diff --git a/WORKSPACE b/WORKSPACE
index fce12066e8..0405f03316 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -12,16 +12,25 @@ git_repository(
 
 git_repository(
     name = "io_bazel",
-    commit = "1fe52dd4b2d77a740648bc1509b68acae49deffc",
+    commit = "b571b72961b9244059bdf96818948623cebf342e",
     remote = "https://github.com/ixdy/bazel.git",
 )
 
+git_repository(
+    name = "io_bazel_rules_docker",
+    commit = "52d9faf209ff6d16eb850b6b66d03483735e0633",
+    remote = "https://github.com/bazelbuild/rules_docker.git",
+)
+
 load("@io_bazel_rules_go//go:def.bzl", "go_repositories")
+load("@io_bazel_rules_docker//docker:docker.bzl", "docker_repositories")
 
 go_repositories(
     go_version = "1.8.1",
 )
 
+docker_repositories()
+
 # for building docker base images
 debs = (
     (
diff --git a/build/BUILD b/build/BUILD
index 82760f615a..b3317ebe95 100644
--- a/build/BUILD
+++ b/build/BUILD
@@ -1,6 +1,6 @@
 package(default_visibility = ["//visibility:public"])
 
-load("@io_bazel//tools/build_defs/docker:docker.bzl", "docker_build")
+load("@io_bazel_rules_docker//docker:docker.bzl", "docker_build", "docker_bundle")
 load("@io_kubernetes_build//defs:build.bzl", "release_filegroup")
 
 filegroup(
@@ -69,6 +69,26 @@ DOCKERIZED_BINARIES = {
     },
 }
 
+[docker_build(
+    name = binary + "-internal",
+    base = meta["base"],
+    cmd = ["/usr/bin/" + binary],
+    debs = [
+        "//build/debs:%s.deb" % binary,
+    ],
+    symlinks = {
+        # Some cluster startup scripts expect to find the binaries in /usr/local/bin,
+        # but the debs install the binaries into /usr/bin.
+        "/usr/local/bin/" + binary: "/usr/bin/" + binary,
+    },
+) for binary, meta in DOCKERIZED_BINARIES.items()]
+
+[docker_bundle(
+    name = binary,
+    images = {"gcr.io/google_containers/%s:{STABLE_DOCKER_TAG}" % binary: binary + "-internal"},
+    stamp = True,
+) for binary in DOCKERIZED_BINARIES.keys()]
+
 [genrule(
     name = binary + "_docker_tag",
     srcs = [meta["target"]],
@@ -77,25 +97,6 @@ DOCKERIZED_BINARIES = {
     stamp = 1,
 ) for binary, meta in DOCKERIZED_BINARIES.items()]
 
-[docker_build(
-    name = binary,
-    base = meta["base"],
-    cmd = ["/usr/bin/" + binary],
-    debs = [
-        "//build/debs:%s.deb" % binary,
-    ],
-    image_tags = [
-        "@%s.docker_tag" % binary,
-    ],
-    repository = "gcr.io/google_containers/" + binary,
-    repository_append_package = False,
-    symlinks = {
-        # Some cluster startup scripts expect to find the binaries in /usr/local/bin,
-        # but the debs install the binaries into /usr/bin.
-        "/usr/local/bin/" + binary: "/usr/bin/" + binary,
-    },
-) for binary, meta in DOCKERIZED_BINARIES.items()]
-
 release_filegroup(
     name = "docker-artifacts",
     srcs = [":%s.tar" % binary for binary in DOCKERIZED_BINARIES.keys()] +