Migrate TCMalloc CI to use the new lightweight docker setup and latest gcc.

.bazelrc

@@ -45,15 +45,11 @@ build:asan-libfuzzer --@rules_fuzzing//fuzzing:cc_engine=@rules_fuzzing//fuzzing
 build:asan-libfuzzer --@rules_fuzzing//fuzzing:cc_engine_instrumentation=libfuzzer
 build:asan-libfuzzer --@rules_fuzzing//fuzzing:cc_engine_sanitizer=asan
 
-# TODO(b/530366451) Replace these with a proper toolchain setup
-build:libstdc++ --repo_env=BAZEL_CXXOPTS= --repo_env=BAZEL_LINKOPTS= --repo_env=CPLUS_INCLUDE_PATH=
-build:libstdc++ --action_env=BAZEL_CXXOPTS= --action_env=BAZEL_LINKOPTS= --action_env=CPLUS_INCLUDE_PATH=
-build:libstdc++ --host_action_env=BAZEL_CXXOPTS= --host_action_env=BAZEL_LINKOPTS= --host_action_env=CPLUS_INCLUDE_PATH=
-
-# TODO(b/530366451) This uses gcc 14, replace with a more recent version.
-build:gcc --config=libstdc++
-build:gcc --host_action_env=CC=/usr/local/bin/gcc --action_env=CC=/usr/bin/gcc
-build:gcc --host_action_env=CXX=/usr/local/bin/g++ --action_env=CXX=/usr/bin/g++
+# Configure our Docker toolchain setup.
+build --extra_toolchains=@docker_toolchain//:all
+build:libstdc++ --features=libstdc++
+build:gcc --platforms=//ci:linux_gcc
+build:clang --platforms=//ci:linux_clang
 
 # Remote build configuration for CI.
 build:remote-base --define=EXECUTOR=remote

.github/workflows/ci.yml

@@ -45,7 +45,7 @@ jobs:
     runs-on: ubuntu-24.04
     name: Linux ${{ matrix.toolchain }} ${{ matrix.compilation_mode }} ${{ matrix.exceptions }} Bazel
     container:
-      image: gcr.io/google.com/absl-177019/gloop-linux-latest@sha256:903f3d7733dd615bc1542b548fab4b649cf6e48118251a2c6527ce4e30543c6b
+      image: gcr.io/google.com/absl-177019/gloop-linux-toolchain-latest@sha256:a820c79d3f356a64db121a4ee16c4408df18f9d2c8bf6c6abfae21666ac003ba
       options: --cap-add=SYS_PTRACE
       credentials:
         # TODO(b/530366451) Switch to Workload Identity Federation to avoid the need for secrets and

MODULE.bazel

@@ -38,3 +38,9 @@ bazel_dep(
     version = "20260708.rc1",
     repo_name = "do_not_use_for_gloop_visibility_only",
 )
+
+bazel_dep(name = "docker_toolchain", version = "0.1", dev_dependency = True)
+local_path_override(
+    module_name = "docker_toolchain",
+    path = "ci/docker_toolchain",
+)

ci/BUILD

@@ -1,7 +1,4 @@
-package(
-    default_applicable_licenses = ["//tcmalloc:license"],
-    default_visibility = ["//visibility:private"],
-)
+package(default_visibility = ["//visibility:private"])
 
 platform(
     name = "rbe",
@@ -10,9 +7,27 @@ platform(
         "@platforms//cpu:x86_64",
     ],
     exec_properties = {
-        "container-image": "docker://gcr.io/google.com/absl-177019/gloop-linux-latest@sha256:903f3d7733dd615bc1542b548fab4b649cf6e48118251a2c6527ce4e30543c6b",
+        "container-image": "docker://gcr.io/google.com/absl-177019/gloop-linux-latest@sha256:e199623ad0b61b30d240e8bbddf473f65cb1a11da09462001d83b5066dbd9e98",
         "OSArch": "amd64",
         "dockerRunAsRoot": "true",
         "cache-silo-key": "n2-highmem-8-2026-07-07",
     },
 )
+
+platform(
+    name = "linux_gcc",
+    constraint_values = [
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+        "@bazel_tools//tools/cpp:gcc",
+    ],
+)
+
+platform(
+    name = "linux_clang",
+    constraint_values = [
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+        "@bazel_tools//tools/cpp:clang",
+    ],
+)

ci/docker_toolchain/BUILD

@@ -0,0 +1,21 @@
+# Copyright 2026 The TCMalloc Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Standalone fallback toolchain module when building outside the Docker container.
+# Inside the container, this module is overridden via /etc/bazel.bazelrc to point to an actual
+# toolchain.
+
+package(default_visibility = ["//visibility:public"])
+
+filegroup(name = "empty")

ci/docker_toolchain/MODULE.bazel

@@ -0,0 +1,19 @@
+# Copyright 2026 The TCMalloc Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module(
+    name = "docker_toolchain",
+    version = "0.1",
+)
+