diff --git a/WORKSPACE b/WORKSPACE
index add3951ebe0a..15938bf25dab 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -1,80 +1,5 @@
 workspace(name = "envoy")
 
-load("//bazel:repositories.bzl", "envoy_dependencies")
+load("//bazel:prebuilt.bzl", "envoy_prebuilt_workspace_targets")
 
-envoy_dependencies()
-
-bind(
-    name = "ares",
-    actual = "@cares_git//:ares",
-)
-
-bind(
-    name = "cc_wkt_protos_genproto",
-    actual = "@protobuf_git//:cc_wkt_protos_genproto",
-)
-
-bind(
-    name = "cc_wkt_protos",
-    actual = "@protobuf_git//:cc_wkt_protos",
-)
-
-bind(
-    name = "event",
-    actual = "@libevent_git//:event",
-)
-
-bind(
-    name = "event_pthreads",
-    actual = "@libevent_git//:event_pthreads",
-)
-
-bind(
-    name = "googletest",
-    actual = "@googletest_git//:googletest",
-)
-
-bind(
-    name = "http_parser",
-    actual = "@http_parser_git//:http_parser",
-)
-
-bind(
-    name = "lightstep",
-    actual = "@lightstep_git//:lightstep_core",
-)
-
-bind(
-    name = "nghttp2",
-    actual = "@nghttp2_tar//:nghttp2",
-)
-
-bind(
-    name = "protobuf",
-    actual = "@protobuf_git//:protobuf",
-)
-
-bind(
-    name = "protoc",
-    actual = "@protobuf_git//:protoc",
-)
-
-bind(
-    name = "rapidjson",
-    actual = "@rapidjson_git//:rapidjson",
-)
-
-bind(
-    name = "spdlog",
-    actual = "@spdlog_git//:spdlog",
-)
-
-bind(
-    name = "ssl",
-    actual = "@boringssl//:ssl",
-)
-
-bind(
-    name = "tclap",
-    actual = "@tclap_archive//:tclap",
-)
+envoy_prebuilt_workspace_targets("//bazel")
diff --git a/bazel/BUILD b/bazel/BUILD
index e69de29bb2d1..af3dca168c3f 100644
--- a/bazel/BUILD
+++ b/bazel/BUILD
@@ -0,0 +1,5 @@
+package(default_visibility = ["//visibility:public"])
+
+load(":prebuilt.bzl", "envoy_prebuilt_targets")
+
+envoy_prebuilt_targets(prebuilts_genrule = True)
diff --git a/bazel/EXTERNAL_DEPS.md b/bazel/EXTERNAL_DEPS.md
new file mode 100644
index 000000000000..337cfb0ec6d6
--- /dev/null
+++ b/bazel/EXTERNAL_DEPS.md
@@ -0,0 +1,20 @@
+# Adding external dependencies to Envoy
+
+1. Specify name and version in [external documentation](../docs/install/requirements.rst).
+2. Add a build recipe in [`ci/build_container/build_recipes`](../ci/build_container/build_recipes)
+   for developer-local and CI external dependency build flows. Reference build recipe from the [`Makefile`](../ci/build_container/Makefile).
+3. Verify that the build recipe works by running `ENVOY_SRC_DIR=$PWD tools/setup_external_deps.sh`
+   from the Envoy root. The built artifacts are located in `build/prebuilt`.
+4. Add a `LIBS` entry in `bazel/gen_prebuilt.py` providing a reference to the build recipe and
+   a name X for the new external dependency target.
+5. `bazel/gen_prebuilt.sh` to rebuild `bazel/prebuilt.bzl`.
+6. Reference your new external dependency in some `envoy_cc_library` via X in the `external_deps`
+   attribute.
+7. `bazel test //test/...`
+
+# Updating an external dependency version
+
+1. Specify the new version in [external documentation](../docs/install/requirements.rst).
+2. Update the build recipe in [`ci/build_container/build_recipes`](../ci/build_container/build_recipes).
+3. `bazel/gen_prebuilt.sh` to rebuild `bazel/prebuilt.bzl`.
+4. `bazel test //test/...`
diff --git a/bazel/envoy_build_system.bzl b/bazel/envoy_build_system.bzl
index 6057d86abb83..e5dd5c06cbd9 100644
--- a/bazel/envoy_build_system.bzl
+++ b/bazel/envoy_build_system.bzl
@@ -1,4 +1,4 @@
-load("@protobuf_git//:protobuf.bzl", "cc_proto_library")
+load("@protobuf_bzl//:protobuf.bzl", "cc_proto_library")
 
 ENVOY_COPTS = [
     # TODO(htuch): Remove this when Bazel bringup is done.
diff --git a/bazel/gen_prebuilt.py b/bazel/gen_prebuilt.py
new file mode 100755
index 000000000000..aa5c6713733e
--- /dev/null
+++ b/bazel/gen_prebuilt.py
@@ -0,0 +1,277 @@
+#!/usr/bin/env python
+
+# This tool produces a .bzl file that provides functions that export out as
+# cc_library and filegroup targets all of Envoy's external dependencies. At the
+# core of the generated .bzl file is a genrule that invokes the recursive make
+# system (inside a Bazel sandbox) located in ci/build_container/Makefile.
+#
+# A BUILD file with this genrule is generated, rather than prewritten, due to fundamental limits on
+# how Bazel builds its dependency graph. Bazel needs to know ahead of time, before it starts
+# executing rules, which outputs they produce. As a result, it needs to know, before invoking
+# ci/build_container/Makefile, what its resulting header/libraries will be - we can't use Bazel
+# globs as a result for example, since the results of ci/build_container/Makefile are not on
+# the filesystem at the time of glob evaluation.
+#
+# So, the approach taken here is that when a developer changes the external dependencies, they run
+# gen_prebuilt.sh, which first does a local build outside of Bazel with ci/build_container/Makefile.
+# Then, gen_prebuilt.py (this script) analyzes the files that resulted from the build and generates
+# a BUILD file, which then is checked into the repository.
+
+from collections import defaultdict
+from collections import namedtuple
+import os
+import string
+import sys
+
+# External libraries that we automatically discover headers from and generate
+# corresponding Bazel genrule and cc_library targets with.
+#   target: cc_library target name. This may be referenced in the external_deps
+#     parameter of envoy_cc_library.
+#   build_recipe: build recipe name in ci/build_container/build_recipes without
+#     .sh.
+#   build_paths: path in thirdparty_build/ of libraries to link.
+#   include_path: path to include files, starting with ${THIRDPARTY_BUILD} for
+#     generated headers or ${THIRDPARTY_SRC} for original source tree.
+Library = namedtuple('Library',
+                     ['target', 'build_recipe', 'build_paths', 'include_path'])
+LIBS = [
+    Library('ares', 'cares', ['lib/libcares.a'], '${THIRDPARTY_BUILD}/include'),
+    Library('crypto', 'boringssl', ['lib/libcrypto.a'],
+            '${THIRDPARTY_BUILD}/include'),
+    Library('event', 'libevent', ['lib/libevent.a'],
+            '${THIRDPARTY_BUILD}/include'),
+    Library('googletest', 'googletest', [
+        'lib/libgmock.a',
+        'lib/libgtest.a',
+    ], '${THIRDPARTY_BUILD}/include'),
+    Library('http_parser', 'http-parser', ['lib/libhttp_parser.a'],
+            '${THIRDPARTY_BUILD}/include'),
+    Library('lightstep_includes', 'lightstep', [],
+            '${THIRDPARTY_BUILD}/include'),
+    Library('nghttp2', 'nghttp2', ['lib/libnghttp2.a'],
+            '${THIRDPARTY_BUILD}/include'),
+    Library('protobuf', 'protobuf',
+            ['lib/libprotobuf.a', 'lib/libprotobuf-lite.a',
+             'lib/libprotoc.a'], '${THIRDPARTY_BUILD}/include'),
+    Library('rapidjson', 'rapidjson', [],
+            '${THIRDPARTY_SRC}/rapidjson-1.1.0/include'),
+    Library('spdlog', 'spdlog', [], '${THIRDPARTY_SRC}/spdlog-0.11.0/include'),
+    Library('tclap', 'tclap', [], '${THIRDPARTY_SRC}/tclap-1.2.1/include'),
+]
+
+# These library targets express dependency relationships in the Bazel graph so that the correct link
+# order can be expressed between .a files.
+DependentLibrary = namedtuple('DependentLibrary',
+                              ['target', 'build_recipe', 'build_paths', 'deps'])
+DEPLIBS = [
+    DependentLibrary('event_pthreads', 'libevent', ['lib/libevent_pthreads.a'],
+                     ['event']),
+    DependentLibrary('lightstep', 'lightstep',
+                     ['lib/liblightstep_core_cxx11.a'],
+                     ['lightstep_includes', 'protobuf']),
+    DependentLibrary('ssl', 'boringssl', ['lib/libssl.a'], ['crypto']),
+]
+
+# Filegroups are used to export misc. targets that are not libraries or headers, e.g.
+# the proto compiler.
+Filegroup = namedtuple('ExportedFile',
+                       ['target', 'build_recipe', 'build_paths'])
+FILEGROUPS = [
+    Filegroup('protoc', 'protobuf', ['bin/protoc']),
+]
+
+PREBUILT_TEMPLATE = string.Template(
+    '''# Everything in this file is generated by bazel/gen_prebuilt.sh, DO NOT HAND
+# EDIT. This script should be rerun on the change to any dependency.
+
+${list_def_defs}${generated_files}
+
+def envoy_prebuilt_targets(prebuilts_genrule=False):
+    if prebuilts_genrule:
+        native.genrule(
+            name = "prebuilts",
+            srcs = [
+                "//ci/build_container:build_and_install_deps.sh",
+                "//ci/build_container:prebuilt_build_inputs",
+            ],
+            outs = GENERATED_FILES,
+            cmd = "export GENDIR=$$$$(realpath $$(@D)); BUILD_DISTINCT=1 TMPDIR=$$$$GENDIR " +
+                  "THIRDPARTY_DEPS=$$$$GENDIR THIRDPARTY_SRC=$$$$GENDIR/thirdparty " +
+                  "THIRDPARTY_BUILD=$$$$GENDIR/thirdparty_build $$(location " +
+                  "//ci/build_container:build_and_install_deps.sh)",
+            message = "Building Envoy dependencies",
+        )
+
+${cc_libraries}
+${filegroups}
+def envoy_prebuilt_workspace_targets(path):
+${binds}
+    # Used only for protobuf.bzl
+    native.git_repository(
+        name = "protobuf_bzl",
+        # Using a non-canonical repository/branch here. This is a workaround to the lack of
+        # merge on https://github.com/google/protobuf/pull/2508, which is needed for supporting
+        # arbitrary CC compiler locations from the environment. The branch is
+        # https://github.com/htuch/protobuf/tree/v3.2.0-default-shell-env, which is the 3.2.0
+        # release with the above mentioned PR cherry picked.
+        commit = "d490587268931da78c942a6372ef57bb53db80da",
+        remote = "https://github.com/htuch/protobuf.git",
+    )
+''')
+
+SOURCE_DIR_NAME = 'thirdparty'
+BUILD_DIR_NAME = 'thirdparty_build'
+
+
+def GetSourceDir(build_recipe):
+  return os.path.join(SOURCE_DIR_NAME, '%s.dep' % build_recipe)
+
+
+def GetBuildDir(build_recipe):
+  return os.path.join(BUILD_DIR_NAME, '%s.dep' % build_recipe)
+
+
+# Obtain a dictionary with the thirdparty source/build paths. This will be relative to the runfiles
+# root unless a prefix is provided.
+def GetEnvPaths(lib, prefix_path=''):
+  return {
+      'THIRDPARTY_SRC':
+          os.path.join(prefix_path, GetSourceDir(lib.build_recipe)),
+      'THIRDPARTY_BUILD':
+          os.path.join(prefix_path, GetBuildDir(lib.build_recipe)),
+  }
+
+
+def SubstitueEnvPaths(lib, s):
+  return string.Template(s).substitute(GetEnvPaths(lib))
+
+
+# This is the heart of the generated output analysis. It walks the include directory of
+# the dependency and finds all the headers.
+def GetExportedIncludes(lib, prebuilt_path):
+  include_prefix = lib.include_path
+  env = GetEnvPaths(lib, prebuilt_path)
+  include_files = []
+  for root, dirs, files in os.walk(
+      string.Template(include_prefix).substitute(env)):
+    include_files.extend(
+        os.path.join(root[len(prebuilt_path) + 1:], f) for f in files)
+  return sorted(include_files)
+
+
+# The rest of this file is the pretty-printing of the BUILD file.
+
+
+def Indent(s, indent_level=0):
+  return '    ' * indent_level + s
+
+
+def Quote(x):
+  return '"%s"' % x
+
+
+def QuoteList(xs):
+  return map(Quote, xs)
+
+
+def FormatBazelValue(value, indent_level=0):
+  if not isinstance(value, list):
+    return str(value)
+  return '[\n' + '\n'.join('%s,' % Indent(str(v), indent_level + 1)
+                           for v in value) + '\n' + Indent(']', indent_level)
+
+
+def FormatBazelRule(name, parameters):
+  return Indent('%s(\n' % name, 1) + '\n'.join(
+      Indent('%s = %s,' % (key, FormatBazelValue(value, 2)), 2)
+      for key, value in parameters) + '\n' + Indent(')\n', 1)
+
+
+def HeadersName(name):
+  return '%s_HDRS' % name.upper()
+
+
+def LibsName(name):
+  return '%s_LIBS' % name.upper()
+
+
+def FormatListDefs(lib, include_files):
+  list_defs = []
+  if include_files:
+    list_defs.append('%s = %s' % (HeadersName(lib.target),
+                                  FormatBazelValue(QuoteList(include_files))))
+  if lib.build_paths:
+    lib_files = (os.path.join(GetBuildDir(lib.build_recipe), p)
+                 for p in lib.build_paths)
+    list_defs.append('%s = %s' % (LibsName(lib.target),
+                                  FormatBazelValue(QuoteList(lib_files))))
+  return '\n\n'.join(list_defs) + '\n\n'
+
+
+def FormatGeneratedFiles(libs, includes):
+  defs = []
+  for lib in libs:
+    if includes.get(lib.target, None):
+      defs.append(HeadersName(lib.target))
+    if hasattr(lib, 'build_paths') and lib.build_paths:
+      defs.append(LibsName(lib.target))
+  preamble = 'GENERATED_FILES = ('
+  separator = ' +\n' + ' ' * len(preamble)
+  return preamble + separator.join(defs) + ')'
+
+
+def FormatCcLibrary(lib, has_headers):
+  params = [('name', Quote(lib.target))]
+  if lib.build_paths:
+    params.append(('srcs', LibsName(lib.target)))
+  if has_headers:
+    params.append(('hdrs', HeadersName(lib.target)))
+  if hasattr(lib, 'deps'):
+    params.append(('deps', QuoteList(lib.deps)))
+  if hasattr(lib, 'include_path'):
+    params.append(('includes',
+                   [Quote(SubstitueEnvPaths(lib, lib.include_path))]))
+  return FormatBazelRule('native.cc_library', params)
+
+
+def FormatFilegroup(filegroup):
+  return FormatBazelRule('native.filegroup', [('name', Quote(filegroup.target)),
+                                              ('srcs',
+                                               LibsName(filegroup.target))])
+
+
+def FormatBind(lib):
+  return FormatBazelRule('native.bind',
+                         [('name', Quote(lib.target)),
+                          ('actual', 'path + ' + Quote(':%s' % lib.target))])
+
+
+if __name__ == '__main__':
+  if len(sys.argv) != 3:
+    print 'Usage: %s <prebuilt directory> <output BUILD path>' % sys.argv[0]
+    sys.exit(1)
+
+  prebuilt_path = sys.argv[1]
+  build_path = sys.argv[2]
+  includes = defaultdict(list)
+
+  for lib in sorted(LIBS):
+    includes[lib.target] = GetExportedIncludes(lib, prebuilt_path)
+
+  sorted_libs = sorted(LIBS + DEPLIBS, key=lambda lib: lib.target)
+  sorted_filegroups = sorted(FILEGROUPS, key=lambda lib: lib.target)
+  build_contents = PREBUILT_TEMPLATE.substitute(
+      list_def_defs=''.join(
+          FormatListDefs(lib, includes[lib.target])
+          for lib in sorted_libs + sorted_filegroups),
+      generated_files=FormatGeneratedFiles(sorted_libs + sorted_filegroups,
+                                           includes),
+      cc_libraries='\n'.join(
+          FormatCcLibrary(lib, bool(includes[lib.target]))
+          for lib in sorted_libs),
+      filegroups='\n'.join(FormatFilegroup(fg) for fg in sorted_filegroups),
+      binds='\n'.join(
+          FormatBind(lib) for lib in sorted_libs + sorted_filegroups))
+
+  with open(build_path, 'w') as f:
+    f.write(build_contents)
diff --git a/bazel/gen_prebuilt.sh b/bazel/gen_prebuilt.sh
new file mode 100755
index 000000000000..63d43593ee9e
--- /dev/null
+++ b/bazel/gen_prebuilt.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# Run this file when adding a new or upgrading an existing external dependency.
+
+set -e
+
+[ -z "${ENVOY_SRC_DIR}" ] && { echo "ENVOY_SRC_DIR not set"; exit 1; }
+
+"${ENVOY_SRC_DIR}"/tools/setup_external_deps.sh
+"${ENVOY_SRC_DIR}"/bazel/gen_prebuilt.py "${ENVOY_SRC_DIR}"/build/prebuilt \
+  "${ENVOY_SRC_DIR}"/bazel/prebuilt.bzl
diff --git a/bazel/prebuilt.bzl b/bazel/prebuilt.bzl
new file mode 100644
index 000000000000..f78a7d374d64
--- /dev/null
+++ b/bazel/prebuilt.bzl
@@ -0,0 +1,732 @@
+# Everything in this file is generated by bazel/gen_prebuilt.sh, DO NOT HAND
+# EDIT. This script should be rerun on the change to any dependency.
+
+ARES_HDRS = [
+    "thirdparty_build/cares.dep/include/ares.h",
+    "thirdparty_build/cares.dep/include/ares_build.h",
+    "thirdparty_build/cares.dep/include/ares_dns.h",
+    "thirdparty_build/cares.dep/include/ares_rules.h",
+    "thirdparty_build/cares.dep/include/ares_version.h",
+]
+
+ARES_LIBS = [
+    "thirdparty_build/cares.dep/lib/libcares.a",
+]
+
+CRYPTO_HDRS = [
+    "thirdparty_build/boringssl.dep/include/openssl/aead.h",
+    "thirdparty_build/boringssl.dep/include/openssl/aes.h",
+    "thirdparty_build/boringssl.dep/include/openssl/arm_arch.h",
+    "thirdparty_build/boringssl.dep/include/openssl/asn1.h",
+    "thirdparty_build/boringssl.dep/include/openssl/asn1_mac.h",
+    "thirdparty_build/boringssl.dep/include/openssl/asn1t.h",
+    "thirdparty_build/boringssl.dep/include/openssl/base.h",
+    "thirdparty_build/boringssl.dep/include/openssl/base64.h",
+    "thirdparty_build/boringssl.dep/include/openssl/bio.h",
+    "thirdparty_build/boringssl.dep/include/openssl/blowfish.h",
+    "thirdparty_build/boringssl.dep/include/openssl/bn.h",
+    "thirdparty_build/boringssl.dep/include/openssl/buf.h",
+    "thirdparty_build/boringssl.dep/include/openssl/buffer.h",
+    "thirdparty_build/boringssl.dep/include/openssl/bytestring.h",
+    "thirdparty_build/boringssl.dep/include/openssl/cast.h",
+    "thirdparty_build/boringssl.dep/include/openssl/chacha.h",
+    "thirdparty_build/boringssl.dep/include/openssl/cipher.h",
+    "thirdparty_build/boringssl.dep/include/openssl/cmac.h",
+    "thirdparty_build/boringssl.dep/include/openssl/conf.h",
+    "thirdparty_build/boringssl.dep/include/openssl/cpu.h",
+    "thirdparty_build/boringssl.dep/include/openssl/crypto.h",
+    "thirdparty_build/boringssl.dep/include/openssl/curve25519.h",
+    "thirdparty_build/boringssl.dep/include/openssl/des.h",
+    "thirdparty_build/boringssl.dep/include/openssl/dh.h",
+    "thirdparty_build/boringssl.dep/include/openssl/digest.h",
+    "thirdparty_build/boringssl.dep/include/openssl/dsa.h",
+    "thirdparty_build/boringssl.dep/include/openssl/dtls1.h",
+    "thirdparty_build/boringssl.dep/include/openssl/ec.h",
+    "thirdparty_build/boringssl.dep/include/openssl/ec_key.h",
+    "thirdparty_build/boringssl.dep/include/openssl/ecdh.h",
+    "thirdparty_build/boringssl.dep/include/openssl/ecdsa.h",
+    "thirdparty_build/boringssl.dep/include/openssl/engine.h",
+    "thirdparty_build/boringssl.dep/include/openssl/err.h",
+    "thirdparty_build/boringssl.dep/include/openssl/evp.h",
+    "thirdparty_build/boringssl.dep/include/openssl/ex_data.h",
+    "thirdparty_build/boringssl.dep/include/openssl/hkdf.h",
+    "thirdparty_build/boringssl.dep/include/openssl/hmac.h",
+    "thirdparty_build/boringssl.dep/include/openssl/lhash.h",
+    "thirdparty_build/boringssl.dep/include/openssl/lhash_macros.h",
+    "thirdparty_build/boringssl.dep/include/openssl/md4.h",
+    "thirdparty_build/boringssl.dep/include/openssl/md5.h",
+    "thirdparty_build/boringssl.dep/include/openssl/mem.h",
+    "thirdparty_build/boringssl.dep/include/openssl/newhope.h",
+    "thirdparty_build/boringssl.dep/include/openssl/nid.h",
+    "thirdparty_build/boringssl.dep/include/openssl/obj.h",
+    "thirdparty_build/boringssl.dep/include/openssl/obj_mac.h",
+    "thirdparty_build/boringssl.dep/include/openssl/objects.h",
+    "thirdparty_build/boringssl.dep/include/openssl/opensslconf.h",
+    "thirdparty_build/boringssl.dep/include/openssl/opensslv.h",
+    "thirdparty_build/boringssl.dep/include/openssl/ossl_typ.h",
+    "thirdparty_build/boringssl.dep/include/openssl/pem.h",
+    "thirdparty_build/boringssl.dep/include/openssl/pkcs12.h",
+    "thirdparty_build/boringssl.dep/include/openssl/pkcs7.h",
+    "thirdparty_build/boringssl.dep/include/openssl/pkcs8.h",
+    "thirdparty_build/boringssl.dep/include/openssl/poly1305.h",
+    "thirdparty_build/boringssl.dep/include/openssl/pool.h",
+    "thirdparty_build/boringssl.dep/include/openssl/rand.h",
+    "thirdparty_build/boringssl.dep/include/openssl/rc4.h",
+    "thirdparty_build/boringssl.dep/include/openssl/ripemd.h",
+    "thirdparty_build/boringssl.dep/include/openssl/rsa.h",
+    "thirdparty_build/boringssl.dep/include/openssl/safestack.h",
+    "thirdparty_build/boringssl.dep/include/openssl/sha.h",
+    "thirdparty_build/boringssl.dep/include/openssl/srtp.h",
+    "thirdparty_build/boringssl.dep/include/openssl/ssl.h",
+    "thirdparty_build/boringssl.dep/include/openssl/ssl3.h",
+    "thirdparty_build/boringssl.dep/include/openssl/stack.h",
+    "thirdparty_build/boringssl.dep/include/openssl/stack_macros.h",
+    "thirdparty_build/boringssl.dep/include/openssl/thread.h",
+    "thirdparty_build/boringssl.dep/include/openssl/time_support.h",
+    "thirdparty_build/boringssl.dep/include/openssl/tls1.h",
+    "thirdparty_build/boringssl.dep/include/openssl/type_check.h",
+    "thirdparty_build/boringssl.dep/include/openssl/x509.h",
+    "thirdparty_build/boringssl.dep/include/openssl/x509_vfy.h",
+    "thirdparty_build/boringssl.dep/include/openssl/x509v3.h",
+]
+
+CRYPTO_LIBS = [
+    "thirdparty_build/boringssl.dep/lib/libcrypto.a",
+]
+
+EVENT_HDRS = [
+    "thirdparty_build/libevent.dep/include/evdns.h",
+    "thirdparty_build/libevent.dep/include/event.h",
+    "thirdparty_build/libevent.dep/include/event2/buffer.h",
+    "thirdparty_build/libevent.dep/include/event2/buffer_compat.h",
+    "thirdparty_build/libevent.dep/include/event2/bufferevent.h",
+    "thirdparty_build/libevent.dep/include/event2/bufferevent_compat.h",
+    "thirdparty_build/libevent.dep/include/event2/bufferevent_ssl.h",
+    "thirdparty_build/libevent.dep/include/event2/bufferevent_struct.h",
+    "thirdparty_build/libevent.dep/include/event2/dns.h",
+    "thirdparty_build/libevent.dep/include/event2/dns_compat.h",
+    "thirdparty_build/libevent.dep/include/event2/dns_struct.h",
+    "thirdparty_build/libevent.dep/include/event2/event-config.h",
+    "thirdparty_build/libevent.dep/include/event2/event.h",
+    "thirdparty_build/libevent.dep/include/event2/event_compat.h",
+    "thirdparty_build/libevent.dep/include/event2/event_struct.h",
+    "thirdparty_build/libevent.dep/include/event2/http.h",
+    "thirdparty_build/libevent.dep/include/event2/http_compat.h",
+    "thirdparty_build/libevent.dep/include/event2/http_struct.h",
+    "thirdparty_build/libevent.dep/include/event2/keyvalq_struct.h",
+    "thirdparty_build/libevent.dep/include/event2/listener.h",
+    "thirdparty_build/libevent.dep/include/event2/rpc.h",
+    "thirdparty_build/libevent.dep/include/event2/rpc_compat.h",
+    "thirdparty_build/libevent.dep/include/event2/rpc_struct.h",
+    "thirdparty_build/libevent.dep/include/event2/tag.h",
+    "thirdparty_build/libevent.dep/include/event2/tag_compat.h",
+    "thirdparty_build/libevent.dep/include/event2/thread.h",
+    "thirdparty_build/libevent.dep/include/event2/util.h",
+    "thirdparty_build/libevent.dep/include/event2/visibility.h",
+    "thirdparty_build/libevent.dep/include/evhttp.h",
+    "thirdparty_build/libevent.dep/include/evrpc.h",
+    "thirdparty_build/libevent.dep/include/evutil.h",
+]
+
+EVENT_LIBS = [
+    "thirdparty_build/libevent.dep/lib/libevent.a",
+]
+
+EVENT_PTHREADS_LIBS = [
+    "thirdparty_build/libevent.dep/lib/libevent_pthreads.a",
+]
+
+GOOGLETEST_HDRS = [
+    "thirdparty_build/googletest.dep/include/gmock/gmock-actions.h",
+    "thirdparty_build/googletest.dep/include/gmock/gmock-cardinalities.h",
+    "thirdparty_build/googletest.dep/include/gmock/gmock-generated-actions.h",
+    "thirdparty_build/googletest.dep/include/gmock/gmock-generated-actions.h.pump",
+    "thirdparty_build/googletest.dep/include/gmock/gmock-generated-function-mockers.h",
+    "thirdparty_build/googletest.dep/include/gmock/gmock-generated-function-mockers.h.pump",
+    "thirdparty_build/googletest.dep/include/gmock/gmock-generated-matchers.h",
+    "thirdparty_build/googletest.dep/include/gmock/gmock-generated-matchers.h.pump",
+    "thirdparty_build/googletest.dep/include/gmock/gmock-generated-nice-strict.h",
+    "thirdparty_build/googletest.dep/include/gmock/gmock-generated-nice-strict.h.pump",
+    "thirdparty_build/googletest.dep/include/gmock/gmock-matchers.h",
+    "thirdparty_build/googletest.dep/include/gmock/gmock-more-actions.h",
+    "thirdparty_build/googletest.dep/include/gmock/gmock-more-matchers.h",
+    "thirdparty_build/googletest.dep/include/gmock/gmock-spec-builders.h",
+    "thirdparty_build/googletest.dep/include/gmock/gmock.h",
+    "thirdparty_build/googletest.dep/include/gmock/internal/custom/gmock-generated-actions.h",
+    "thirdparty_build/googletest.dep/include/gmock/internal/custom/gmock-generated-actions.h.pump",
+    "thirdparty_build/googletest.dep/include/gmock/internal/custom/gmock-matchers.h",
+    "thirdparty_build/googletest.dep/include/gmock/internal/custom/gmock-port.h",
+    "thirdparty_build/googletest.dep/include/gmock/internal/gmock-generated-internal-utils.h",
+    "thirdparty_build/googletest.dep/include/gmock/internal/gmock-generated-internal-utils.h.pump",
+    "thirdparty_build/googletest.dep/include/gmock/internal/gmock-internal-utils.h",
+    "thirdparty_build/googletest.dep/include/gmock/internal/gmock-port.h",
+    "thirdparty_build/googletest.dep/include/gtest/gtest-death-test.h",
+    "thirdparty_build/googletest.dep/include/gtest/gtest-message.h",
+    "thirdparty_build/googletest.dep/include/gtest/gtest-param-test.h",
+    "thirdparty_build/googletest.dep/include/gtest/gtest-param-test.h.pump",
+    "thirdparty_build/googletest.dep/include/gtest/gtest-printers.h",
+    "thirdparty_build/googletest.dep/include/gtest/gtest-spi.h",
+    "thirdparty_build/googletest.dep/include/gtest/gtest-test-part.h",
+    "thirdparty_build/googletest.dep/include/gtest/gtest-typed-test.h",
+    "thirdparty_build/googletest.dep/include/gtest/gtest.h",
+    "thirdparty_build/googletest.dep/include/gtest/gtest_pred_impl.h",
+    "thirdparty_build/googletest.dep/include/gtest/gtest_prod.h",
+    "thirdparty_build/googletest.dep/include/gtest/internal/custom/gtest-port.h",
+    "thirdparty_build/googletest.dep/include/gtest/internal/custom/gtest-printers.h",
+    "thirdparty_build/googletest.dep/include/gtest/internal/custom/gtest.h",
+    "thirdparty_build/googletest.dep/include/gtest/internal/gtest-death-test-internal.h",
+    "thirdparty_build/googletest.dep/include/gtest/internal/gtest-filepath.h",
+    "thirdparty_build/googletest.dep/include/gtest/internal/gtest-internal.h",
+    "thirdparty_build/googletest.dep/include/gtest/internal/gtest-linked_ptr.h",
+    "thirdparty_build/googletest.dep/include/gtest/internal/gtest-param-util-generated.h",
+    "thirdparty_build/googletest.dep/include/gtest/internal/gtest-param-util-generated.h.pump",
+    "thirdparty_build/googletest.dep/include/gtest/internal/gtest-param-util.h",
+    "thirdparty_build/googletest.dep/include/gtest/internal/gtest-port-arch.h",
+    "thirdparty_build/googletest.dep/include/gtest/internal/gtest-port.h",
+    "thirdparty_build/googletest.dep/include/gtest/internal/gtest-string.h",
+    "thirdparty_build/googletest.dep/include/gtest/internal/gtest-tuple.h",
+    "thirdparty_build/googletest.dep/include/gtest/internal/gtest-tuple.h.pump",
+    "thirdparty_build/googletest.dep/include/gtest/internal/gtest-type-util.h",
+    "thirdparty_build/googletest.dep/include/gtest/internal/gtest-type-util.h.pump",
+]
+
+GOOGLETEST_LIBS = [
+    "thirdparty_build/googletest.dep/lib/libgmock.a",
+    "thirdparty_build/googletest.dep/lib/libgtest.a",
+]
+
+HTTP_PARSER_HDRS = [
+    "thirdparty_build/http-parser.dep/include/http_parser.h",
+]
+
+HTTP_PARSER_LIBS = [
+    "thirdparty_build/http-parser.dep/lib/libhttp_parser.a",
+]
+
+LIGHTSTEP_LIBS = [
+    "thirdparty_build/lightstep.dep/lib/liblightstep_core_cxx11.a",
+]
+
+LIGHTSTEP_INCLUDES_HDRS = [
+    "thirdparty_build/lightstep.dep/include/collector.pb.h",
+    "thirdparty_build/lightstep.dep/include/lightstep/carrier.h",
+    "thirdparty_build/lightstep.dep/include/lightstep/impl.h",
+    "thirdparty_build/lightstep.dep/include/lightstep/options.h",
+    "thirdparty_build/lightstep.dep/include/lightstep/propagation.h",
+    "thirdparty_build/lightstep.dep/include/lightstep/recorder.h",
+    "thirdparty_build/lightstep.dep/include/lightstep/span.h",
+    "thirdparty_build/lightstep.dep/include/lightstep/tracer.h",
+    "thirdparty_build/lightstep.dep/include/lightstep/util.h",
+    "thirdparty_build/lightstep.dep/include/lightstep/value.h",
+    "thirdparty_build/lightstep.dep/include/lightstep_carrier.pb.h",
+    "thirdparty_build/lightstep.dep/include/mapbox_variant/recursive_wrapper.hpp",
+    "thirdparty_build/lightstep.dep/include/mapbox_variant/variant.hpp",
+]
+
+NGHTTP2_HDRS = [
+    "thirdparty_build/nghttp2.dep/include/nghttp2/nghttp2.h",
+    "thirdparty_build/nghttp2.dep/include/nghttp2/nghttp2ver.h",
+]
+
+NGHTTP2_LIBS = [
+    "thirdparty_build/nghttp2.dep/lib/libnghttp2.a",
+]
+
+PROTOBUF_HDRS = [
+    "thirdparty_build/protobuf.dep/include/google/protobuf/any.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/any.pb.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/any.proto",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/api.pb.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/api.proto",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/arena.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/arenastring.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/compiler/code_generator.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/compiler/command_line_interface.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/compiler/cpp/cpp_generator.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/compiler/csharp/csharp_generator.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/compiler/csharp/csharp_names.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/compiler/importer.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/compiler/java/java_generator.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/compiler/java/java_names.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/compiler/javanano/javanano_generator.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/compiler/js/js_generator.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/compiler/js/well_known_types_embed.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/compiler/objectivec/objectivec_generator.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/compiler/objectivec/objectivec_helpers.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/compiler/parser.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/compiler/php/php_generator.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/compiler/plugin.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/compiler/plugin.pb.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/compiler/plugin.proto",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/compiler/python/python_generator.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/compiler/ruby/ruby_generator.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/descriptor.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/descriptor.pb.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/descriptor.proto",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/descriptor_database.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/duration.pb.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/duration.proto",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/dynamic_message.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/empty.pb.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/empty.proto",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/extension_set.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/field_mask.pb.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/field_mask.proto",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/generated_enum_reflection.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/generated_enum_util.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/generated_message_reflection.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/generated_message_util.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/has_bits.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/io/coded_stream.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/io/printer.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/io/strtod.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/io/tokenizer.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/io/zero_copy_stream.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/io/zero_copy_stream_impl.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/io/zero_copy_stream_impl_lite.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/map.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/map_entry.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/map_entry_lite.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/map_field.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/map_field_inl.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/map_field_lite.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/map_type_handler.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/message.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/message_lite.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/metadata.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/reflection.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/reflection_ops.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/repeated_field.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/service.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/source_context.pb.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/source_context.proto",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/struct.pb.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/struct.proto",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/atomic_sequence_num.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/atomicops.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/atomicops_internals_arm64_gcc.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/atomicops_internals_arm_gcc.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/atomicops_internals_arm_qnx.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/atomicops_internals_atomicword_compat.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/atomicops_internals_generic_c11_atomic.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/atomicops_internals_generic_gcc.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/atomicops_internals_macosx.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/atomicops_internals_mips_gcc.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/atomicops_internals_power.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/atomicops_internals_ppc_gcc.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/atomicops_internals_solaris.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/atomicops_internals_tsan.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/atomicops_internals_x86_gcc.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/atomicops_internals_x86_msvc.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/bytestream.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/callback.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/casts.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/common.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/fastmem.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/hash.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/logging.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/macros.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/mutex.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/once.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/platform_macros.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/port.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/scoped_ptr.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/shared_ptr.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/singleton.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/status.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/stl_util.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/stringpiece.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/template_util.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/stubs/type_traits.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/text_format.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/timestamp.pb.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/timestamp.proto",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/type.pb.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/type.proto",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/unknown_field_set.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/util/field_comparator.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/util/field_mask_util.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/util/json_util.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/util/message_differencer.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/util/time_util.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/util/type_resolver.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/util/type_resolver_util.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/wire_format.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/wire_format_lite.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/wire_format_lite_inl.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/wrappers.pb.h",
+    "thirdparty_build/protobuf.dep/include/google/protobuf/wrappers.proto",
+]
+
+PROTOBUF_LIBS = [
+    "thirdparty_build/protobuf.dep/lib/libprotobuf.a",
+    "thirdparty_build/protobuf.dep/lib/libprotobuf-lite.a",
+    "thirdparty_build/protobuf.dep/lib/libprotoc.a",
+]
+
+RAPIDJSON_HDRS = [
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/allocators.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/document.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/encodedstream.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/encodings.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/error/en.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/error/error.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/filereadstream.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/filewritestream.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/fwd.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/internal/biginteger.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/internal/diyfp.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/internal/dtoa.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/internal/ieee754.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/internal/itoa.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/internal/meta.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/internal/pow10.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/internal/regex.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/internal/stack.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/internal/strfunc.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/internal/strtod.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/internal/swap.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/istreamwrapper.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/memorybuffer.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/memorystream.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/msinttypes/inttypes.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/msinttypes/stdint.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/ostreamwrapper.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/pointer.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/prettywriter.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/rapidjson.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/reader.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/schema.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/stream.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/stringbuffer.h",
+    "thirdparty/rapidjson.dep/rapidjson-1.1.0/include/rapidjson/writer.h",
+]
+
+SPDLOG_HDRS = [
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/async_logger.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/common.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/details/async_log_helper.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/details/async_logger_impl.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/details/file_helper.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/details/log_msg.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/details/logger_impl.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/details/mpmc_bounded_q.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/details/null_mutex.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/details/os.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/details/pattern_formatter_impl.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/details/registry.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/details/spdlog_impl.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/fmt/bundled/format.cc",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/fmt/bundled/format.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/fmt/bundled/ostream.cc",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/fmt/bundled/ostream.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/fmt/bundled/printf.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/fmt/fmt.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/fmt/ostr.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/formatter.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/logger.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/sinks/android_sink.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/sinks/ansicolor_sink.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/sinks/base_sink.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/sinks/dist_sink.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/sinks/file_sinks.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/sinks/msvc_sink.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/sinks/null_sink.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/sinks/ostream_sink.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/sinks/sink.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/sinks/stdout_sinks.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/sinks/syslog_sink.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/spdlog.h",
+    "thirdparty/spdlog.dep/spdlog-0.11.0/include/spdlog/tweakme.h",
+]
+
+SSL_LIBS = [
+    "thirdparty_build/boringssl.dep/lib/libssl.a",
+]
+
+TCLAP_HDRS = [
+    "thirdparty/tclap.dep/tclap-1.2.1/include/Makefile.am",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/Makefile.in",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/Arg.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/ArgException.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/ArgTraits.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/CmdLine.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/CmdLineInterface.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/CmdLineOutput.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/Constraint.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/DocBookOutput.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/HelpVisitor.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/IgnoreRestVisitor.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/Makefile.am",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/Makefile.in",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/MultiArg.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/MultiSwitchArg.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/OptionalUnlabeledTracker.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/StandardTraits.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/StdOutput.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/SwitchArg.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/UnlabeledMultiArg.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/UnlabeledValueArg.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/ValueArg.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/ValuesConstraint.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/VersionVisitor.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/Visitor.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/XorHandler.h",
+    "thirdparty/tclap.dep/tclap-1.2.1/include/tclap/ZshCompletionOutput.h",
+]
+
+PROTOC_LIBS = [
+    "thirdparty_build/protobuf.dep/bin/protoc",
+]
+
+GENERATED_FILES = (ARES_HDRS +
+                   ARES_LIBS +
+                   CRYPTO_HDRS +
+                   CRYPTO_LIBS +
+                   EVENT_HDRS +
+                   EVENT_LIBS +
+                   EVENT_PTHREADS_LIBS +
+                   GOOGLETEST_HDRS +
+                   GOOGLETEST_LIBS +
+                   HTTP_PARSER_HDRS +
+                   HTTP_PARSER_LIBS +
+                   LIGHTSTEP_LIBS +
+                   LIGHTSTEP_INCLUDES_HDRS +
+                   NGHTTP2_HDRS +
+                   NGHTTP2_LIBS +
+                   PROTOBUF_HDRS +
+                   PROTOBUF_LIBS +
+                   RAPIDJSON_HDRS +
+                   SPDLOG_HDRS +
+                   SSL_LIBS +
+                   TCLAP_HDRS +
+                   PROTOC_LIBS)
+
+def envoy_prebuilt_targets(prebuilts_genrule=False):
+    if prebuilts_genrule:
+        native.genrule(
+            name = "prebuilts",
+            srcs = [
+                "//ci/build_container:build_and_install_deps.sh",
+                "//ci/build_container:prebuilt_build_inputs",
+            ],
+            outs = GENERATED_FILES,
+            cmd = "export GENDIR=$$(realpath $(@D)); BUILD_DISTINCT=1 TMPDIR=$$GENDIR " +
+                  "THIRDPARTY_DEPS=$$GENDIR THIRDPARTY_SRC=$$GENDIR/thirdparty " +
+                  "THIRDPARTY_BUILD=$$GENDIR/thirdparty_build $(location " +
+                  "//ci/build_container:build_and_install_deps.sh)",
+            message = "Building Envoy dependencies",
+        )
+
+    native.cc_library(
+        name = "ares",
+        srcs = ARES_LIBS,
+        hdrs = ARES_HDRS,
+        includes = [
+            "thirdparty_build/cares.dep/include",
+        ],
+    )
+
+    native.cc_library(
+        name = "crypto",
+        srcs = CRYPTO_LIBS,
+        hdrs = CRYPTO_HDRS,
+        includes = [
+            "thirdparty_build/boringssl.dep/include",
+        ],
+    )
+
+    native.cc_library(
+        name = "event",
+        srcs = EVENT_LIBS,
+        hdrs = EVENT_HDRS,
+        includes = [
+            "thirdparty_build/libevent.dep/include",
+        ],
+    )
+
+    native.cc_library(
+        name = "event_pthreads",
+        srcs = EVENT_PTHREADS_LIBS,
+        deps = [
+            "event",
+        ],
+    )
+
+    native.cc_library(
+        name = "googletest",
+        srcs = GOOGLETEST_LIBS,
+        hdrs = GOOGLETEST_HDRS,
+        includes = [
+            "thirdparty_build/googletest.dep/include",
+        ],
+    )
+
+    native.cc_library(
+        name = "http_parser",
+        srcs = HTTP_PARSER_LIBS,
+        hdrs = HTTP_PARSER_HDRS,
+        includes = [
+            "thirdparty_build/http-parser.dep/include",
+        ],
+    )
+
+    native.cc_library(
+        name = "lightstep",
+        srcs = LIGHTSTEP_LIBS,
+        deps = [
+            "lightstep_includes",
+            "protobuf",
+        ],
+    )
+
+    native.cc_library(
+        name = "lightstep_includes",
+        hdrs = LIGHTSTEP_INCLUDES_HDRS,
+        includes = [
+            "thirdparty_build/lightstep.dep/include",
+        ],
+    )
+
+    native.cc_library(
+        name = "nghttp2",
+        srcs = NGHTTP2_LIBS,
+        hdrs = NGHTTP2_HDRS,
+        includes = [
+            "thirdparty_build/nghttp2.dep/include",
+        ],
+    )
+
+    native.cc_library(
+        name = "protobuf",
+        srcs = PROTOBUF_LIBS,
+        hdrs = PROTOBUF_HDRS,
+        includes = [
+            "thirdparty_build/protobuf.dep/include",
+        ],
+    )
+
+    native.cc_library(
+        name = "rapidjson",
+        hdrs = RAPIDJSON_HDRS,
+        includes = [
+            "thirdparty/rapidjson.dep/rapidjson-1.1.0/include",
+        ],
+    )
+
+    native.cc_library(
+        name = "spdlog",
+        hdrs = SPDLOG_HDRS,
+        includes = [
+            "thirdparty/spdlog.dep/spdlog-0.11.0/include",
+        ],
+    )
+
+    native.cc_library(
+        name = "ssl",
+        srcs = SSL_LIBS,
+        deps = [
+            "crypto",
+        ],
+    )
+
+    native.cc_library(
+        name = "tclap",
+        hdrs = TCLAP_HDRS,
+        includes = [
+            "thirdparty/tclap.dep/tclap-1.2.1/include",
+        ],
+    )
+
+    native.filegroup(
+        name = "protoc",
+        srcs = PROTOC_LIBS,
+    )
+
+def envoy_prebuilt_workspace_targets(path):
+    native.bind(
+        name = "ares",
+        actual = path + ":ares",
+    )
+
+    native.bind(
+        name = "crypto",
+        actual = path + ":crypto",
+    )
+
+    native.bind(
+        name = "event",
+        actual = path + ":event",
+    )
+
+    native.bind(
+        name = "event_pthreads",
+        actual = path + ":event_pthreads",
+    )
+
+    native.bind(
+        name = "googletest",
+        actual = path + ":googletest",
+    )
+
+    native.bind(
+        name = "http_parser",
+        actual = path + ":http_parser",
+    )
+
+    native.bind(
+        name = "lightstep",
+        actual = path + ":lightstep",
+    )
+
+    native.bind(
+        name = "lightstep_includes",
+        actual = path + ":lightstep_includes",
+    )
+
+    native.bind(
+        name = "nghttp2",
+        actual = path + ":nghttp2",
+    )
+
+    native.bind(
+        name = "protobuf",
+        actual = path + ":protobuf",
+    )
+
+    native.bind(
+        name = "rapidjson",
+        actual = path + ":rapidjson",
+    )
+
+    native.bind(
+        name = "spdlog",
+        actual = path + ":spdlog",
+    )
+
+    native.bind(
+        name = "ssl",
+        actual = path + ":ssl",
+    )
+
+    native.bind(
+        name = "tclap",
+        actual = path + ":tclap",
+    )
+
+    native.bind(
+        name = "protoc",
+        actual = path + ":protoc",
+    )
+
+    # Used only for protobuf.bzl
+    native.git_repository(
+        name = "protobuf_bzl",
+        # Using a non-canonical repository/branch here. This is a workaround to the lack of
+        # merge on https://github.com/google/protobuf/pull/2508, which is needed for supporting
+        # arbitrary CC compiler locations from the environment. The branch is
+        # https://github.com/htuch/protobuf/tree/v3.2.0-default-shell-env, which is the 3.2.0
+        # release with the above mentioned PR cherry picked.
+        commit = "d490587268931da78c942a6372ef57bb53db80da",
+        remote = "https://github.com/htuch/protobuf.git",
+    )
diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
deleted file mode 100644
index 4219e2313e5b..000000000000
--- a/bazel/repositories.bzl
+++ /dev/null
@@ -1,532 +0,0 @@
-# The build rules below for external dependencies build rules are maintained on a best effort basis.
-# The rules are provided for developer convenience. For production builds, we recommend building the
-# libraries according to their canonical build systems and expressing the dependencies in a manner
-# similar to ci/WORKSPACE.
-
-def ares_repositories():
-    BUILD = """
-cc_library(
-    name = "ares",
-    srcs = [
-        "ares__close_sockets.c",
-        "ares__get_hostent.c",
-        "ares__read_line.c",
-        "ares__timeval.c",
-        "ares_cancel.c",
-        "ares_create_query.c",
-        "ares_data.c",
-        "ares_destroy.c",
-        "ares_expand_name.c",
-        "ares_expand_string.c",
-        "ares_fds.c",
-        "ares_free_hostent.c",
-        "ares_free_string.c",
-        "ares_getenv.c",
-        "ares_gethostbyaddr.c",
-        "ares_gethostbyname.c",
-        "ares_getnameinfo.c",
-        "ares_getopt.c",
-        "ares_getsock.c",
-        "ares_init.c",
-        "ares_library_init.c",
-        "ares_llist.c",
-        "ares_mkquery.c",
-        "ares_nowarn.c",
-        "ares_options.c",
-        "ares_parse_a_reply.c",
-        "ares_parse_aaaa_reply.c",
-        "ares_parse_mx_reply.c",
-        "ares_parse_naptr_reply.c",
-        "ares_parse_ns_reply.c",
-        "ares_parse_ptr_reply.c",
-        "ares_parse_soa_reply.c",
-        "ares_parse_srv_reply.c",
-        "ares_parse_txt_reply.c",
-        "ares_platform.c",
-        "ares_process.c",
-        "ares_query.c",
-        "ares_search.c",
-        "ares_send.c",
-        "ares_strcasecmp.c",
-        "ares_strdup.c",
-        "ares_strerror.c",
-        "ares_timeout.c",
-        "ares_version.c",
-        "ares_writev.c",
-        "bitncmp.c",
-        "inet_net_pton.c",
-        "inet_ntop.c",
-        "windows_port.c",
-    ],
-    hdrs = [
-        "ares.h",
-        "ares_build.h",
-        "ares_config.h",
-        "ares_data.h",
-        "ares_dns.h",
-        "ares_getenv.h",
-        "ares_getopt.h",
-        "ares_inet_net_pton.h",
-        "ares_iphlpapi.h",
-        "ares_ipv6.h",
-        "ares_library_init.h",
-        "ares_llist.h",
-        "ares_nowarn.h",
-        "ares_platform.h",
-        "ares_private.h",
-        "ares_rules.h",
-        "ares_setup.h",
-        "ares_strcasecmp.h",
-        "ares_strdup.h",
-        "ares_version.h",
-        "ares_writev.h",
-        "bitncmp.h",
-        "nameser.h",
-        "setup_once.h",
-    ],
-    copts = [
-        "-DHAVE_CONFIG_H",
-    ],
-    includes = ["."],
-    visibility = ["//visibility:public"],
-)
-
-# There is some moderate evil here. buildconf needs to be invoked in its source
-# location, where it also generates temp files (no option to place in TMPDIR).
-# Also, configure does a cd relative dance that doesn't play nice with the
-# symlink execroot in the Bazel build. So, copy everything prior to building.
-ARES_CONFIG_SH_CMDS = [
-    "export TMPDIR=$$(realpath $(@D))",
-    "rm -rf $(@D)/cares_build",
-    "mkdir -p $(@D)/cares_build",
-    "cp --parents -L $(SRCS) $(@D)/cares_build",
-    "pushd $(@D)/cares_build/external/cares_git",
-    "./buildconf",
-    "./configure",
-    "popd",
-    "cp $(@D)/cares_build/external/cares_git/ares_config.h $@",
-]
-
-genrule(
-    name = "config",
-    srcs = glob(["**/*"]),
-    outs = ["ares_config.h"],
-    cmd = "&& ".join(ARES_CONFIG_SH_CMDS),
-)
-
-genrule(
-    name = "ares_build",
-    srcs = ["ares_build.h.dist"],
-    outs = ["ares_build.h"],
-    cmd = "cp $(SRCS) $@",
-)
-"""
-
-    native.new_git_repository(
-        name = "cares_git",
-        remote = "https://github.com/c-ares/c-ares.git",
-        commit = "7691f773af79bf75a62d1863fd0f13ebf9dc51b1", # v1.12.0
-        build_file_content = BUILD,
-    )
-
-def boringssl_repositories():
-    native.git_repository(
-        name = "boringssl",
-        commit = "bfd36df3da38dbf8828e712f42fbab2a0034bc40",  # 2017-02-02
-        remote = "https://boringssl.googlesource.com/boringssl",
-    )
-
-def googletest_repositories():
-    BUILD = """
-cc_library(
-    name = "googletest",
-    srcs = [
-        "googlemock/src/gmock-all.cc",
-        "googletest/src/gtest-all.cc",
-    ],
-    hdrs = glob([
-        "googlemock/include/**/*.h",
-        "googlemock/src/*.cc",
-        "googletest/include/**/*.h",
-        "googletest/src/*.cc",
-        "googletest/src/*.h",
-    ]),
-    includes = [
-        "googlemock",
-        "googlemock/include",
-        "googletest",
-        "googletest/include",
-    ],
-    visibility = ["//visibility:public"],
-)
-"""
-    native.new_git_repository(
-        name = "googletest_git",
-        build_file_content = BUILD,
-        # v1.8.0 release
-        commit = "ec44c6c1675c25b9827aacd08c02433cccde7780",
-        remote = "https://github.com/google/googletest.git",
-    )
-
-def http_parser_repositories():
-    BUILD = """
-cc_library(
-    name = "http_parser",
-    srcs = [
-        "http_parser.c",
-    ],
-    hdrs = [
-        "http_parser.h",
-    ],
-    visibility = ["//visibility:public"],
-)
-"""
-
-    native.new_git_repository(
-        name = "http_parser_git",
-        remote = "https://github.com/nodejs/http-parser.git",
-        commit = "9b0d5b33ebdaacff1dadd06bad4e198b11ff880e",
-        build_file_content = BUILD,
-    )
-
-def libevent_repositories():
-    BUILD = """
-genrule(
-    name = "config",
-    srcs = glob(["**/*"]),
-    outs = ["config.h"],
-    cmd = "TMPDIR=$(@D) $(location configure) --enable-shared=no --disable-libevent-regress " +
-          "--disable-openssl && cp config.h $@",
-    tools = ["configure"],
-)
-
-genrule(
-    name = "event-config",
-    srcs = [
-        "config.h",
-        "make-event-config.sed",
-    ],
-    outs = ["include/event2/event-config.h"],
-    cmd = "sed -f $(location make-event-config.sed) < $(location config.h) > $@",
-)
-
-event_srcs = [
-    "buffer.c",
-    "bufferevent.c",
-    "bufferevent_filter.c",
-    "bufferevent_pair.c",
-    "bufferevent_ratelim.c",
-    "bufferevent_sock.c",
-    "epoll.c",
-    "evdns.c",
-    "event.c",
-    "event_tagging.c",
-    "evmap.c",
-    "evrpc.c",
-    "evthread.c",
-    "evutil.c",
-    "evutil_rand.c",
-    "evutil_time.c",
-    "http.c",
-    "listener.c",
-    "log.c",
-    "poll.c",
-    "select.c",
-    "signal.c",
-    "strlcpy.c",
-    ":event-config",
-] + glob(["*.h"])
-
-event_pthread_srcs = [
-    "evthread_pthread.c",
-    ":event-config",
-]
-
-cc_library(
-    name = "event",
-    srcs = event_srcs,
-    hdrs = glob(["include/**/*.h"]) + [
-        "arc4random.c",  # arc4random.c is included by evutil_rand.c
-        "bufferevent-internal.h",
-        "defer-internal.h",
-        "evbuffer-internal.h",
-        "event-internal.h",
-        "evthread-internal.h",
-        "http-internal.h",
-        "iocp-internal.h",
-        "ipv6-internal.h",
-        "log-internal.h",
-        "minheap-internal.h",
-        "mm-internal.h",
-        "strlcpy-internal.h",
-        "util-internal.h",
-        "compat/sys/queue.h",
-    ],
-    copts = [
-        "-w",
-        "-DHAVE_CONFIG_H",
-    ],
-    includes = [
-        "compat",
-        "include",
-    ],
-    visibility = ["//visibility:public"],
-)
-
-cc_library(
-    name = "event_pthreads",
-    srcs = event_pthread_srcs + ["include/event2/thread.h"],
-    hdrs = [
-        "compat/sys/queue.h",
-        "evthread-internal.h",
-    ],
-    copts = [
-        "-w",
-        "-DHAVE_CONFIG_H",
-    ],
-    includes = [
-        "compat",
-        "include",
-    ],
-    visibility = ["//visibility:public"],
-    deps = [":event"],
-)"""
-
-    native.new_http_archive(
-        name = "libevent_git",
-        url = "https://github.com/libevent/libevent/releases/download/release-2.1.8-stable/libevent-2.1.8-stable.tar.gz",
-        strip_prefix = "libevent-2.1.8-stable",
-        build_file_content = BUILD,
-    )
-
-def lightstep_repositories():
-    BUILD = """
-load("@protobuf_git//:protobuf.bzl", "cc_proto_library")
-
-cc_library(
-    name = "lightstep_core",
-    srcs = [
-        "src/c++11/impl.cc",
-        "src/c++11/span.cc",
-        "src/c++11/tracer.cc",
-        "src/c++11/util.cc",
-    ],
-    hdrs = [
-        "src/c++11/lightstep/impl.h",
-        "src/c++11/lightstep/options.h",
-        "src/c++11/lightstep/propagation.h",
-        "src/c++11/lightstep/carrier.h",
-        "src/c++11/lightstep/span.h",
-        "src/c++11/lightstep/tracer.h",
-        "src/c++11/lightstep/util.h",
-        "src/c++11/lightstep/value.h",
-        "src/c++11/mapbox_variant/recursive_wrapper.hpp",
-        "src/c++11/mapbox_variant/variant.hpp",
-    ],
-    copts = [
-        "-DPACKAGE_VERSION='\\"0.36\\"'",
-        "-Iexternal/lightstep_git/src/c++11/lightstep",
-        "-Iexternal/lightstep_git/src/c++11/mapbox_variant",
-    ],
-    includes = ["src/c++11"],
-    visibility = ["//visibility:public"],
-    deps = [
-        "@lightstep_common_git//:collector_proto",
-        "@lightstep_common_git//:lightstep_carrier_proto",
-        "//external:protobuf",
-    ],
-)"""
-
-    COMMON_BUILD = """
-load("@protobuf_git//:protobuf.bzl", "cc_proto_library")
-
-cc_proto_library(
-    name = "collector_proto",
-    srcs = ["collector.proto"],
-    include = ".",
-    deps = [
-        "//external:cc_wkt_protos",
-    ],
-    protoc = "//external:protoc",
-    default_runtime = "//external:protobuf",
-    visibility = ["//visibility:public"],
-)
-
-cc_proto_library(
-    name = "lightstep_carrier_proto",
-    srcs = ["lightstep_carrier.proto"],
-    include = ".",
-    deps = [
-        "//external:cc_wkt_protos",
-    ],
-    protoc = "//external:protoc",
-    default_runtime = "//external:protobuf",
-    visibility = ["//visibility:public"],
-)
-"""
-
-    native.new_git_repository(
-        name = "lightstep_common_git",
-        remote = "https://github.com/lightstep/lightstep-tracer-common.git",
-        commit = "cbbecd671c1ae1f20ae873c5da688c8c14d04ec3",
-        build_file_content = COMMON_BUILD,
-    )
-
-    native.new_git_repository(
-        name = "lightstep_git",
-        remote = "https://github.com/lightstep/lightstep-tracer-cpp.git",
-        commit = "f1dc8f3dfd529350e053fd21273e627f409ae428", # 0.36
-        build_file_content = BUILD,
-    )
-
-def nghttp2_repositories():
-    BUILD = """
-genrule(
-    name = "config",
-    srcs = glob(["**/*"]),
-    outs = ["config.h"],
-    cmd = "TMPDIR=$(@D) $(location configure) --enable-lib-only --enable-shared=no" +
-          " && cp config.h $@",
-    tools = ["configure"],
-)
-
-cc_library(
-    name = "nghttp2",
-    srcs = glob([
-        "lib/*.c",
-        "lib/*.h",
-    ]) + ["config.h"],
-    hdrs = glob(["lib/includes/nghttp2/*.h"]),
-    copts = [
-        "-DHAVE_CONFIG_H",
-        "-DBUILDING_NGHTTP2",
-    ],
-    includes = [
-        ".",
-        "lib/includes",
-    ],
-    visibility = ["//visibility:public"],
-)
-"""
-
-    native.new_http_archive(
-        name = "nghttp2_tar",
-        url = "https://github.com/nghttp2/nghttp2/releases/download/v1.20.0/nghttp2-1.20.0.tar.gz",
-        strip_prefix = "nghttp2-1.20.0",
-        build_file_content = BUILD,
-    )
-
-def protobuf_repositories():
-    native.git_repository(
-        name = "protobuf_git",
-        # Using a non-canonical repository/branch here. This is a workaround to the lack of
-        # merge on https://github.com/google/protobuf/pull/2508, which is needed for supporting
-        # arbitrary CC compiler locations from the environment. The branch is
-        # https://github.com/htuch/protobuf/tree/v3.2.0-default-shell-env, which is the 3.2.0
-        # release with the above mentioned PR cherry picked.
-        commit = "d490587268931da78c942a6372ef57bb53db80da",
-        remote = "https://github.com/htuch/protobuf.git",
-    )
-
-def rapidjson_repositories():
-    BUILD = """
-cc_library(
-    name = "rapidjson",
-    srcs = glob([
-        "include/rapidjson/internal/*.h",
-    ]),
-    hdrs = glob([
-        "include/rapidjson/*.h",
-        "include/rapidjson/error/*.h",
-    ]),
-    includes = ["include"],
-    visibility = ["//visibility:public"],
-)
-"""
-
-    native.new_git_repository(
-        name = "rapidjson_git",
-        remote = "https://github.com/miloyip/rapidjson.git",
-        commit = "f54b0e47a08782a6131cc3d60f94d038fa6e0a51", # v1.1.0
-        build_file_content = BUILD,
-    )
-
-def spdlog_repositories():
-    BUILD = """
-package(default_visibility = ["//visibility:public"])
-
-cc_library(
-    name = "spdlog",
-    hdrs = glob([
-        "include/**/*.cc",
-        "include/**/*.h",
-    ]),
-    strip_include_prefix = "include",
-)
-"""
-
-    native.new_git_repository(
-        name = "spdlog_git",
-        build_file_content = BUILD,
-        # v0.11.0 release
-        commit = "1f1f6a5f3b424203a429e9cb78e6548037adefa8",
-        remote = "https://github.com/gabime/spdlog.git",
-    )
-
-def tclap_repositories():
-    BUILD = """
-cc_library(
-    name = "tclap",
-    hdrs = [
-        "include/tclap/Arg.h",
-        "include/tclap/ArgException.h",
-        "include/tclap/ArgTraits.h",
-        "include/tclap/CmdLine.h",
-        "include/tclap/CmdLineInterface.h",
-        "include/tclap/CmdLineOutput.h",
-        "include/tclap/Constraint.h",
-        "include/tclap/DocBookOutput.h",
-        "include/tclap/HelpVisitor.h",
-        "include/tclap/IgnoreRestVisitor.h",
-        "include/tclap/MultiArg.h",
-        "include/tclap/MultiSwitchArg.h",
-        "include/tclap/OptionalUnlabeledTracker.h",
-        "include/tclap/StandardTraits.h",
-        "include/tclap/StdOutput.h",
-        "include/tclap/SwitchArg.h",
-        "include/tclap/UnlabeledMultiArg.h",
-        "include/tclap/UnlabeledValueArg.h",
-        "include/tclap/ValueArg.h",
-        "include/tclap/ValuesConstraint.h",
-        "include/tclap/VersionVisitor.h",
-        "include/tclap/Visitor.h",
-        "include/tclap/XorHandler.h",
-        "include/tclap/ZshCompletionOutput.h",
-    ],
-    defines = [
-        "HAVE_LONG_LONG=1",
-        "HAVE_SSTREAM=1",
-    ],
-    includes = ["include"],
-    visibility = ["//visibility:public"],
-)
-"""
-    native.new_http_archive(
-        name = "tclap_archive",
-        url = "https://storage.googleapis.com/istio-build-deps/tclap-1.2.1.tar.gz",
-        strip_prefix = "tclap-1.2.1",
-        build_file_content = BUILD,
-    )
-
-def envoy_dependencies():
-    ares_repositories()
-    boringssl_repositories()
-    googletest_repositories()
-    http_parser_repositories()
-    libevent_repositories()
-    lightstep_repositories()
-    nghttp2_repositories()
-    protobuf_repositories()
-    rapidjson_repositories()
-    spdlog_repositories()
-    tclap_repositories()
diff --git a/ci/WORKSPACE b/ci/WORKSPACE
index ad08a17d3a3e..7c8a262ee3f7 100644
--- a/ci/WORKSPACE
+++ b/ci/WORKSPACE
@@ -1,69 +1,5 @@
-bind(
-    name = "ares",
-    actual = "//ci/prebuilt:ares",
-)
+workspace(name = "envoy")
 
-bind(
-    name = "event",
-    actual = "//ci/prebuilt:event",
-)
+load("//bazel:prebuilt.bzl", "envoy_prebuilt_workspace_targets")
 
-bind(
-    name = "event_pthreads",
-    actual = "//ci/prebuilt:event_pthreads",
-)
-
-bind(
-    name = "googletest",
-    actual = "//ci/prebuilt:googletest",
-)
-
-bind(
-    name = "http_parser",
-    actual = "//ci/prebuilt:http_parser",
-)
-
-bind(
-    name = "lightstep",
-    actual = "//ci/prebuilt:lightstep",
-)
-
-bind(
-    name = "nghttp2",
-    actual = "//ci/prebuilt:nghttp2",
-)
-
-bind(
-    name = "protobuf",
-    actual = "//ci/prebuilt:protobuf",
-)
-
-local_repository(
-    name = "protobuf_git",
-    path = "/thirdparty/protobuf-3.2.0",
-)
-
-bind(
-    name = "protoc",
-    actual = "//ci/prebuilt:protoc",
-)
-
-bind(
-    name = "rapidjson",
-    actual = "//ci/prebuilt:rapidjson",
-)
-
-bind(
-    name = "spdlog",
-    actual = "//ci/prebuilt:spdlog",
-)
-
-bind(
-    name = "ssl",
-    actual = "//ci/prebuilt:ssl",
-)
-
-bind(
-    name = "tclap",
-    actual = "//ci/prebuilt:tclap",
-)
+envoy_prebuilt_workspace_targets("//ci/prebuilt")
diff --git a/ci/build_container/BUILD b/ci/build_container/BUILD
new file mode 100644
index 000000000000..7218ec222651
--- /dev/null
+++ b/ci/build_container/BUILD
@@ -0,0 +1,9 @@
+package(default_visibility = ["//visibility:public"])
+
+exports_files(["build_and_install_deps.sh"])
+
+filegroup(
+    name = "prebuilt_build_inputs",
+    # FIXME: fill in others
+    srcs = ["Makefile"] + glob(["build_recipes/*.sh"]),
+)
diff --git a/ci/prebuilt/BUILD b/ci/prebuilt/BUILD
index 52a61c12877d..844f4800d745 100644
--- a/ci/prebuilt/BUILD
+++ b/ci/prebuilt/BUILD
@@ -1,108 +1,5 @@
 package(default_visibility = ["//visibility:public"])
 
-cc_library(
-    name = "ares",
-    srcs = ["thirdparty_build/lib/libcares.a"],
-    hdrs = glob(["thirdparty_build/include/ares*.h"]),
-    strip_include_prefix = "thirdparty_build/include",
-)
+load("//bazel:prebuilt.bzl", "envoy_prebuilt_targets")
 
-cc_library(
-    name = "crypto",
-    srcs = ["thirdparty_build/lib/libcrypto.a"],
-    hdrs = glob(["thirdparty_build/include/openssl/**/*.h"]),
-    strip_include_prefix = "thirdparty_build/include",
-)
-
-cc_library(
-    name = "event",
-    srcs = ["thirdparty_build/lib/libevent.a"],
-    hdrs = glob(["thirdparty_build/include/event2/**/*.h"]),
-    strip_include_prefix = "thirdparty_build/include",
-)
-
-cc_library(
-    name = "event_pthreads",
-    srcs = ["thirdparty_build/lib/libevent_pthreads.a"],
-    deps = [":event"],
-)
-
-cc_library(
-    name = "googletest",
-    srcs = [
-        "thirdparty_build/lib/libgmock.a",
-        "thirdparty_build/lib/libgtest.a",
-    ],
-    hdrs = glob([
-        "thirdparty_build/include/gmock/**/*.h",
-        "thirdparty_build/include/gtest/**/*.h",
-    ]),
-    strip_include_prefix = "thirdparty_build/include",
-)
-
-cc_library(
-    name = "http_parser",
-    srcs = ["thirdparty_build/lib/libhttp_parser.a"],
-    hdrs = glob(["thirdparty_build/include/http_parser.h"]),
-    strip_include_prefix = "thirdparty_build/include",
-)
-
-cc_library(
-    name = "lightstep",
-    srcs = ["thirdparty_build/lib/liblightstep_core_cxx11.a"],
-    hdrs = glob([
-        "thirdparty_build/include/lightstep/**/*.h",
-        "thirdparty_build/include/mapbox_variant/**/*.hpp",
-    ]) + [
-        "thirdparty_build/include/collector.pb.h",
-        "thirdparty_build/include/lightstep_carrier.pb.h",
-    ],
-    strip_include_prefix = "thirdparty_build/include",
-    deps = [":protobuf"],
-)
-
-cc_library(
-    name = "nghttp2",
-    srcs = ["thirdparty_build/lib/libnghttp2.a"],
-    hdrs = glob(["thirdparty_build/include/nghttp2/**/*.h"]),
-    strip_include_prefix = "thirdparty_build/include",
-)
-
-cc_library(
-    name = "protobuf",
-    srcs = glob(["thirdparty_build/lib/libproto*.a"]),
-    hdrs = glob(["thirdparty_build/include/google/protobuf/**/*.h"]),
-    strip_include_prefix = "thirdparty_build/include",
-)
-
-filegroup(
-    name = "protoc",
-    srcs = ["thirdparty_build/bin/protoc"],
-)
-
-cc_library(
-    name = "rapidjson",
-    hdrs = glob(["thirdparty/rapidjson-1.1.0/include/**/*.h"]),
-    strip_include_prefix = "thirdparty/rapidjson-1.1.0/include",
-)
-
-cc_library(
-    name = "spdlog",
-    hdrs = glob([
-        "thirdparty/spdlog-0.11.0/include/**/*.cc",
-        "thirdparty/spdlog-0.11.0/include/**/*.h",
-    ]),
-    strip_include_prefix = "thirdparty/spdlog-0.11.0/include",
-)
-
-cc_library(
-    name = "ssl",
-    srcs = ["thirdparty_build/lib/libssl.a"],
-    deps = [":crypto"],
-)
-
-cc_library(
-    name = "tclap",
-    hdrs = glob(["thirdparty/tclap-1.2.1/include/**/*.h"]),
-    strip_include_prefix = "thirdparty/tclap-1.2.1/include",
-)
+envoy_prebuilt_targets(prebuilts_genrule = False)
diff --git a/tools/bazel.rc b/tools/bazel.rc
index b82582678dca..d701fec7d77f 100644
--- a/tools/bazel.rc
+++ b/tools/bazel.rc
@@ -3,3 +3,8 @@
 build:asan --copt -fsanitize=address
 build:asan --linkopt -fsanitize=address
 build:asan --linkopt -ldl
+
+build --distinct_host_configuration=false
+build --action_env=CC
+build --action_env=CXX
+build --action_env=LD_LIBRARY_PATH
diff --git a/tools/setup_external_deps.sh b/tools/setup_external_deps.sh
new file mode 100755
index 000000000000..d5b9d855f7cc
--- /dev/null
+++ b/tools/setup_external_deps.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -e
+
+[ -z "${ENVOY_SRC_DIR}" ] && { echo "ENVOY_SRC_DIR not set"; exit 1; }
+
+PREBUILT_DIR="${ENVOY_SRC_DIR}"/build/prebuilt
+mkdir -p "${PREBUILT_DIR}"
+PREBUILT_DIR_REAL=$(realpath "${PREBUILT_DIR}")
+
+export THIRDPARTY_DEPS="${PREBUILT_DIR_REAL}"
+export THIRDPARTY_SRC="${PREBUILT_DIR_REAL}/thirdparty"
+export THIRDPARTY_BUILD="${PREBUILT_DIR_REAL}/thirdparty_build"
+export BUILD_DISTINCT=1
+
+"${ENVOY_SRC_DIR}"/ci/build_container/build_and_install_deps.sh "${PREBUILT_DIR_REAL}"