INPUT_IMAGE}',
-         '-image-project=${_INPUT_PROJECT}',
-         '-gcs-bucket=${PROJECT_ID}_cloudbuild',
-         '-gcs-workdir=customizer-$BUILD_ID']
-- name: 'cos_customizer'
-  args: ['run-script',
-         '-script=preload.sh']
-- name: 'cos_customizer'
-  args: ['finish-image-build',
-         '-zone=us-west1-b',
-         '-project=$PROJECT_ID',
-         '-image-name=preload-test-$BUILD_ID',
-         '-image-project=$PROJECT_ID']
+- name: 'gcr.io/cloud-builders/bazel'
+  args: ["run", "--spawn_strategy=standalone", ":cos_customizer", "--", "--norun"]
+- name: 'bazel:cos_customizer'
+  args: ["start-image-build",
+         "-build-context=testing/${_TEST}",
+         "-image-name=${_INPUT_IMAGE}",
+         "-image-project=${_INPUT_PROJECT}",
+         "-gcs-bucket=${PROJECT_ID}_cloudbuild",
+         "-gcs-workdir=customizer-$BUILD_ID"]
+- name: 'bazel:cos_customizer'
+  args: ["run-script",
+         "-script=preload.sh"]
+- name: 'bazel:cos_customizer'
+  args: ["finish-image-build",
+         "-zone=us-west1-b",
+         "-project=$PROJECT_ID",
+         "-image-name=preload-test-$BUILD_ID",
+         "-image-project=$PROJECT_ID"]
 - name: 'gcr.io/compute-image-tools/daisy'
-  args: ['-project=$PROJECT_ID', '-zone=us-west1-b', '-var:image_name',
-         'preload-test-$BUILD_ID', '-var:image_project', '$PROJECT_ID',
-         '-var:test_cfg', '../${_TEST}/preload_test.cfg', 'testing/util/run_test.wf.json']
+  args: ["-project=$PROJECT_ID", "-zone=us-west1-b", "-var:image_name",
+         "preload-test-$BUILD_ID", "-var:image_project", "$PROJECT_ID",
+         "-var:test_cfg", "../${_TEST}/preload_test.cfg", "testing/util/run_test.wf.json"]
 options:
   machineType: 'N1_HIGHCPU_8'
-timeout: '7200s'
+timeout: "7200s"
diff --git a/testing/smoke_test/preload_test.cfg b/testing/smoke_test/preload_test.cfg
index 207717f..c943032 100644
--- a/testing/smoke_test/preload_test.cfg
+++ b/testing/smoke_test/preload_test.cfg
@@ -60,7 +60,7 @@
       }
 
       testVersion() {
-        expected="16623.461.15"
+        expected="10895.0.0"
         actual=$(. /etc/os-release; echo "${BUILD_ID}")
         if [[ "${expected}" != "${actual}" ]]; then
           echo "expected version: ${expected}"
diff --git a/testing/timeout_test/timeout_test.yaml b/testing/timeout_test/timeout_test.yaml
index 94be555..0c5bc3f 100644
--- a/testing/timeout_test/timeout_test.yaml
+++ b/testing/timeout_test/timeout_test.yaml
@@ -14,22 +14,22 @@
 
 substitutions:
   '_TEST': 'timeout_test'
-  '_INPUT_IMAGE': 'cos-93-16623-461-15'
+  '_INPUT_IMAGE': 'cos-dev-69-10895-0-0'
   '_INPUT_PROJECT': 'cos-cloud'
 steps:
-- name: 'gcr.io/cloud-builders/docker'
-  args: ['build', '-f', 'src/cmd/cos_customizer/Dockerfile', '-t', 'cos_customizer', '.']
-- name: 'cos_customizer'
+- name: 'gcr.io/cloud-builders/bazel'
+  args: ['run', '--spawn_strategy=standalone', ':cos_customizer', '--', '--norun']
+- name: 'bazel:cos_customizer'
   args: ['start-image-build',
          '-build-context=testing/${_TEST}',
          '-image-name=${_INPUT_IMAGE}',
          '-image-project=${_INPUT_PROJECT}',
          '-gcs-bucket=${PROJECT_ID}_cloudbuild',
          '-gcs-workdir=customizer-$BUILD_ID']
-- name: 'cos_customizer'
+- name: 'bazel:cos_customizer'
   args: ['run-script',
          '-script=preload.sh']
-- name: 'cos_customizer'
+- name: 'bazel:cos_customizer'
   args: ['finish-image-build',
          '-zone=us-west1-b',
          '-project=$PROJECT_ID',
diff --git a/testing/toolbox_test.yaml b/testing/toolbox_test.yaml
index f489204..0b89950 100644
--- a/testing/toolbox_test.yaml
+++ b/testing/toolbox_test.yaml
@@ -13,32 +13,32 @@
 # limitations under the License.
 
 substitutions:
-  '_TEST': 'toolbox_test'
-  '_INPUT_IMAGE': 'cos-93-16623-461-15'
-  '_INPUT_PROJECT': 'cos-cloud'
+  "_TEST": "toolbox_test"
+  "_INPUT_IMAGE": "cos-dev-69-10895-0-0"
+  "_INPUT_PROJECT": "cos-cloud"
 steps:
-- name: 'gcr.io/cloud-builders/docker'
-  args: ['build', '-f', 'src/cmd/cos_customizer/Dockerfile', '-t', 'cos_customizer', '.']
-- name: 'cos_customizer'
-  args: ['start-image-build',
-         '-build-context=testing/${_TEST}',
-         '-image-name=${_INPUT_IMAGE}',
-         '-image-project=${_INPUT_PROJECT}',
-         '-gcs-bucket=${PROJECT_ID}_cloudbuild',
-         '-gcs-workdir=customizer-$BUILD_ID']
-- name: 'cos_customizer'
-  args: ['run-script',
-         '-script=preload.sh']
-- name: 'cos_customizer'
-  args: ['finish-image-build',
-         '-zone=us-west1-b',
-         '-project=$PROJECT_ID',
-         '-image-name=preload-test-$BUILD_ID',
-         '-image-project=$PROJECT_ID']
+- name: 'gcr.io/cloud-builders/bazel'
+  args: ["run", "--spawn_strategy=standalone", ":cos_customizer", "--", "--norun"]
+- name: 'bazel:cos_customizer'
+  args: ["start-image-build",
+         "-build-context=testing/${_TEST}",
+         "-image-name=${_INPUT_IMAGE}",
+         "-image-project=${_INPUT_PROJECT}",
+         "-gcs-bucket=${PROJECT_ID}_cloudbuild",
+         "-gcs-workdir=customizer-$BUILD_ID"]
+- name: 'bazel:cos_customizer'
+  args: ["run-script",
+         "-script=preload.sh"]
+- name: 'bazel:cos_customizer'
+  args: ["finish-image-build",
+         "-zone=us-west1-b",
+         "-project=$PROJECT_ID",
+         "-image-name=preload-test-$BUILD_ID",
+         "-image-project=$PROJECT_ID"]
 - name: 'gcr.io/compute-image-tools/daisy'
-  args: ['-project=$PROJECT_ID', '-zone=us-west1-b', '-var:image_name',
-         'preload-test-$BUILD_ID', '-var:image_project', '$PROJECT_ID',
-         '-var:test_cfg', '../${_TEST}/preload_test.cfg', 'testing/util/run_test.wf.json']
+  args: ["-project=$PROJECT_ID", "-zone=us-west1-b", "-var:image_name",
+         "preload-test-$BUILD_ID", "-var:image_project", "$PROJECT_ID",
+         "-var:test_cfg", "../${_TEST}/preload_test.cfg", "testing/util/run_test.wf.json"]
 options:
   machineType: 'N1_HIGHCPU_8'
-timeout: '7200s'
+timeout: "7200s"
diff --git a/testing/toolbox_test/preload.sh b/testing/toolbox_test/preload.sh
index 0eece3c..fee0210 100644
--- a/testing/toolbox_test/preload.sh
+++ b/testing/toolbox_test/preload.sh
@@ -14,4 +14,4 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-toolbox echo
+toolbox
diff --git a/testing/toolbox_test/preload_test.cfg b/testing/toolbox_test/preload_test.cfg
index 32094d3..da3f4f6 100644
--- a/testing/toolbox_test/preload_test.cfg
+++ b/testing/toolbox_test/preload_test.cfg
@@ -30,8 +30,8 @@
       }
 
       testToolbox() {
-        expected="gcr.io/cos-cloud/toolbox:v20230615"
-        actual=$(ctr images ls -q)
+        expected="gcr.io/google-containers/toolbox"
+        actual=$(docker images --format {{.Repository}})
         if [[ "${expected}" != "${actual}" ]]; then
           echo "expected: ${expected}"
           echo "actual: ${actual}"
diff --git a/testing/ubuntu_ova_test.yaml b/testing/ubuntu_ova_test.yaml
index bf7a0d7..06d5230 100644
--- a/testing/ubuntu_ova_test.yaml
+++ b/testing/ubuntu_ova_test.yaml
@@ -17,8 +17,8 @@
   '_INPUT_IMAGE': 'https://cloud-images.ubuntu.com/bionic/current/bionic-server-cloudimg-amd64.ova'
 steps:
 # Build cos-customizer and tools container
-- name: 'gcr.io/cloud-builders/docker'
-  args: ['build', '-f', 'src/cmd/cos_customizer/Dockerfile', '-t', 'cos_customizer', '.']
+- name: 'gcr.io/cloud-builders/bazel'
+  args: ['run', '--spawn_strategy=standalone', ':cos_customizer', '--', '--norun']
 - name: 'gcr.io/cloud-builders/docker'
   entrypoint: 'bash'
   args:
@@ -56,17 +56,17 @@
   args: ['rm', 'gs://${PROJECT_ID}_cloudbuild/build-ova-${BUILD_ID}/ubuntu_gce.tar.gz']
 
 # Run cos-customizer
-- name: 'cos_customizer'
+- name: 'bazel:cos_customizer'
   args: ['start-image-build',
          '-build-context=testing/${_TEST}',
          '-image-name=input-${BUILD_ID}',
          '-image-project=${PROJECT_ID}',
          '-gcs-bucket=${PROJECT_ID}_cloudbuild',
          '-gcs-workdir=customizer-$BUILD_ID']
-- name: 'cos_customizer'
+- name: 'bazel:cos_customizer'
   args: ['run-script',
          '-script=preload.sh']
-- name: 'cos_customizer'
+- name: 'bazel:cos_customizer'
   args: ['finish-image-build',
          '-zone=us-west1-b',
          '-project=${PROJECT_ID}',