diff --git a/dev-infra/bazel/BUILD.bazel b/dev-infra/bazel/BUILD.bazel
index 76e236b1df..6bb4f3a008 100644
--- a/dev-infra/bazel/BUILD.bazel
+++ b/dev-infra/bazel/BUILD.bazel
@@ -5,5 +5,6 @@ filegroup(
     srcs = [
         "BUILD.bazel",
         "expand_template.bzl",
+        "//dev-infra/bazel/remote-execution:files",
     ],
 )
diff --git a/dev-infra/bazel/remote-execution/BUILD.bazel b/dev-infra/bazel/remote-execution/BUILD.bazel
new file mode 100644
index 0000000000..e68015a1bf
--- /dev/null
+++ b/dev-infra/bazel/remote-execution/BUILD.bazel
@@ -0,0 +1,38 @@
+package(default_visibility = ["//visibility:public"])
+
+platform(
+    name = "platform",
+    constraint_values = [
+        "@bazel_tools//platforms:linux",
+        "@bazel_tools//platforms:x86_64",
+        "@bazel_tools//tools/cpp:clang",
+    ],
+    # We use a basic docker image from the Google Cloud container registry that supports
+    # browser tests. Note that we usually do not use any of the local browsers, but the image
+    # guarantees that necessary dependencies for launching browsers are installed. Since we
+    # do not rely on many binaries/tools from the image, the image doesn't need to be updated
+    # frequently. There are rare cases where it needs to be updated. e.g. for a more recent Bash
+    # version, or new system settings that are required for launching browsers. In order to do that,
+    # we need to either see if the `rbe-ubuntu16-04-webtest` image can be updated, or if we need to
+    # build and publish our own image to the Google cloud image registry. Additionally, we set th
+    # `SYS_ADMIN` capability so that browsers can be launched with sandbox mode enabled. Related
+    # information: https://developers.google.com/web/tools/puppeteer/troubleshooting#running_puppeteer_in_docker
+    remote_execution_properties = """
+        properties: {
+          name: "container-image"
+          value:"docker://gcr.io/cloud-marketplace/google/rbe-ubuntu16-04-webtest@sha256:886a12dc4726f5b991b46386292afa8d943b6703a5496c8a1e07cfde778d9044"
+        }
+        properties: {
+          name: "dockerAddCapabilities"
+          value: "SYS_ADMIN"
+        }
+        """,
+)
+
+filegroup(
+    name = "files",
+    srcs = [
+        "BUILD.bazel",
+        "//dev-infra/bazel/remote-execution/cpp:files",
+    ],
+)
diff --git a/dev-infra/bazel/remote-execution/cpp/BUILD.bazel b/dev-infra/bazel/remote-execution/cpp/BUILD.bazel
new file mode 100644
index 0000000000..83c3fda085
--- /dev/null
+++ b/dev-infra/bazel/remote-execution/cpp/BUILD.bazel
@@ -0,0 +1,57 @@
+load("@bazel_tools//tools/cpp:cc_toolchain_config.bzl", "cc_toolchain_config")
+
+package(default_visibility = ["//visibility:public"])
+
+filegroup(
+    name = "files",
+    srcs = ["BUILD.bazel"],
+)
+
+cc_toolchain_suite(
+    name = "cc_toolchain_suite",
+    toolchains = {
+        "k8": ":cc_compiler_k8",
+    },
+)
+
+toolchain(
+    name = "cc_toolchain",
+    exec_compatible_with = [
+        "@bazel_tools//platforms:linux",
+        "@bazel_tools//platforms:x86_64",
+        "@bazel_tools//tools/cpp:clang",
+    ],
+    target_compatible_with = [
+        "@bazel_tools//platforms:linux",
+        "@bazel_tools//platforms:x86_64",
+    ],
+    toolchain = ":cc_compiler_k8",
+    toolchain_type = "@bazel_tools//tools/cpp:toolchain_type",
+)
+
+# Basic CC toolchain for k8 remote containers. Based on the default k8
+# toolchain provided in Bazel (but unfortunately internal).
+# https://github.com/bazelbuild/bazel/blob/c951753097b45cfb9be512c02199aa891b9646b8/tools/cpp/BUILD.tools#L298-L311
+cc_toolchain(
+    name = "cc_compiler_k8",
+    all_files = ":empty",
+    ar_files = ":empty",
+    as_files = ":empty",
+    compiler_files = ":empty",
+    dwp_files = ":empty",
+    linker_files = ":empty",
+    objcopy_files = ":empty",
+    strip_files = ":empty",
+    supports_param_files = 1,
+    toolchain_config = ":k8_toolchain_config",
+    toolchain_identifier = "cc-k8-compiler",
+)
+
+cc_toolchain_config(
+    name = "k8_toolchain_config",
+    compiler = "compiler",
+    cpu = "local",
+)
+
+# Empty filegroup used for defining the CC toolchain.
+filegroup(name = "empty")