From eb210b3db13243ac1acdb4c6a38b3207595a27c5 Mon Sep 17 00:00:00 2001
From: Tom Parker-Shemilt <tom@tracemachina.com>
Date: Mon, 11 May 2026 16:10:20 +0100
Subject: [PATCH 01/16] Test actual LRE in CI

---
 .github/workflows/lre.yaml                    | 258 ++++--------------
 .github/workflows/main.yaml                   |  66 -----
 MODULE.bazel                                  |  15 +-
 MODULE.bazel.lock                             |  14 +-
 deployment-examples/docker-compose/Dockerfile |   2 +-
 .../docker-compose/docker-compose-lre.yml     | 101 +++++++
 .../docker-compose/docker-compose.yml         |  18 +-
 .../docker-compose/local-storage-cas.json5    |  22 +-
 .../docker-compose/worker.json5               |   2 +-
 flake.nix                                     |   3 +
 local-remote-execution/MODULE.bazel           |   4 +-
 local-remote-execution/MODULE.bazel.lock      |  46 +++-
 .../src/running_actions_manager.rs            |   5 +-
 templates/bazel/MODULE.bazel                  |   2 +-
 toolchain-examples/MODULE.bazel               |   4 +-
 .../src/content/docs/docs/contribute/nix.mdx  |   2 +-
 16 files changed, 241 insertions(+), 323 deletions(-)
 create mode 100644 deployment-examples/docker-compose/docker-compose-lre.yml

diff --git a/.github/workflows/lre.yaml b/.github/workflows/lre.yaml
index 16bf40f66..27b043595 100644
--- a/.github/workflows/lre.yaml
+++ b/.github/workflows/lre.yaml
@@ -58,211 +58,53 @@ jobs:
         with:
           nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}
 
-#   remote:
-#     strategy:
-#       fail-fast: false
-#       matrix:
-#         os: [xlarge-ubuntu-24.04]
-#         toolchain: [lre-cc, lre-rs]
-#     name: Remote / ${{ matrix.toolchain }} / ${{ matrix.os }}
-#     runs-on: ${{ matrix.os }}
-#     timeout-minutes: 45
-#     steps:
-#       - name: Checkout
-#         uses: >- # v6.0.2
-#           actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
-
-#       - name: Prepare Worker
-#         uses: ./.github/actions/prepare-nix
-#         with:
-#           nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}
-
-#       - name: Start Kubernetes cluster
-#         run: >
-#           nix run .#native up
-
-#       - name: Start NativeLink operator
-#         env:
-#           REPO_URL: ${{ github.event.pull_request.head.repo.clone_url || format('https://github.com/{0}.git', github.repository) }}
-#           BRANCH: ${{ github.event.pull_request.head.ref || github.ref_name }}
-#           COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
-#           TOOLCHAIN: ${{ matrix.toolchain }}
-#         run: |
-#           nix develop --fallback --impure --command bash -c 'cat > kustomization.yaml << EOF
-#           apiVersion: kustomize.config.k8s.io/v1beta1
-#           kind: Kustomization
-#           resources:
-#           - kubernetes/resources/flux
-#           - kubernetes/resources/nativelink-core
-#           - kubernetes/resources/gateway-routes
-#           - kubernetes/workers/resources/worker-init
-#           - kubernetes/workers/resources/${TOOLCHAIN}
-#           patches:
-#           - patch: |-
-#               - op: replace
-#                 path: /spec/url
-#                 value: ${REPO_URL}
-#               - op: replace
-#                 path: /spec/ref/branch
-#                 value: ${BRANCH}
-#               - op: replace
-#                 path: /spec/ref/commit
-#                 value: ${COMMIT}
-#             target:
-#               kind: GitRepository
-#               name: nativelink-infra
-#           - patch: |-
-#               - op: replace
-#                 path: /spec/postBuild/substitute/PLACEHOLDER_FLAKE_OUTPUT
-#                 value: ./src_root#image
-#             target:
-#               kind: Kustomization
-#               name: nativelink-alert-core
-#           - patch: |-
-#               - op: replace
-#                 path: /spec/postBuild/substitute/PLACEHOLDER_FLAKE_OUTPUT
-#                 value: ./src_root#nativelink-worker-init
-#             target:
-#               kind: Kustomization
-#               name: nativelink-alert-worker-init
-#           - patch: |-
-#               - op: replace
-#                 path: /spec/postBuild/substitute/PLACEHOLDER_FLAKE_OUTPUT
-#                 value: ./src_root#nativelink-worker-${TOOLCHAIN}
-#             target:
-#               kind: Kustomization
-#               name: nativelink-alert-${TOOLCHAIN}
-#           EOF
-#           kubectl apply -k . &&
-#           rm kustomization.yaml'
-
-#       - name: Wait for Tekton resources
-#         run: >
-#           nix develop --impure --command
-#           bash -c "flux reconcile kustomization \
-#             --timeout=15m \
-#             nativelink-tekton-resources"
-
-#       - name: Wait for alerts
-#         env:
-#           TOOLCHAIN: ${{ matrix.toolchain }}
-#         run: >
-#           nix develop --impure --command
-#           bash -c "flux reconcile kustomization \
-#             --timeout=15m \
-#             nativelink-alert-core && \
-#           flux reconcile kustomization \
-#             --timeout=15m \
-#             nativelink-alert-worker-init && \
-#           flux reconcile kustomization \
-#             --timeout=15m \
-#             nativelink-alert-${TOOLCHAIN}"
-
-#       - name: Trigger pipelines
-#         env:
-#           REPO_URL: ${{ github.event.pull_request.head.repo.clone_url || format('https://github.com/{0}.git', github.repository) }}
-#           BRANCH: ${{ github.event.pull_request.head.ref || github.ref_name }}
-#         run: |
-#           nix develop --impure --command bash -c 'cat > nativelink-repo.yaml << EOF
-#           apiVersion: source.toolkit.fluxcd.io/v1
-#           kind: GitRepository
-#           metadata:
-#             name: nativelink
-#             namespace: default
-#           spec:
-#             interval: 2m
-#             url: ${REPO_URL}
-#             ref:
-#               branch: ${BRANCH}
-#           EOF
-#           kubectl apply -f nativelink-repo.yaml &&
-#           rm nativelink-repo.yaml'
-
-#       - name: Wait for Tekton pipelines
-#         run: >
-#           nix develop --impure --command bash << 'EOF'
-#             until pr=$(kubectl get pipelinerun -n ci -o name | \
-#                        grep rebuild-nativelink-run-); do
-#               echo "Waiting for pipeline to be created..."
-#               sleep 1
-#             done
-
-#             echo "Found pipelinerun: $pr"
-#             kubectl wait --for=create -n ci $pr
-
-#             echo "Waiting for pipelinerun to succeed..."
-#             kubectl wait \
-#               --for=condition=Succeeded \
-#               --timeout=45m \
-#               pipelinerun \
-#               -n ci \
-#               -l tekton.dev/pipeline=rebuild-nativelink
-#           EOF
-
-#       - name: Wait for NativeLink Kustomization
-#         run: >
-#           nix develop --impure --command
-#           bash -c "flux reconcile kustomization -n default \
-#             --timeout=15m \
-#             nativelink-core"
-
-#       - name: Debug Kustomizations
-#         run: >
-#           nix develop --impure --command
-#           bash -c "kubectl get kustomizations.kustomize.toolkit.fluxcd.io -A && kubectl events --all-namespaces && kubectl describe kustomizations.kustomize.toolkit.fluxcd.io -A"
-#         if: always()
-
-#       - name: Wait for Worker Kustomization
-#         env:
-#           TOOLCHAIN: ${{ matrix.toolchain }}
-#         run: >
-#           nix develop --impure --command
-#           bash -c "flux reconcile kustomization -n default \
-#             --timeout=15m \
-#             nativelink-${TOOLCHAIN}"
-
-#       - name: Debug Kustomizations
-#         run: >
-#           nix develop --impure --command
-#           bash -c "kubectl get kustomizations.kustomize.toolkit.fluxcd.io -A && kubectl events --all-namespaces && kubectl describe kustomizations.kustomize.toolkit.fluxcd.io -A"
-#         if: always()
-
-#       - name: Wait for NativeLink
-#         run: >
-#           nix develop --impure --command
-#           bash -c "kubectl rollout status deploy/nativelink"
-
-#       - name: Wait for worker
-#         env:
-#           TOOLCHAIN: ${{ matrix.toolchain }}
-#         run: >
-#           nix develop --impure --command
-#           bash -c "kubectl rollout status deploy/nativelink-worker-${TOOLCHAIN}"
-
-#       - name: Get gateway IPs
-#         id: gateway-ips
-#         run: |
-#           echo "nativelink_ip=$(kubectl get gtw nativelink-gateway -o=jsonpath='{.status.addresses[0].value}')" >> "$GITHUB_ENV"
-
-#       - name: Print cluster state
-#         run: |
-#           kubectl get svc -A
-#           kubectl get pod -A
-#           kubectl get svc -A
-#           kubectl get deployments -A
-#           kubectl describe gtw
-#           echo "nativelink"
-#           kubectl logs -l app=nativelink
-#           echo "worker"
-#           kubectl logs -l app=nativelink-worker
-
-#       - name: Build example with ${{ matrix.toolchain }} toolchain
-#         env:
-#           TOOLCHAIN: ${{ matrix.toolchain }}
-#         run: >
-#           nix develop --impure --command
-#           bash -c "bazel run \
-#             --remote_cache=grpc://$nativelink_ip \
-#             --remote_executor=grpc://$nativelink_ip \
-#             --verbose_failures \
-#             @local-remote-execution//examples:${TOOLCHAIN}"
+  remote-docker-compose:
+    runs-on: ubuntu-24.04
+    steps:
+    - name: Checkout
+      uses: >- # v6.0.2
+        actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
+    - name: Set up Docker Buildx
+      uses: >- # v3.9.0
+        docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca
+
+    - name: Prepare Worker
+      uses: ./.github/actions/prepare-nix
+      with:
+        nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}
+
+    - name: Build Nativelink images
+      run: |
+        nix run .#image.copyTo docker-daemon:local-nativelink:latest
+        nix run .#nativelink-worker-lre-rs.copyTo docker-daemon:local-worker-rs:latest
+        nix run .#nativelink-worker-init.copyTo docker-daemon:local-worker-init:latest
+
+    - name: Compile NativeLink with NativeLink
+      timeout-minutes: 60
+      run: |
+        set -eu
+        cd deployment-examples/docker-compose
+        docker compose -f docker-compose-lre.yml up &> docker-compose.log &
+        cd ../../
+        nix develop --impure --fallback --command \
+        bash -c "bazel test //... \
+           --lockfile_mode=error \
+           --verbose_failures \
+           --remote_cache=grpc://127.0.0.1:50051 \
+           --remote_executor=grpc://127.0.0.1:50052"
+      env:
+          NATIVELINK_IMAGE: local-nativelink:latest
+          NATIVELINK_WORKER_INIT_IMAGE: local-worker-init:latest
+          NATIVELINK_LRE_IMAGE: local-worker-rs:latest
+          RUST_LOG: debug
+
+    - name: Check Docker compose
+      run: cat deployment-examples/docker-compose/docker-compose.log
+      if: always()
+
+    - name: Teardown Worker
+      uses: ./.github/actions/end-nix
+      if: always()
+      with:
+        nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}
diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index 2fa5d424d..1992b609f 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -20,72 +20,6 @@ concurrency:
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 jobs:
-  # TODO(palfrey): Flaky. Fix.
-  # docker-compose-compiles-nativelink:
-  #   # The type of runner that the job will run on.
-  #   runs-on: ubuntu-24.04
-  #   strategy:
-  #     matrix:
-  #       # Which OS versions we will test on.
-  #       os_version: [ 24.04 ]
-  #   steps:
-  #   - name: Checkout
-  #     uses: >- # v6.0.2
-  #       actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
-
-  #   - name: Set up Docker Buildx
-  #     uses: >- # v3.9.0
-  #       docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca
-
-  #   - name: Build Nativelink image
-  #     uses: >- # v6.13.0
-  #       docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991
-  #     with:
-  #       context: .
-  #       file: ./deployment-examples/docker-compose/Dockerfile
-  #       build-args: |
-  #         OPT_LEVEL=opt
-  #         OS_VERSION=${{ matrix.os_version }}
-  #         ADDITIONAL_SETUP_WORKER_CMD=apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y gcc g++ lld pkg-config python3
-  #       load: true # This brings the build into `docker images` from buildx.
-  #       tags: trace_machina/nativelink:latest
-
-  #   - name: Build builder image
-  #     uses: >- # v6.13.0
-  #       docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991
-  #     with:
-  #       context: .
-  #       file: ./deployment-examples/docker-compose/Dockerfile
-  #       build-args: |
-  #         OPT_LEVEL=opt
-  #         OS_VERSION=${{ matrix.os_version }}
-  #       load: true # This brings the build into `docker images` from buildx.
-  #       tags: trace_machina/nativelink:builder
-  #       target: builder
-
-  #   - name: Compile NativeLink with NativeLink
-  #     run: |
-  #       mkdir -p ~/.cache && \
-  #       cd deployment-examples/docker-compose && \
-  #       (docker-compose up -d || docker compose up -d) && \
-  #       cd ../../ && \
-  #       docker run --rm --net=host -w /root/nativelink -v $PWD:/root/nativelink trace_machina/nativelink:builder sh -c ' \
-  #         bazel clean && \
-  #         bazel test //... \
-  #         --extra_toolchains=@rust_toolchains//:all \
-  #         --remote_cache=grpc://127.0.0.1:50051 \
-  #         --remote_executor=grpc://127.0.0.1:50052 \
-  #         --remote_default_exec_properties=cpu_count=2 \
-  #       ' && \
-  #       docker run --rm --net=host -w /root/nativelink -v $PWD:/root/nativelink trace_machina/nativelink:builder sh -c ' \
-  #         bazel clean && \
-  #         bazel test //... \
-  #         --extra_toolchains=@rust_toolchains//:all \
-  #         --remote_cache=grpc://127.0.0.1:50051 \
-  #         --remote_executor=grpc://127.0.0.1:50052 \
-  #         --remote_default_exec_properties=cpu_count=2 \
-  #       ' 2>&1 | ( ! grep '         PASSED in ' ) # If we get PASSED without (cache) it means there's a cache issue.
-
   integration-tests:
     runs-on: ubuntu-24.04
     timeout-minutes: 60
diff --git a/MODULE.bazel b/MODULE.bazel
index a9901b0db..0d69ebbf7 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -15,7 +15,7 @@ bazel_dep(name = "rules_shell", version = "0.6.1")
 # via --extra_toolchains, which outranks the MODULE.bazel registration below,
 # so Nix users keep getting LRE-CC unchanged. Outside Nix (no lre.bazelrc),
 # these hermetic toolchains replace the host autodetect path.
-bazel_dep(name = "llvm", version = "0.7.7")
+bazel_dep(name = "llvm", version = "0.8.0")
 
 register_toolchains("@llvm//toolchain:all")
 
@@ -50,9 +50,10 @@ register_toolchains(
     dev_dependency = True,
 )
 
-bazel_dep(name = "rules_rs", version = "0.0.76")
+bazel_dep(name = "rules_rs", version = "0.0.77")
 
-# Pin rules_rust to the hermeticbuild fork (the same commit rules_rs provisions)
+# Pin rules_rust to the hermeticbuild fork (the same commit rules_rs provisions
+# see https://github.com/hermeticbuild/rules_rs/blob/v0.0.77/rs/rules_rust.bzl)
 # so all `@rules_rust//...` references resolve to the patched ruleset. The
 # bazel_dep + archive_override is the form that keeps `@rules_rust` visible to
 # subsequent `use_extension(...)` calls in this MODULE.bazel — the alternative
@@ -62,15 +63,15 @@ bazel_dep(name = "rules_rs", version = "0.0.76")
 # The local musl-platforms patch is still applied because the hermeticbuild
 # fork does not list x86_64/aarch64-unknown-linux-musl as supported triples in
 # rust/platform/triple_mappings.bzl.
-bazel_dep(name = "rules_rust", version = "0.68.1")
+bazel_dep(name = "rules_rust", version = "0.70.0")
 archive_override(
     module_name = "rules_rust",
-    integrity = "sha256-HG4cSGKVIoZTn0zpUNKhJbGvFfD2UVPJqKRqgTqLOQQ=",
+    integrity = "sha256-aROt7MxNPUOELpgM4BZEQpptsoT6t2qjFpAzyZRF0LE=",
     patch_strip = 1,
     patches = ["//tools:rules_rust-musl-platforms.diff"],
-    strip_prefix = "rules_rust-cf176d81c12d9c8f6420c7d433b0af0f08d2abb1",
+    strip_prefix = "rules_rust-1c00622c3ba0269a6d5306772fe2e9aff4bf89a0",
     urls = [
-        "https://github.com/hermeticbuild/rules_rust/archive/cf176d81c12d9c8f6420c7d433b0af0f08d2abb1.tar.gz",
+        "https://github.com/hermeticbuild/rules_rust/archive/1c00622c3ba0269a6d5306772fe2e9aff4bf89a0.tar.gz",
     ],
 )
 
diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock
index 6a8aaed13..2ce1a71c9 100644
--- a/MODULE.bazel.lock
+++ b/MODULE.bazel.lock
@@ -83,7 +83,8 @@
     "https://bcr.bazel.build/modules/jsoncpp/1.9.6/source.json": "a04756d367a2126c3541682864ecec52f92cdee80a35735a3cb249ce015ca000",
     "https://bcr.bazel.build/modules/libpfm/4.11.0/MODULE.bazel": "45061ff025b301940f1e30d2c16bea596c25b176c8b6b3087e92615adbd52902",
     "https://bcr.bazel.build/modules/llvm/0.7.7/MODULE.bazel": "0eeaf1814feca77abc7af3523e2b9d3735f92e2583043f8d6a2cc0fb5f479a28",
-    "https://bcr.bazel.build/modules/llvm/0.7.7/source.json": "7c8910307329462a21b7bdcc52710360da3de8284738dca52241bb15302a00dc",
+    "https://bcr.bazel.build/modules/llvm/0.8.0/MODULE.bazel": "72e043f9ad3cdd721659c74010fff87a4ce970abf8d47c04f48a0371234191e3",
+    "https://bcr.bazel.build/modules/llvm/0.8.0/source.json": "bbe84a7c74b4bbb964a5dad5071c80e4ea36da42f798f70844658b8fd3b236af",
     "https://bcr.bazel.build/modules/nlohmann_json/3.6.1/MODULE.bazel": "6f7b417dcc794d9add9e556673ad25cb3ba835224290f4f848f8e2db1e1fca74",
     "https://bcr.bazel.build/modules/package_metadata/0.0.3/MODULE.bazel": "77890552ecea9e284b5424c9de827a58099348763a4359e975c359a83d4faa83",
     "https://bcr.bazel.build/modules/package_metadata/0.0.7/MODULE.bazel": "7adb03933fc8401f495800cf4eafcff0edc6da0ff55c7db223ef69d19f689486",
@@ -193,7 +194,8 @@
     "https://bcr.bazel.build/modules/rules_python/2.0.0/MODULE.bazel": "1459089e2d4194d2a49e07896f5334fb230a8f2966ae945b1f793bef87a292fd",
     "https://bcr.bazel.build/modules/rules_python/2.0.0/source.json": "b8e25661f58c573e5e27af21295867e87766e89211f326fcb84034e6e6b6794b",
     "https://bcr.bazel.build/modules/rules_rs/0.0.76/MODULE.bazel": "461dcf664f368fdc921f67ea20ec1bc78c73f65a0a20b6e2a6d4b1c77fbde8c1",
-    "https://bcr.bazel.build/modules/rules_rs/0.0.76/source.json": "167eb1122e0f74848fc995b581061155dda1dfd600a38c253a85ef46d0523221",
+    "https://bcr.bazel.build/modules/rules_rs/0.0.77/MODULE.bazel": "709814c4dc438fe77234ffa04a0ffe12e511e7e7d051590a0e8f43db678e712d",
+    "https://bcr.bazel.build/modules/rules_rs/0.0.77/source.json": "6af335041ccb8a949dad0cf55e4785a68c622012646b820f87a9c40038bf1936",
     "https://bcr.bazel.build/modules/rules_shell/0.2.0/MODULE.bazel": "fda8a652ab3c7d8fee214de05e7a9916d8b28082234e8d2c0094505c5268ed3c",
     "https://bcr.bazel.build/modules/rules_shell/0.3.0/MODULE.bazel": "de4402cd12f4cc8fda2354fce179fdb068c0b9ca1ec2d2b17b3e21b24c1a937b",
     "https://bcr.bazel.build/modules/rules_shell/0.4.1/MODULE.bazel": "00e501db01bbf4e3e1dd1595959092c2fadf2087b2852d3f553b5370f5633592",
@@ -209,8 +211,9 @@
     "https://bcr.bazel.build/modules/stardoc/0.7.2/MODULE.bazel": "fc152419aa2ea0f51c29583fab1e8c99ddefd5b3778421845606ee628629e0e5",
     "https://bcr.bazel.build/modules/swift_argument_parser/1.3.1.1/MODULE.bazel": "5e463fbfba7b1701d957555ed45097d7f984211330106ccd1352c6e0af0dcf91",
     "https://bcr.bazel.build/modules/swift_argument_parser/1.3.1.2/MODULE.bazel": "75aab2373a4bbe2a1260b9bf2a1ebbdbf872d3bd36f80bff058dccd82e89422f",
+    "https://bcr.bazel.build/modules/tar.bzl/0.10.4/MODULE.bazel": "e8f9ff79199e8d9eaad7f1b0a77ad74b30bb82d794b87d8ca942bead5de83ae9",
+    "https://bcr.bazel.build/modules/tar.bzl/0.10.4/source.json": "20143442376c03426f6135292ba02d825cb75308aa47e6bf42dd4cc5a435c2ff",
     "https://bcr.bazel.build/modules/tar.bzl/0.9.0/MODULE.bazel": "452a22d7f02b1c9d7a22ab25edf20f46f3e1101f0f67dc4bfbf9a474ddf02445",
-    "https://bcr.bazel.build/modules/tar.bzl/0.9.0/source.json": "c732760a374831a2cf5b08839e4be75017196b4d796a5aa55235272ee17cd839",
     "https://bcr.bazel.build/modules/toolchains_protoc/0.4.3/MODULE.bazel": "54daf5468a9c3e52f6c8a96c8e0b867f7b30029dfe1e74f5a59bf081921d91a3",
     "https://bcr.bazel.build/modules/toolchains_protoc/0.4.3/source.json": "fbf3886395e08c407caca84f92f8c9ad92b05ce126a94883def1e150edd6b417",
     "https://bcr.bazel.build/modules/upb/0.0.0-20220923-a547704/MODULE.bazel": "7298990c00040a0e2f121f6c32544bab27d4452f80d9ce51349b1a28f3005c43",
@@ -226,7 +229,7 @@
     "@@aspect_tools_telemetry+//:extension.bzl%telemetry": {
       "general": {
         "bzlTransitiveDigest": "MePriaXmQNSqUfE+YQvEtzBc2bU1mjITINIffFiZYgo=",
-        "usagesDigest": "ibiT5THLv67F8GNR92fjXCqmyYBFE4ZBphBLqWLTFBI=",
+        "usagesDigest": "QyL2lVFExcQwxFR4MIRIQssq2OMzBZKS9pogrUzpqwY=",
         "recordedInputs": [
           "REPO_MAPPING:aspect_tools_telemetry+,bazel_lib bazel_lib+",
           "REPO_MAPPING:aspect_tools_telemetry+,bazel_skylib bazel_skylib+"
@@ -236,7 +239,7 @@
             "repoRuleId": "@@aspect_tools_telemetry+//:extension.bzl%tel_repository",
             "attributes": {
               "deps": {
-                "rules_rs": "0.0.76",
+                "rules_rs": "0.0.77",
                 "aspect_tools_telemetry": "0.3.3"
               }
             }
@@ -1519,6 +1522,7 @@
       "rustc-1.92.0-aarch64-apple-darwin.tar.xz": "15dee753c9217dff4cf45d734b29dc13ce6017d8a55fe34eed75022b39a63ff0",
       "rustc-1.92.0-aarch64-pc-windows-msvc.tar.xz": "07ba5606143de3bc916455714f67732fca05805591396a8190d5e88b8863eea3",
       "rustc-1.92.0-aarch64-unknown-linux-gnu.tar.xz": "7c8706fad4c038b5eacab0092e15db54d2b365d5f3323ca046fe987f814e7826",
+      "rustc-1.92.0-src.tar.xz": "ebee170bfe4c4dfc59521a101de651e5534f4dae889756a5c97ca9ea40d0c307",
       "rustc-1.92.0-x86_64-apple-darwin.tar.xz": "0facbd5d2742c8e97c53d59c9b5b81db6088cfc285d9ecb99523a50d6765fc5c",
       "rustc-1.92.0-x86_64-pc-windows-msvc.tar.xz": "6aec5aba5384ce1041538e71ebebf671d82e29f4fe697bc7844626d94b0dbfe6",
       "rustc-1.92.0-x86_64-unknown-linux-gnu.tar.xz": "78b2dd9c6b1fcd2621fa81c611cf5e2d6950690775038b585c64f364422886e0",
diff --git a/deployment-examples/docker-compose/Dockerfile b/deployment-examples/docker-compose/Dockerfile
index c95796932..268cf336c 100644
--- a/deployment-examples/docker-compose/Dockerfile
+++ b/deployment-examples/docker-compose/Dockerfile
@@ -66,4 +66,4 @@ RUN apt-get update \
     && mkdir -p /root/.cache/nativelink
 
 EXPOSE 50051/tcp 50052/tcp
-CMD ["nativelink"]
+ENTRYPOINT ["nativelink"]
diff --git a/deployment-examples/docker-compose/docker-compose-lre.yml b/deployment-examples/docker-compose/docker-compose-lre.yml
new file mode 100644
index 000000000..967ba9802
--- /dev/null
+++ b/deployment-examples/docker-compose/docker-compose-lre.yml
@@ -0,0 +1,101 @@
+# Copyright 2022 The NativeLink Authors. All rights reserved.
+#
+# Licensed under the Functional Source License, Version 1.1, Apache 2.0 Future License (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    See LICENSE file for details
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+services:
+  nativelink_local_cas:
+    image: ${NATIVELINK_IMAGE:-trace_machina/nativelink:latest}
+    build:
+      context: ../..
+      dockerfile: ./deployment-examples/docker-compose/Dockerfile
+      network: host
+      args:
+        - ADDITIONAL_SETUP_WORKER_CMD=${ADDITIONAL_SETUP_WORKER_CMD:-}
+    volumes:
+      - ${NATIVELINK_DIR:-~/.cache/nativelink}:/root/.cache/nativelink
+      - type: bind
+        source: .
+        target: /root
+    environment:
+      RUST_LOG: ${RUST_LOG:-warn}
+      NL_LOG: json
+    ports: [ "50051:50051/tcp", "127.0.0.1:50061:50061", "50071:50071/tcp", ]
+    command: |
+      /root/local-storage-cas.json5
+
+  nativelink_scheduler:
+    image: ${NATIVELINK_IMAGE:-trace_machina/nativelink:latest}
+    build:
+      context: ../..
+      dockerfile: ./deployment-examples/docker-compose/Dockerfile
+      network: host
+      args:
+        - ADDITIONAL_SETUP_WORKER_CMD=${ADDITIONAL_SETUP_WORKER_CMD:-}
+    volumes:
+      - type: bind
+        source: .
+        target: /root
+    environment:
+      RUST_LOG: ${RUST_LOG:-warn}
+      CAS_ENDPOINT: nativelink_local_cas
+      NL_LOG: json
+    ports: [ "50052:50052/tcp" ]
+    command: |
+      /root/scheduler.json5
+    depends_on:
+      - nativelink_local_cas
+
+  executor-init:
+    image: ${NATIVELINK_WORKER_INIT_IMAGE:-trace_machina/nativelink:latest}
+    build:
+      context: ../..
+      dockerfile: ./deployment-examples/docker-compose/Dockerfile
+      network: host
+      args:
+        - ADDITIONAL_SETUP_WORKER_CMD=${ADDITIONAL_SETUP_WORKER_CMD:-}
+    command: /shared
+    volumes:
+      - exec-shared:/shared
+
+  nativelink_executor:
+    image: ${NATIVELINK_LRE_IMAGE:-trace_machina/nativelink:latest}
+    privileged: true # So we can do use_namespaces
+    build:
+      context: ../..
+      dockerfile: ./deployment-examples/docker-compose/Dockerfile
+      network: host
+      args:
+        - ADDITIONAL_SETUP_WORKER_CMD=${ADDITIONAL_SETUP_WORKER_CMD:-}
+    volumes:
+      - ${NATIVELINK_DIR:-~/.cache/nativelink}:/root/.cache/nativelink
+      - type: bind
+        source: .
+        target: /root
+      - exec-shared:/shared
+    environment:
+      RUST_LOG: ${RUST_LOG:-warn}
+      NL_LOG: json
+      CAS_ENDPOINT: nativelink_local_cas
+      SCHEDULER_ENDPOINT: nativelink_scheduler
+    command: |
+      /shared/nativelink /root/worker.json5
+    depends_on:
+      nativelink_local_cas:
+        condition: service_started
+      nativelink_scheduler:
+        condition: service_started
+      executor-init:
+        condition: service_completed_successfully
+
+volumes:
+  exec-shared:
diff --git a/deployment-examples/docker-compose/docker-compose.yml b/deployment-examples/docker-compose/docker-compose.yml
index 3eb071aa1..bb9cdece6 100644
--- a/deployment-examples/docker-compose/docker-compose.yml
+++ b/deployment-examples/docker-compose/docker-compose.yml
@@ -14,7 +14,7 @@
 
 services:
   nativelink_local_cas:
-    image: trace_machina/nativelink:latest
+    image: ${NATIVELINK_IMAGE:-trace_machina/nativelink:latest}
     build:
       context: ../..
       dockerfile: ./deployment-examples/docker-compose/Dockerfile
@@ -30,10 +30,10 @@ services:
       RUST_LOG: ${RUST_LOG:-warn}
     ports: [ "50051:50051/tcp", "127.0.0.1:50061:50061", "50071:50071/tcp", ]
     command: |
-      nativelink /root/local-storage-cas.json5
+      /root/local-storage-cas.json5
 
   nativelink_scheduler:
-    image: trace_machina/nativelink:latest
+    image: ${NATIVELINK_IMAGE:-trace_machina/nativelink:latest}
     build:
       context: ../..
       dockerfile: ./deployment-examples/docker-compose/Dockerfile
@@ -49,12 +49,12 @@ services:
       CAS_ENDPOINT: nativelink_local_cas
     ports: [ "50052:50052/tcp" ]
     command: |
-      nativelink /root/scheduler.json5
+      /root/scheduler.json5
     depends_on:
       - nativelink_local_cas
 
   nativelink_executor:
-    image: trace_machina/nativelink:latest
+    image: ${NATIVELINK_LRE_IMAGE:-trace_machina/nativelink:latest}
     privileged: true # So we can do use_namespaces
     build:
       context: ../..
@@ -72,7 +72,9 @@ services:
       CAS_ENDPOINT: nativelink_local_cas
       SCHEDULER_ENDPOINT: nativelink_scheduler
     command: |
-      nativelink /root/worker.json5
+      /root/worker.json5
     depends_on:
-      - nativelink_local_cas
-      - nativelink_scheduler
+      nativelink_local_cas:
+        condition: service_started
+      nativelink_scheduler:
+        condition: service_started
diff --git a/deployment-examples/docker-compose/local-storage-cas.json5 b/deployment-examples/docker-compose/local-storage-cas.json5
index 6d4acdeed..428f36d8f 100644
--- a/deployment-examples/docker-compose/local-storage-cas.json5
+++ b/deployment-examples/docker-compose/local-storage-cas.json5
@@ -54,13 +54,13 @@
           },
         ],
         capabilities: [],
-        bytestream: {
-          cas_stores: {
-            "": "CAS_MAIN_STORE",
+        bytestream: [
+          {
+            cas_store: "CAS_MAIN_STORE",
           },
-        },
-        fetch: {},
-        push: {},
+        ],
+        fetch: [],
+        push: [],
       },
     },
     {
@@ -91,12 +91,12 @@
           },
         ],
         capabilities: [],
-        bytestream: {
-          cas_stores: {
-            "": "CAS_MAIN_STORE",
+        bytestream: [
+          {
+            cas_store: "CAS_MAIN_STORE",
           },
-        },
-        health: {},
+        ],
+        health: [],
       },
     },
   ],
diff --git a/deployment-examples/docker-compose/worker.json5 b/deployment-examples/docker-compose/worker.json5
index 7e55b0f17..fff3cd1aa 100644
--- a/deployment-examples/docker-compose/worker.json5
+++ b/deployment-examples/docker-compose/worker.json5
@@ -63,7 +63,7 @@
         work_directory: "/root/.cache/nativelink/work",
         platform_properties: {
           cpu_count: {
-            query_cmd: "nproc",
+            values: [],
           },
           OSFamily: {
             values: [
diff --git a/flake.nix b/flake.nix
index ad1e68fac..effc6375f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -164,6 +164,9 @@
           (craneLibFor p).buildPackage ((commonArgsFor p)
             // {
               cargoArtifacts = cargoArtifactsFor p;
+              # If you're testing Nativelink images, doing a dev profile will
+              # massively speedup build times. Just don't commit/push them!
+              # CARGO_PROFILE = "dev";
             });
 
         nativeTargetPkgs =
diff --git a/local-remote-execution/MODULE.bazel b/local-remote-execution/MODULE.bazel
index 8c95cf2ec..868f70510 100644
--- a/local-remote-execution/MODULE.bazel
+++ b/local-remote-execution/MODULE.bazel
@@ -14,8 +14,8 @@ bazel_dep(name = "rules_cc", version = "0.2.18")
 
 # Use the starlark implementation of Java rules instead of the builtin ones.
 bazel_dep(name = "rules_java", version = "8.11.0")
-bazel_dep(name = "rules_rs", version = "0.0.76")
-bazel_dep(name = "rules_rust", version = "0.68.1")
+bazel_dep(name = "rules_rs", version = "0.0.77")
+bazel_dep(name = "rules_rust", version = "0.70.0")
 bazel_dep(name = "bazel_skylib", version = "1.9.0")
 # rules_rust is pinned to the hermeticbuild fork in the parent MODULE.bazel via
 # archive_override; this submodule resolves to the same archive automatically.
diff --git a/local-remote-execution/MODULE.bazel.lock b/local-remote-execution/MODULE.bazel.lock
index 900107ca3..a20eb23b9 100644
--- a/local-remote-execution/MODULE.bazel.lock
+++ b/local-remote-execution/MODULE.bazel.lock
@@ -21,6 +21,8 @@
     "https://bcr.bazel.build/modules/apple_support/1.24.1/MODULE.bazel": "f46e8ddad60aef170ee92b2f3d00ef66c147ceafea68b6877cb45bd91737f5f8",
     "https://bcr.bazel.build/modules/apple_support/1.24.2/MODULE.bazel": "0e62471818affb9f0b26f128831d5c40b074d32e6dda5a0d3852847215a41ca4",
     "https://bcr.bazel.build/modules/apple_support/1.24.2/source.json": "2c22c9827093250406c5568da6c54e6fdf0ef06238def3d99c71b12feb057a8d",
+    "https://bcr.bazel.build/modules/aspect_tools_telemetry/0.3.3/MODULE.bazel": "37c764292861c2f70314efa9846bb6dbb44fc0308903b3285da6528305450183",
+    "https://bcr.bazel.build/modules/aspect_tools_telemetry/0.3.3/source.json": "605086bbc197743a0d360f7ddc550a1d4dfa0441bc807236e17170f636153348",
     "https://bcr.bazel.build/modules/bazel_features/1.1.1/MODULE.bazel": "27b8c79ef57efe08efccbd9dd6ef70d61b4798320b8d3c134fd571f78963dbcd",
     "https://bcr.bazel.build/modules/bazel_features/1.10.0/MODULE.bazel": "f75e8807570484a99be90abcd52b5e1f390362c258bcb73106f4544957a48101",
     "https://bcr.bazel.build/modules/bazel_features/1.11.0/MODULE.bazel": "f9382337dd5a474c3b7d334c2f83e50b6eaedc284253334cf823044a26de03e8",
@@ -30,16 +32,25 @@
     "https://bcr.bazel.build/modules/bazel_features/1.19.0/MODULE.bazel": "59adcdf28230d220f0067b1f435b8537dd033bfff8db21335ef9217919c7fb58",
     "https://bcr.bazel.build/modules/bazel_features/1.21.0/MODULE.bazel": "675642261665d8eea09989aa3b8afb5c37627f1be178382c320d1b46afba5e3b",
     "https://bcr.bazel.build/modules/bazel_features/1.23.0/MODULE.bazel": "fd1ac84bc4e97a5a0816b7fd7d4d4f6d837b0047cf4cbd81652d616af3a6591a",
+    "https://bcr.bazel.build/modules/bazel_features/1.24.0/MODULE.bazel": "4796b4c25b47053e9bbffa792b3792d07e228ff66cd0405faef56a978708acd4",
     "https://bcr.bazel.build/modules/bazel_features/1.27.0/MODULE.bazel": "621eeee06c4458a9121d1f104efb80f39d34deff4984e778359c60eaf1a8cb65",
     "https://bcr.bazel.build/modules/bazel_features/1.28.0/MODULE.bazel": "4b4200e6cbf8fa335b2c3f43e1d6ef3e240319c33d43d60cc0fbd4b87ece299d",
     "https://bcr.bazel.build/modules/bazel_features/1.3.0/MODULE.bazel": "cdcafe83ec318cda34e02948e81d790aab8df7a929cec6f6969f13a489ccecd9",
     "https://bcr.bazel.build/modules/bazel_features/1.30.0/MODULE.bazel": "a14b62d05969a293b80257e72e597c2da7f717e1e69fa8b339703ed6731bec87",
     "https://bcr.bazel.build/modules/bazel_features/1.32.0/MODULE.bazel": "095d67022a58cb20f7e20e1aefecfa65257a222c18a938e2914fd257b5f1ccdc",
     "https://bcr.bazel.build/modules/bazel_features/1.33.0/MODULE.bazel": "8b8dc9d2a4c88609409c3191165bccec0e4cb044cd7a72ccbe826583303459f6",
+    "https://bcr.bazel.build/modules/bazel_features/1.34.0/MODULE.bazel": "e8475ad7c8965542e0c7aac8af68eb48c4af904be3d614b6aa6274c092c2ea1e",
     "https://bcr.bazel.build/modules/bazel_features/1.4.1/MODULE.bazel": "e45b6bb2350aff3e442ae1111c555e27eac1d915e77775f6fdc4b351b758b5d7",
+    "https://bcr.bazel.build/modules/bazel_features/1.42.0/MODULE.bazel": "e8ca15cb2639c5f12183db6dcb678735555d0cdd739b32a0418b6532b5e565f8",
     "https://bcr.bazel.build/modules/bazel_features/1.42.1/MODULE.bazel": "275a59b5406ff18c01739860aa70ad7ccb3cfb474579411decca11c93b951080",
-    "https://bcr.bazel.build/modules/bazel_features/1.42.1/source.json": "fcd4396b2df85f64f2b3bb436ad870793ecf39180f1d796f913cc9276d355309",
+    "https://bcr.bazel.build/modules/bazel_features/1.43.0/MODULE.bazel": "defa2226f06ba20550d6548c3a2ea2a7929634437a52973869c20c225450eb91",
+    "https://bcr.bazel.build/modules/bazel_features/1.45.0/MODULE.bazel": "7daec6d87ab0703417486d4cb948af0b06f55d4d7c08cbb5978c80e79b538edf",
+    "https://bcr.bazel.build/modules/bazel_features/1.45.0/source.json": "635e4536e09ff125b8972e0fa239c135fde5f18701f7d5115680560651dfb41d",
+    "https://bcr.bazel.build/modules/bazel_features/1.9.0/MODULE.bazel": "885151d58d90d8d9c811eb75e3288c11f850e1d6b481a8c9f766adee4712358b",
     "https://bcr.bazel.build/modules/bazel_features/1.9.1/MODULE.bazel": "8f679097876a9b609ad1f60249c49d68bfab783dd9be012faf9d82547b14815a",
+    "https://bcr.bazel.build/modules/bazel_lib/3.0.0/MODULE.bazel": "22b70b80ac89ad3f3772526cd9feee2fa412c2b01933fea7ed13238a448d370d",
+    "https://bcr.bazel.build/modules/bazel_lib/3.2.2/MODULE.bazel": "e2c890c8a515d6bca9c66d47718aa9e44b458fde64ec7204b8030bf2d349058c",
+    "https://bcr.bazel.build/modules/bazel_lib/3.2.2/source.json": "9e84e115c20e14652c5c21401ae85ff4daa8702e265b5c0b3bf89353f17aa212",
     "https://bcr.bazel.build/modules/bazel_skylib/1.0.3/MODULE.bazel": "bcb0fd896384802d1ad283b4e4eb4d718eebd8cb820b0a2c3a347fb971afd9d8",
     "https://bcr.bazel.build/modules/bazel_skylib/1.1.1/MODULE.bazel": "1add3e7d93ff2e6998f9e118022c84d163917d912f5afafb3058e3d2f1545b5e",
     "https://bcr.bazel.build/modules/bazel_skylib/1.2.0/MODULE.bazel": "44fe84260e454ed94ad326352a698422dbe372b21a1ac9f3eab76eb531223686",
@@ -51,11 +62,15 @@
     "https://bcr.bazel.build/modules/bazel_skylib/1.6.1/MODULE.bazel": "8fdee2dbaace6c252131c00e1de4b165dc65af02ea278476187765e1a617b917",
     "https://bcr.bazel.build/modules/bazel_skylib/1.7.0/MODULE.bazel": "0db596f4563de7938de764cc8deeabec291f55e8ec15299718b93c4423e9796d",
     "https://bcr.bazel.build/modules/bazel_skylib/1.7.1/MODULE.bazel": "3120d80c5861aa616222ec015332e5f8d3171e062e3e804a2a0253e1be26e59b",
+    "https://bcr.bazel.build/modules/bazel_skylib/1.8.0/MODULE.bazel": "2fb3fb53675f6adfc1ca5bfbd5cfb655ae350fba4706d924a8ec7e3ba945671c",
     "https://bcr.bazel.build/modules/bazel_skylib/1.8.1/MODULE.bazel": "88ade7293becda963e0e3ea33e7d54d3425127e0a326e0d17da085a5f1f03ff6",
     "https://bcr.bazel.build/modules/bazel_skylib/1.8.2/MODULE.bazel": "69ad6927098316848b34a9142bcc975e018ba27f08c4ff403f50c1b6e646ca67",
-    "https://bcr.bazel.build/modules/bazel_skylib/1.8.2/source.json": "34a3c8bcf233b835eb74be9d628899bb32999d3e0eadef1947a0a562a2b16ffb",
+    "https://bcr.bazel.build/modules/bazel_skylib/1.9.0/MODULE.bazel": "72997b29dfd95c3fa0d0c48322d05590418edef451f8db8db5509c57875fb4b7",
+    "https://bcr.bazel.build/modules/bazel_skylib/1.9.0/source.json": "7ad77c1e8c1b84222d9b3f3cae016a76639435744c19330b0b37c0a3c9da7dc0",
     "https://bcr.bazel.build/modules/buildozer/8.5.1/MODULE.bazel": "a35d9561b3fc5b18797c330793e99e3b834a473d5fbd3d7d7634aafc9bdb6f8f",
     "https://bcr.bazel.build/modules/buildozer/8.5.1/source.json": "e3386e6ff4529f2442800dee47ad28d3e6487f36a1f75ae39ae56c70f0cd2fbd",
+    "https://bcr.bazel.build/modules/gawk/5.3.2.bcr.3/MODULE.bazel": "f1b7bb2dd53e8f2ef984b39485ec8a44e9076dda5c4b8efd2fb4c6a6e856a31d",
+    "https://bcr.bazel.build/modules/gawk/5.3.2.bcr.3/source.json": "ebe931bfe362e4b41e59ee00a528db6074157ff2ced92eb9e970acab2e1089c9",
     "https://bcr.bazel.build/modules/google_benchmark/1.8.2/MODULE.bazel": "a70cf1bba851000ba93b58ae2f6d76490a9feb74192e57ab8e8ff13c34ec50cb",
     "https://bcr.bazel.build/modules/googletest/1.11.0/MODULE.bazel": "3a83f095183f66345ca86aa13c58b59f9f94a2f81999c093d4eeaa2d262d12f4",
     "https://bcr.bazel.build/modules/googletest/1.14.0.bcr.1/MODULE.bazel": "22c31a561553727960057361aa33bf20fb2e98584bc4fec007906e27053f80c6",
@@ -67,8 +82,12 @@
     "https://bcr.bazel.build/modules/jsoncpp/1.9.6/MODULE.bazel": "2f8d20d3b7d54143213c4dfc3d98225c42de7d666011528dc8fe91591e2e17b0",
     "https://bcr.bazel.build/modules/jsoncpp/1.9.6/source.json": "a04756d367a2126c3541682864ecec52f92cdee80a35735a3cb249ce015ca000",
     "https://bcr.bazel.build/modules/libpfm/4.11.0/MODULE.bazel": "45061ff025b301940f1e30d2c16bea596c25b176c8b6b3087e92615adbd52902",
+    "https://bcr.bazel.build/modules/llvm/0.7.7/MODULE.bazel": "0eeaf1814feca77abc7af3523e2b9d3735f92e2583043f8d6a2cc0fb5f479a28",
+    "https://bcr.bazel.build/modules/llvm/0.7.7/source.json": "7c8910307329462a21b7bdcc52710360da3de8284738dca52241bb15302a00dc",
     "https://bcr.bazel.build/modules/nlohmann_json/3.6.1/MODULE.bazel": "6f7b417dcc794d9add9e556673ad25cb3ba835224290f4f848f8e2db1e1fca74",
-    "https://bcr.bazel.build/modules/nlohmann_json/3.6.1/source.json": "f448c6e8963fdfa7eb831457df83ad63d3d6355018f6574fb017e8169deb43a9",
+    "https://bcr.bazel.build/modules/package_metadata/0.0.3/MODULE.bazel": "77890552ecea9e284b5424c9de827a58099348763a4359e975c359a83d4faa83",
+    "https://bcr.bazel.build/modules/package_metadata/0.0.7/MODULE.bazel": "7adb03933fc8401f495800cf4eafcff0edc6da0ff55c7db223ef69d19f689486",
+    "https://bcr.bazel.build/modules/package_metadata/0.0.7/source.json": "50639625e937b56115012674c797cca7a05a96b4878c87d803c13dc2b31de8a0",
     "https://bcr.bazel.build/modules/platforms/0.0.10/MODULE.bazel": "8cb8efaf200bdeb2150d93e162c40f388529a25852b332cec879373771e48ed5",
     "https://bcr.bazel.build/modules/platforms/0.0.11/MODULE.bazel": "0daefc49732e227caa8bfa834d65dc52e8cc18a2faf80df25e8caea151a9413f",
     "https://bcr.bazel.build/modules/platforms/0.0.4/MODULE.bazel": "9b328e31ee156f53f3c416a64f8491f7eb731742655a47c9eec4703a71644aee",
@@ -78,7 +97,8 @@
     "https://bcr.bazel.build/modules/platforms/0.0.8/MODULE.bazel": "9f142c03e348f6d263719f5074b21ef3adf0b139ee4c5133e2aa35664da9eb2d",
     "https://bcr.bazel.build/modules/platforms/0.0.9/MODULE.bazel": "4a87a60c927b56ddd67db50c89acaa62f4ce2a1d2149ccb63ffd871d5ce29ebc",
     "https://bcr.bazel.build/modules/platforms/1.0.0/MODULE.bazel": "f05feb42b48f1b3c225e4ccf351f367be0371411a803198ec34a389fb22aa580",
-    "https://bcr.bazel.build/modules/platforms/1.0.0/source.json": "f4ff1fd412e0246fd38c82328eb209130ead81d62dcd5a9e40910f867f733d96",
+    "https://bcr.bazel.build/modules/platforms/1.1.0/MODULE.bazel": "1c0c09f5bdcf4b3f924720d2478a3711cb39f4977019ca5988685e5b7e18b3d2",
+    "https://bcr.bazel.build/modules/platforms/1.1.0/source.json": "fcf351c47596c939140ab0d333dfdd08ed1ea6ce33c2fe70c12493a301cf1344",
     "https://bcr.bazel.build/modules/protobuf/21.7/MODULE.bazel": "a5a29bb89544f9b97edce05642fac225a808b5b7be74038ea3640fae2f8e66a7",
     "https://bcr.bazel.build/modules/protobuf/27.0/MODULE.bazel": "7873b60be88844a0a1d8f80b9d5d20cfbd8495a689b8763e76c6372998d3f64c",
     "https://bcr.bazel.build/modules/protobuf/29.0-rc2/MODULE.bazel": "6241d35983510143049943fc0d57937937122baf1b287862f9dc8590fc4c37df",
@@ -87,7 +107,8 @@
     "https://bcr.bazel.build/modules/protobuf/3.19.0/MODULE.bazel": "6b5fbb433f760a99a22b18b6850ed5784ef0e9928a72668b66e4d7ccd47db9b0",
     "https://bcr.bazel.build/modules/protobuf/32.1/MODULE.bazel": "89cd2866a9cb07fee9ff74c41ceace11554f32e0d849de4e23ac55515cfada4d",
     "https://bcr.bazel.build/modules/protobuf/33.4/MODULE.bazel": "114775b816b38b6d0ca620450d6b02550c60ceedfdc8d9a229833b34a223dc42",
-    "https://bcr.bazel.build/modules/protobuf/33.4/source.json": "555f8686b4c7d6b5ba731fbea13bf656b4bfd9a7ff629c1d9d3f6e1d6155de79",
+    "https://bcr.bazel.build/modules/protobuf/34.0.bcr.1/MODULE.bazel": "74e541b0ba877813da786a11707d4e394433c157841d5111a36be0d44b907931",
+    "https://bcr.bazel.build/modules/protobuf/34.0.bcr.1/source.json": "fc174b3d6215aa14197d1bd779f98bb72d9fd666ee5ec0d6bba6ae986baa4535",
     "https://bcr.bazel.build/modules/pybind11_bazel/2.11.1/MODULE.bazel": "88af1c246226d87e65be78ed49ecd1e6f5e98648558c14ce99176da041dc378e",
     "https://bcr.bazel.build/modules/pybind11_bazel/2.12.0/MODULE.bazel": "e6f4c20442eaa7c90d7190d8dc539d0ab422f95c65a57cc59562170c58ae3d34",
     "https://bcr.bazel.build/modules/pybind11_bazel/2.12.0/source.json": "6900fdc8a9e95866b8c0d4ad4aba4d4236317b5c1cd04c502df3f0d33afed680",
@@ -99,7 +120,6 @@
     "https://bcr.bazel.build/modules/rules_android/0.1.1/source.json": "e6986b41626ee10bdc864937ffb6d6bf275bb5b9c65120e6137d56e6331f089e",
     "https://bcr.bazel.build/modules/rules_apple/3.16.0/MODULE.bazel": "0d1caf0b8375942ce98ea944be754a18874041e4e0459401d925577624d3a54a",
     "https://bcr.bazel.build/modules/rules_apple/4.1.0/MODULE.bazel": "76e10fd4a48038d3fc7c5dc6e63b7063bbf5304a2e3bd42edda6ec660eebea68",
-    "https://bcr.bazel.build/modules/rules_apple/4.1.0/source.json": "8ee81e1708756f81b343a5eb2b2f0b953f1d25c4ab3d4a68dc02754872e80715",
     "https://bcr.bazel.build/modules/rules_cc/0.0.1/MODULE.bazel": "cb2aa0747f84c6c3a78dad4e2049c154f08ab9d166b1273835a8174940365647",
     "https://bcr.bazel.build/modules/rules_cc/0.0.10/MODULE.bazel": "ec1705118f7eaedd6e118508d3d26deba2a4e76476ada7e0e3965211be012002",
     "https://bcr.bazel.build/modules/rules_cc/0.0.13/MODULE.bazel": "0e8529ed7b323dad0775ff924d2ae5af7640b23553dfcd4d34344c7e7a867191",
@@ -116,7 +136,8 @@
     "https://bcr.bazel.build/modules/rules_cc/0.2.0/MODULE.bazel": "b5c17f90458caae90d2ccd114c81970062946f49f355610ed89bebf954f5783c",
     "https://bcr.bazel.build/modules/rules_cc/0.2.13/MODULE.bazel": "eecdd666eda6be16a8d9dc15e44b5c75133405e820f620a234acc4b1fdc5aa37",
     "https://bcr.bazel.build/modules/rules_cc/0.2.17/MODULE.bazel": "1849602c86cb60da8613d2de887f9566a6d354a6df6d7009f9d04a14402f9a84",
-    "https://bcr.bazel.build/modules/rules_cc/0.2.17/source.json": "3832f45d145354049137c0090df04629d9c2b5493dc5c2bf46f1834040133a07",
+    "https://bcr.bazel.build/modules/rules_cc/0.2.18/MODULE.bazel": "4460ec36adc8f722a6a2a4ac9374cb91f2acebadaa93fc37966129afb3dece87",
+    "https://bcr.bazel.build/modules/rules_cc/0.2.18/source.json": "abad668ff2fd63ada1ac49bf386d37e27048b89a3465a6fd968bb832b00a09d3",
     "https://bcr.bazel.build/modules/rules_cc/0.2.4/MODULE.bazel": "1ff1223dfd24f3ecf8f028446d4a27608aa43c3f41e346d22838a4223980b8cc",
     "https://bcr.bazel.build/modules/rules_cc/0.2.8/MODULE.bazel": "f1df20f0bf22c28192a794f29b501ee2018fa37a3862a1a2132ae2940a23a642",
     "https://bcr.bazel.build/modules/rules_foreign_cc/0.9.0/MODULE.bazel": "c9e8c682bf75b0e7c704166d79b599f93b72cfca5ad7477df596947891feeef6",
@@ -131,6 +152,7 @@
     "https://bcr.bazel.build/modules/rules_java/8.11.0/MODULE.bazel": "c3d280bc5ff1038dcb3bacb95d3f6b83da8dd27bba57820ec89ea4085da767ad",
     "https://bcr.bazel.build/modules/rules_java/8.3.2/MODULE.bazel": "7336d5511ad5af0b8615fdc7477535a2e4e723a357b6713af439fe8cf0195017",
     "https://bcr.bazel.build/modules/rules_java/8.5.1/MODULE.bazel": "d8a9e38cc5228881f7055a6079f6f7821a073df3744d441978e7a43e20226939",
+    "https://bcr.bazel.build/modules/rules_java/8.6.0/MODULE.bazel": "9c064c434606d75a086f15ade5edb514308cccd1544c2b2a89bbac4310e41c71",
     "https://bcr.bazel.build/modules/rules_java/8.6.1/MODULE.bazel": "f4808e2ab5b0197f094cabce9f4b006a27766beb6a9975931da07099560ca9c2",
     "https://bcr.bazel.build/modules/rules_java/9.1.0/MODULE.bazel": "ee63f27e36a3fada80342869361182f120a9819c74320e8e65b1e04ba0cd7a9d",
     "https://bcr.bazel.build/modules/rules_java/9.1.0/source.json": "da589573c1dee2c9ac4a568b301269a2e8191110ff0345c1a959fa7ea6c4dfd6",
@@ -165,19 +187,22 @@
     "https://bcr.bazel.build/modules/rules_python/1.3.0/MODULE.bazel": "8361d57eafb67c09b75bf4bbe6be360e1b8f4f18118ab48037f2bd50aa2ccb13",
     "https://bcr.bazel.build/modules/rules_python/1.4.1/MODULE.bazel": "8991ad45bdc25018301d6b7e1d3626afc3c8af8aaf4bc04f23d0b99c938b73a6",
     "https://bcr.bazel.build/modules/rules_python/1.6.0/MODULE.bazel": "7e04ad8f8d5bea40451cf80b1bd8262552aa73f841415d20db96b7241bd027d8",
+    "https://bcr.bazel.build/modules/rules_python/1.6.3/MODULE.bazel": "a7b80c42cb3de5ee2a5fa1abc119684593704fcd2fec83165ebe615dec76574f",
     "https://bcr.bazel.build/modules/rules_python/1.7.0/MODULE.bazel": "d01f995ecd137abf30238ad9ce97f8fc3ac57289c8b24bd0bf53324d937a14f8",
     "https://bcr.bazel.build/modules/rules_python/1.7.0/source.json": "028a084b65dcf8f4dc4f82f8778dbe65df133f234b316828a82e060d81bdce32",
+    "https://bcr.bazel.build/modules/rules_rs/0.0.76/MODULE.bazel": "461dcf664f368fdc921f67ea20ec1bc78c73f65a0a20b6e2a6d4b1c77fbde8c1",
+    "https://bcr.bazel.build/modules/rules_rs/0.0.76/source.json": "167eb1122e0f74848fc995b581061155dda1dfd600a38c253a85ef46d0523221",
     "https://bcr.bazel.build/modules/rules_rust/0.68.1/MODULE.bazel": "8d3332ef4079673385eb81f8bd68b012decc04ac00c9d5a01a40eff90301732c",
     "https://bcr.bazel.build/modules/rules_rust/0.68.1/source.json": "3378e746f81b62457fdfd37391244fa8ff075ba85c05931ee4f3a20ac1efe963",
     "https://bcr.bazel.build/modules/rules_shell/0.2.0/MODULE.bazel": "fda8a652ab3c7d8fee214de05e7a9916d8b28082234e8d2c0094505c5268ed3c",
     "https://bcr.bazel.build/modules/rules_shell/0.3.0/MODULE.bazel": "de4402cd12f4cc8fda2354fce179fdb068c0b9ca1ec2d2b17b3e21b24c1a937b",
+    "https://bcr.bazel.build/modules/rules_shell/0.4.1/MODULE.bazel": "00e501db01bbf4e3e1dd1595959092c2fadf2087b2852d3f553b5370f5633592",
     "https://bcr.bazel.build/modules/rules_shell/0.6.1/MODULE.bazel": "72e76b0eea4e81611ef5452aa82b3da34caca0c8b7b5c0c9584338aa93bae26b",
     "https://bcr.bazel.build/modules/rules_shell/0.6.1/source.json": "20ec05cd5e592055e214b2da8ccb283c7f2a421ea0dc2acbf1aa792e11c03d0c",
     "https://bcr.bazel.build/modules/rules_swift/1.16.0/MODULE.bazel": "4a09f199545a60d09895e8281362b1ff3bb08bbde69c6fc87aff5b92fcc916ca",
     "https://bcr.bazel.build/modules/rules_swift/2.1.1/MODULE.bazel": "494900a80f944fc7aa61500c2073d9729dff0b764f0e89b824eb746959bc1046",
     "https://bcr.bazel.build/modules/rules_swift/2.4.0/MODULE.bazel": "1639617eb1ede28d774d967a738b4a68b0accb40650beadb57c21846beab5efd",
     "https://bcr.bazel.build/modules/rules_swift/3.1.2/MODULE.bazel": "72c8f5cf9d26427cee6c76c8e3853eb46ce6b0412a081b2b6db6e8ad56267400",
-    "https://bcr.bazel.build/modules/rules_swift/3.1.2/source.json": "e85761f3098a6faf40b8187695e3de6d97944e98abd0d8ce579cb2daf6319a66",
     "https://bcr.bazel.build/modules/stardoc/0.5.1/MODULE.bazel": "1a05d92974d0c122f5ccf09291442580317cdd859f07a8655f1db9a60374f9f8",
     "https://bcr.bazel.build/modules/stardoc/0.5.3/MODULE.bazel": "c7f6948dae6999bf0db32c1858ae345f112cacf98f174c7a8bb707e41b974f1c",
     "https://bcr.bazel.build/modules/stardoc/0.7.0/MODULE.bazel": "05e3d6d30c099b6770e97da986c53bd31844d7f13d41412480ea265ac9e8079c",
@@ -185,8 +210,11 @@
     "https://bcr.bazel.build/modules/stardoc/0.7.2/source.json": "58b029e5e901d6802967754adf0a9056747e8176f017cfe3607c0851f4d42216",
     "https://bcr.bazel.build/modules/swift_argument_parser/1.3.1.1/MODULE.bazel": "5e463fbfba7b1701d957555ed45097d7f984211330106ccd1352c6e0af0dcf91",
     "https://bcr.bazel.build/modules/swift_argument_parser/1.3.1.2/MODULE.bazel": "75aab2373a4bbe2a1260b9bf2a1ebbdbf872d3bd36f80bff058dccd82e89422f",
-    "https://bcr.bazel.build/modules/swift_argument_parser/1.3.1.2/source.json": "5fba48bbe0ba48761f9e9f75f92876cafb5d07c0ce059cc7a8027416de94a05b",
+    "https://bcr.bazel.build/modules/tar.bzl/0.9.0/MODULE.bazel": "452a22d7f02b1c9d7a22ab25edf20f46f3e1101f0f67dc4bfbf9a474ddf02445",
+    "https://bcr.bazel.build/modules/tar.bzl/0.9.0/source.json": "c732760a374831a2cf5b08839e4be75017196b4d796a5aa55235272ee17cd839",
     "https://bcr.bazel.build/modules/upb/0.0.0-20220923-a547704/MODULE.bazel": "7298990c00040a0e2f121f6c32544bab27d4452f80d9ce51349b1a28f3005c43",
+    "https://bcr.bazel.build/modules/with_cfg.bzl/0.12.0/MODULE.bazel": "b573395fe63aef4299ba095173e2f62ccfee5ad9bbf7acaa95dba73af9fc2b38",
+    "https://bcr.bazel.build/modules/with_cfg.bzl/0.12.0/source.json": "3f3fbaeafecaf629877ad152a2c9def21f8d330d91aa94c5dc75bbb98c10b8b8",
     "https://bcr.bazel.build/modules/zlib/1.2.11/MODULE.bazel": "07b389abc85fdbca459b69e2ec656ae5622873af3f845e1c9d80fe179f3effa0",
     "https://bcr.bazel.build/modules/zlib/1.3.1.bcr.5/MODULE.bazel": "eec517b5bbe5492629466e11dae908d043364302283de25581e3eb944326c4ca",
     "https://bcr.bazel.build/modules/zlib/1.3.1.bcr.5/source.json": "22bc55c47af97246cfc093d0acf683a7869377de362b5d1c552c2c2e16b7a806",
diff --git a/nativelink-worker/src/running_actions_manager.rs b/nativelink-worker/src/running_actions_manager.rs
index 4e9ea04a5..09d794874 100644
--- a/nativelink-worker/src/running_actions_manager.rs
+++ b/nativelink-worker/src/running_actions_manager.rs
@@ -959,7 +959,9 @@ impl RunningActionImpl {
         //                    level more effectively and adjust this.
         info!(?args, "Executing command");
 
-        let program = self.canonicalise_path(args[0], &command_proto.working_directory)?;
+        let program = self
+            .canonicalise_path(args[0], &command_proto.working_directory)
+            .err_tip(|| format!("Canonicalisation failure. Command={args:#?}"))?;
 
         let mut command_builder = process::Command::new(program);
         #[cfg(target_family = "unix")]
@@ -1416,6 +1418,7 @@ impl RunningActionImpl {
                 exit_code = ?execution_result.exit_code,
                 stdout = ?stdout[..min(stdout.len(), 1000)],
                 stderr = ?stderr[..min(stderr.len(), 1000)],
+                command = ?command_proto.arguments,
                 "Command returned non-zero exit code",
             );
         }
diff --git a/templates/bazel/MODULE.bazel b/templates/bazel/MODULE.bazel
index a65d6c89d..9895b120a 100644
--- a/templates/bazel/MODULE.bazel
+++ b/templates/bazel/MODULE.bazel
@@ -13,4 +13,4 @@ archive_override(
     urls = ["https://github.com/TraceMachina/nativelink/archive/f9ff630e09a3c22d6a3abea68d1bacc775eac6bb.zip"],
 )
 
-bazel_dep(name = "rules_cc", version = "0.2.8")
+bazel_dep(name = "rules_cc", version = "0.2.18")
diff --git a/toolchain-examples/MODULE.bazel b/toolchain-examples/MODULE.bazel
index c37339476..c3517011e 100644
--- a/toolchain-examples/MODULE.bazel
+++ b/toolchain-examples/MODULE.bazel
@@ -38,8 +38,8 @@ bazel_dep(name = "rules_go", version = "0.60.0")
 
 # Rust
 #
-bazel_dep(name = "rules_rs", version = "0.0.76")
-bazel_dep(name = "llvm", version = "0.7.7")
+bazel_dep(name = "rules_rs", version = "0.0.77")
+bazel_dep(name = "llvm", version = "0.8.0")
 
 rust_toolchains = use_extension("@rules_rs//rs/toolchains:module_extension.bzl", "toolchains")
 rust_toolchains.toolchain(
diff --git a/web/platform/src/content/docs/docs/contribute/nix.mdx b/web/platform/src/content/docs/docs/contribute/nix.mdx
index 119d90f80..e254b3a57 100644
--- a/web/platform/src/content/docs/docs/contribute/nix.mdx
+++ b/web/platform/src/content/docs/docs/contribute/nix.mdx
@@ -41,7 +41,7 @@ and get tagged with nix derivation hashes.
 To build an image locally and make it available to your container runtime:
 
 ```sh
-nix run create-local-image
+create-local-image
 ```
 
 which will be called `local-nativelink:latest`

From e39441fc34afe7ebe930bfff6263bfacee9509d7 Mon Sep 17 00:00:00 2001
From: Tom Parker-Shemilt <tom@tracemachina.com>
Date: Wed, 20 May 2026 14:48:04 +0100
Subject: [PATCH 02/16] Make there actually be a cache dir

---
 .github/workflows/lre.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/lre.yaml b/.github/workflows/lre.yaml
index 27b043595..ec4b71853 100644
--- a/.github/workflows/lre.yaml
+++ b/.github/workflows/lre.yaml
@@ -84,6 +84,7 @@ jobs:
       timeout-minutes: 60
       run: |
         set -eu
+        mkdir .cache
         cd deployment-examples/docker-compose
         docker compose -f docker-compose-lre.yml up &> docker-compose.log &
         cd ../../
@@ -97,6 +98,7 @@ jobs:
           NATIVELINK_IMAGE: local-nativelink:latest
           NATIVELINK_WORKER_INIT_IMAGE: local-worker-init:latest
           NATIVELINK_LRE_IMAGE: local-worker-rs:latest
+          NATIVELINK_DIR: ${{ github.workspace }}/.cache
           RUST_LOG: debug
 
     - name: Check Docker compose

From 4faa1b3f276561c51def202ae9e531f877fa2fe9 Mon Sep 17 00:00:00 2001
From: Tom Parker-Shemilt <tom@tracemachina.com>
Date: Wed, 20 May 2026 15:04:01 +0100
Subject: [PATCH 03/16] Fix LRE CI entrypoint

---
 deployment-examples/docker-compose/docker-compose-lre.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/deployment-examples/docker-compose/docker-compose-lre.yml b/deployment-examples/docker-compose/docker-compose-lre.yml
index 967ba9802..a9ea33af4 100644
--- a/deployment-examples/docker-compose/docker-compose-lre.yml
+++ b/deployment-examples/docker-compose/docker-compose-lre.yml
@@ -87,8 +87,9 @@ services:
       NL_LOG: json
       CAS_ENDPOINT: nativelink_local_cas
       SCHEDULER_ENDPOINT: nativelink_scheduler
+    entrypoint: /shared/nativelink
     command: |
-      /shared/nativelink /root/worker.json5
+       /root/worker.json5
     depends_on:
       nativelink_local_cas:
         condition: service_started

From beee15dedd636bd47880c850923b4f4b6ed0a6cd Mon Sep 17 00:00:00 2001
From: Tom Parker-Shemilt <tom@tracemachina.com>
Date: Wed, 20 May 2026 15:40:56 +0100
Subject: [PATCH 04/16] Set LRE timeout small

---
 .github/workflows/lre.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/lre.yaml b/.github/workflows/lre.yaml
index ec4b71853..8177fef4b 100644
--- a/.github/workflows/lre.yaml
+++ b/.github/workflows/lre.yaml
@@ -81,7 +81,7 @@ jobs:
         nix run .#nativelink-worker-init.copyTo docker-daemon:local-worker-init:latest
 
     - name: Compile NativeLink with NativeLink
-      timeout-minutes: 60
+      timeout-minutes: 5 # FIXME: Reset to 60 before merge
       run: |
         set -eu
         mkdir .cache

From 989d1ec31b3aa531e6b941dedea9e156f8fc98d8 Mon Sep 17 00:00:00 2001
From: Tom Parker-Shemilt <tom@tracemachina.com>
Date: Wed, 20 May 2026 16:26:09 +0100
Subject: [PATCH 05/16] Give full access to cache dir

---
 .github/workflows/lre.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/lre.yaml b/.github/workflows/lre.yaml
index 8177fef4b..0f21d433d 100644
--- a/.github/workflows/lre.yaml
+++ b/.github/workflows/lre.yaml
@@ -85,6 +85,9 @@ jobs:
       run: |
         set -eu
         mkdir .cache
+        ls -ld .cache
+        ls -l .cache
+        chmod 777 .cache
         cd deployment-examples/docker-compose
         docker compose -f docker-compose-lre.yml up &> docker-compose.log &
         cd ../../

From da137fbfffd6e3d6ce44bdfb187039f2e7b7b36f Mon Sep 17 00:00:00 2001
From: Tom Parker-Shemilt <tom@tracemachina.com>
Date: Wed, 20 May 2026 16:44:15 +0100
Subject: [PATCH 06/16] Dump logs synchronously

---
 .github/workflows/lre.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/lre.yaml b/.github/workflows/lre.yaml
index 0f21d433d..1e9bf2c5f 100644
--- a/.github/workflows/lre.yaml
+++ b/.github/workflows/lre.yaml
@@ -85,11 +85,11 @@ jobs:
       run: |
         set -eu
         mkdir .cache
-        ls -ld .cache
         ls -l .cache
         chmod 777 .cache
+        ls -l .cache
         cd deployment-examples/docker-compose
-        docker compose -f docker-compose-lre.yml up &> docker-compose.log &
+        (docker compose -f docker-compose-lre.yml up 2>&1 | tee -i docker-compose.log) &
         cd ../../
         nix develop --impure --fallback --command \
         bash -c "bazel test //... \

From c04d02fb03ee82fafcbf26fe5420b0bde8d675b9 Mon Sep 17 00:00:00 2001
From: Tom Parker-Shemilt <tom@tracemachina.com>
Date: Wed, 20 May 2026 16:46:01 +0100
Subject: [PATCH 07/16] Reset source code changes for faster loops

---
 nativelink-worker/src/running_actions_manager.rs | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/nativelink-worker/src/running_actions_manager.rs b/nativelink-worker/src/running_actions_manager.rs
index ffdb13959..431cc0d29 100644
--- a/nativelink-worker/src/running_actions_manager.rs
+++ b/nativelink-worker/src/running_actions_manager.rs
@@ -987,9 +987,7 @@ impl RunningActionImpl {
         //                    level more effectively and adjust this.
         info!(?args, "Executing command");
 
-        let program = self
-            .canonicalise_path(args[0], &command_proto.working_directory)
-            .err_tip(|| format!("Canonicalisation failure. Command={args:#?}"))?;
+        let program = self.canonicalise_path(args[0], &command_proto.working_directory)?;
 
         let mut command_builder = process::Command::new(program);
         #[cfg(target_family = "unix")]
@@ -1536,7 +1534,6 @@ impl RunningActionImpl {
                 exit_code = ?execution_result.exit_code,
                 stdout = ?stdout[..min(stdout.len(), 1000)],
                 stderr = ?stderr[..min(stderr.len(), 1000)],
-                command = ?command_proto.arguments,
                 "Command returned non-zero exit code",
             );
         }

From 57abf8637c00b7429be618fc0ad84adcf600d58b Mon Sep 17 00:00:00 2001
From: Tom Parker-Shemilt <tom@tracemachina.com>
Date: Wed, 20 May 2026 17:07:39 +0100
Subject: [PATCH 08/16] Fix executor entrypoint

---
 .github/workflows/lre.yaml                            | 3 +--
 deployment-examples/docker-compose/docker-compose.yml | 1 +
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/lre.yaml b/.github/workflows/lre.yaml
index 1e9bf2c5f..adb7d085b 100644
--- a/.github/workflows/lre.yaml
+++ b/.github/workflows/lre.yaml
@@ -95,8 +95,7 @@ jobs:
         bash -c "bazel test //... \
            --lockfile_mode=error \
            --verbose_failures \
-           --remote_cache=grpc://127.0.0.1:50051 \
-           --remote_executor=grpc://127.0.0.1:50052"
+           --config self_test --config self_execute"
       env:
           NATIVELINK_IMAGE: local-nativelink:latest
           NATIVELINK_WORKER_INIT_IMAGE: local-worker-init:latest
diff --git a/deployment-examples/docker-compose/docker-compose.yml b/deployment-examples/docker-compose/docker-compose.yml
index bb9cdece6..60ebdc705 100644
--- a/deployment-examples/docker-compose/docker-compose.yml
+++ b/deployment-examples/docker-compose/docker-compose.yml
@@ -71,6 +71,7 @@ services:
       RUST_LOG: ${RUST_LOG:-warn}
       CAS_ENDPOINT: nativelink_local_cas
       SCHEDULER_ENDPOINT: nativelink_scheduler
+    entrypoint: /shared/nativelink
     command: |
       /root/worker.json5
     depends_on:

From 64e3d6cd93802108355e2991ee63cfbb6187b761 Mon Sep 17 00:00:00 2001
From: Tom Parker-Shemilt <tom@tracemachina.com>
Date: Wed, 20 May 2026 17:21:15 +0100
Subject: [PATCH 09/16] Wrong entrypoint for regular docker compose

---
 deployment-examples/docker-compose/docker-compose.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/deployment-examples/docker-compose/docker-compose.yml b/deployment-examples/docker-compose/docker-compose.yml
index 60ebdc705..bb9cdece6 100644
--- a/deployment-examples/docker-compose/docker-compose.yml
+++ b/deployment-examples/docker-compose/docker-compose.yml
@@ -71,7 +71,6 @@ services:
       RUST_LOG: ${RUST_LOG:-warn}
       CAS_ENDPOINT: nativelink_local_cas
       SCHEDULER_ENDPOINT: nativelink_scheduler
-    entrypoint: /shared/nativelink
     command: |
       /root/worker.json5
     depends_on:

From c57c9a9ae1d742dd40c52867e7619a1b51d0a039 Mon Sep 17 00:00:00 2001
From: Tom Parker-Shemilt <tom@tracemachina.com>
Date: Wed, 20 May 2026 17:36:33 +0100
Subject: [PATCH 10/16] Make worker user root so we can use namespaces

---
 tools/public/create-worker.nix | 31 +++----------------------------
 1 file changed, 3 insertions(+), 28 deletions(-)

diff --git a/tools/public/create-worker.nix b/tools/public/create-worker.nix
index 23308f7e8..9725ef66d 100644
--- a/tools/public/create-worker.nix
+++ b/tools/public/create-worker.nix
@@ -5,7 +5,6 @@
     nix2container,
     coreutils,
     gnused,
-    lib,
     runCommand,
     runtimeShell,
     self,
@@ -31,25 +30,13 @@
       ln -s /bin/env $out/usr/bin/env
     '';
 
-    user = "nativelink";
-    group = "nativelink";
-    uid = "1000";
-    gid = "1000";
-
     mkUser = runCommand "mkUser" {} ''
       mkdir -p $out/etc/pam.d
 
       echo "root:x:0:0::/root:${runtimeShell}" > $out/etc/passwd
-      echo "${user}:x:${uid}:${gid}:::" >> $out/etc/passwd
-
       echo "root:!x:::::::" > $out/etc/shadow
-      echo "${user}:!x:::::::" >> $out/etc/shadow
-
       echo "root:x:0:" > $out/etc/group
-      echo "${group}:x:${gid}:" >> $out/etc/group
-
       echo "root:x::" > $out/etc/gshadow
-      echo "${group}:x::" >> $out/etc/gshadow
 
       cat > $out/etc/pam.d/other <<EOF
       account sufficient pam_unix.so
@@ -59,19 +46,7 @@
       EOF
 
       touch $out/etc/login.defs
-      mkdir -p $out/home/${user}
     '';
-
-    # Set permissions for the user's home directory.
-    mkUserPerms = {
-      path = mkUser;
-      regex = "/home/${user}";
-      mode = "0755";
-      uid = lib.toInt uid;
-      gid = lib.toInt gid;
-      uname = user;
-      gname = group;
-    };
   in
     # Create a container image from a base image with the nativelink executable
     # added and set as entrypoint. This allows arbitrary base images to be
@@ -93,7 +68,6 @@
         ];
 
         perms = [
-          mkUserPerms
           mkTmpPerms
         ];
 
@@ -103,8 +77,9 @@
         tag = image.imageTag;
 
         config = {
-          User = user;
-          WorkingDir = "/home/${user}";
+          # Need root so we can use namespaces
+          User = "root";
+          WorkingDir = "/root";
           Labels = {
             "org.opencontainers.image.description" = "NativeLink worker generated from ${image.imageName}.";
             "org.opencontainers.image.documentation" = "https://github.com/TraceMachina/nativelink";

From d3e1b9bb523a376acee071e623f1b8342e8c6496 Mon Sep 17 00:00:00 2001
From: Tom Parker-Shemilt <tom@tracemachina.com>
Date: Thu, 21 May 2026 10:51:20 +0100
Subject: [PATCH 11/16] Split exec_triple for musl

---
 local-remote-execution/MODULE.bazel.lock | 16 ++++++++--------
 local-remote-execution/rust/BUILD.bazel  | 10 ++++++++--
 2 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/local-remote-execution/MODULE.bazel.lock b/local-remote-execution/MODULE.bazel.lock
index a20eb23b9..2244c9a1a 100644
--- a/local-remote-execution/MODULE.bazel.lock
+++ b/local-remote-execution/MODULE.bazel.lock
@@ -82,8 +82,8 @@
     "https://bcr.bazel.build/modules/jsoncpp/1.9.6/MODULE.bazel": "2f8d20d3b7d54143213c4dfc3d98225c42de7d666011528dc8fe91591e2e17b0",
     "https://bcr.bazel.build/modules/jsoncpp/1.9.6/source.json": "a04756d367a2126c3541682864ecec52f92cdee80a35735a3cb249ce015ca000",
     "https://bcr.bazel.build/modules/libpfm/4.11.0/MODULE.bazel": "45061ff025b301940f1e30d2c16bea596c25b176c8b6b3087e92615adbd52902",
-    "https://bcr.bazel.build/modules/llvm/0.7.7/MODULE.bazel": "0eeaf1814feca77abc7af3523e2b9d3735f92e2583043f8d6a2cc0fb5f479a28",
-    "https://bcr.bazel.build/modules/llvm/0.7.7/source.json": "7c8910307329462a21b7bdcc52710360da3de8284738dca52241bb15302a00dc",
+    "https://bcr.bazel.build/modules/llvm/0.8.0/MODULE.bazel": "72e043f9ad3cdd721659c74010fff87a4ce970abf8d47c04f48a0371234191e3",
+    "https://bcr.bazel.build/modules/llvm/0.8.0/source.json": "bbe84a7c74b4bbb964a5dad5071c80e4ea36da42f798f70844658b8fd3b236af",
     "https://bcr.bazel.build/modules/nlohmann_json/3.6.1/MODULE.bazel": "6f7b417dcc794d9add9e556673ad25cb3ba835224290f4f848f8e2db1e1fca74",
     "https://bcr.bazel.build/modules/package_metadata/0.0.3/MODULE.bazel": "77890552ecea9e284b5424c9de827a58099348763a4359e975c359a83d4faa83",
     "https://bcr.bazel.build/modules/package_metadata/0.0.7/MODULE.bazel": "7adb03933fc8401f495800cf4eafcff0edc6da0ff55c7db223ef69d19f689486",
@@ -190,10 +190,10 @@
     "https://bcr.bazel.build/modules/rules_python/1.6.3/MODULE.bazel": "a7b80c42cb3de5ee2a5fa1abc119684593704fcd2fec83165ebe615dec76574f",
     "https://bcr.bazel.build/modules/rules_python/1.7.0/MODULE.bazel": "d01f995ecd137abf30238ad9ce97f8fc3ac57289c8b24bd0bf53324d937a14f8",
     "https://bcr.bazel.build/modules/rules_python/1.7.0/source.json": "028a084b65dcf8f4dc4f82f8778dbe65df133f234b316828a82e060d81bdce32",
-    "https://bcr.bazel.build/modules/rules_rs/0.0.76/MODULE.bazel": "461dcf664f368fdc921f67ea20ec1bc78c73f65a0a20b6e2a6d4b1c77fbde8c1",
-    "https://bcr.bazel.build/modules/rules_rs/0.0.76/source.json": "167eb1122e0f74848fc995b581061155dda1dfd600a38c253a85ef46d0523221",
-    "https://bcr.bazel.build/modules/rules_rust/0.68.1/MODULE.bazel": "8d3332ef4079673385eb81f8bd68b012decc04ac00c9d5a01a40eff90301732c",
-    "https://bcr.bazel.build/modules/rules_rust/0.68.1/source.json": "3378e746f81b62457fdfd37391244fa8ff075ba85c05931ee4f3a20ac1efe963",
+    "https://bcr.bazel.build/modules/rules_rs/0.0.77/MODULE.bazel": "709814c4dc438fe77234ffa04a0ffe12e511e7e7d051590a0e8f43db678e712d",
+    "https://bcr.bazel.build/modules/rules_rs/0.0.77/source.json": "6af335041ccb8a949dad0cf55e4785a68c622012646b820f87a9c40038bf1936",
+    "https://bcr.bazel.build/modules/rules_rust/0.70.0/MODULE.bazel": "5b1407b11c305bc2522e204e7f170faf8399e836e49b6afef9074dfe532e6c3f",
+    "https://bcr.bazel.build/modules/rules_rust/0.70.0/source.json": "24ae6d23425359db1c3148aa22c389970fce9a06102b2b3a329a2800f9569de2",
     "https://bcr.bazel.build/modules/rules_shell/0.2.0/MODULE.bazel": "fda8a652ab3c7d8fee214de05e7a9916d8b28082234e8d2c0094505c5268ed3c",
     "https://bcr.bazel.build/modules/rules_shell/0.3.0/MODULE.bazel": "de4402cd12f4cc8fda2354fce179fdb068c0b9ca1ec2d2b17b3e21b24c1a937b",
     "https://bcr.bazel.build/modules/rules_shell/0.4.1/MODULE.bazel": "00e501db01bbf4e3e1dd1595959092c2fadf2087b2852d3f553b5370f5633592",
@@ -210,8 +210,8 @@
     "https://bcr.bazel.build/modules/stardoc/0.7.2/source.json": "58b029e5e901d6802967754adf0a9056747e8176f017cfe3607c0851f4d42216",
     "https://bcr.bazel.build/modules/swift_argument_parser/1.3.1.1/MODULE.bazel": "5e463fbfba7b1701d957555ed45097d7f984211330106ccd1352c6e0af0dcf91",
     "https://bcr.bazel.build/modules/swift_argument_parser/1.3.1.2/MODULE.bazel": "75aab2373a4bbe2a1260b9bf2a1ebbdbf872d3bd36f80bff058dccd82e89422f",
-    "https://bcr.bazel.build/modules/tar.bzl/0.9.0/MODULE.bazel": "452a22d7f02b1c9d7a22ab25edf20f46f3e1101f0f67dc4bfbf9a474ddf02445",
-    "https://bcr.bazel.build/modules/tar.bzl/0.9.0/source.json": "c732760a374831a2cf5b08839e4be75017196b4d796a5aa55235272ee17cd839",
+    "https://bcr.bazel.build/modules/tar.bzl/0.10.4/MODULE.bazel": "e8f9ff79199e8d9eaad7f1b0a77ad74b30bb82d794b87d8ca942bead5de83ae9",
+    "https://bcr.bazel.build/modules/tar.bzl/0.10.4/source.json": "20143442376c03426f6135292ba02d825cb75308aa47e6bf42dd4cc5a435c2ff",
     "https://bcr.bazel.build/modules/upb/0.0.0-20220923-a547704/MODULE.bazel": "7298990c00040a0e2f121f6c32544bab27d4452f80d9ce51349b1a28f3005c43",
     "https://bcr.bazel.build/modules/with_cfg.bzl/0.12.0/MODULE.bazel": "b573395fe63aef4299ba095173e2f62ccfee5ad9bbf7acaa95dba73af9fc2b38",
     "https://bcr.bazel.build/modules/with_cfg.bzl/0.12.0/source.json": "3f3fbaeafecaf629877ad152a2c9def21f8d330d91aa94c5dc75bbb98c10b8b8",
diff --git a/local-remote-execution/rust/BUILD.bazel b/local-remote-execution/rust/BUILD.bazel
index be3a63088..0b0990ede 100644
--- a/local-remote-execution/rust/BUILD.bazel
+++ b/local-remote-execution/rust/BUILD.bazel
@@ -98,8 +98,14 @@ config_setting(
         }),
         env = {},
         exec_triple = {
-            "x86_64-linux": "x86_64-unknown-linux-gnu",
-            "aarch64-linux": "aarch64-unknown-linux-gnu",
+            "x86_64-linux": select({
+                "@local-remote-execution//libc:musl": "x86_64-unknown-linux-musl",
+                "//conditions:default": "x86_64-unknown-linux-gnu",
+            }),
+            "aarch64-linux": select({
+                "@local-remote-execution//libc:musl": "aarch64-unknown-linux-musl",
+                "//conditions:default": "aarch64-unknown-linux-gnu",
+            }),
             "x86_64-darwin": "x86_64-apple-darwin",
             "aarch64-darwin": "aarch64-apple-darwin",
         }[nix_system],

From 395e4f6906c625f97fed47656a4fdb3982fc2885 Mon Sep 17 00:00:00 2001
From: Tom Parker-Shemilt <tom@tracemachina.com>
Date: Thu, 21 May 2026 13:11:16 +0100
Subject: [PATCH 12/16] Collapse nixExecToRustExec to musl not gnu

---
 local-remote-execution/flake-module.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/local-remote-execution/flake-module.nix b/local-remote-execution/flake-module.nix
index f548553a7..575dc4132 100644
--- a/local-remote-execution/flake-module.nix
+++ b/local-remote-execution/flake-module.nix
@@ -100,9 +100,9 @@
           in
             {
               "aarch64-darwin" = "aarch64-apple-darwin";
-              "aarch64-linux" = "aarch64-unknown-linux-gnu";
+              "aarch64-linux" = "aarch64-unknown-linux-musl";
               "x86_64-darwin" = "x86_64-apple-darwin";
-              "x86_64-linux" = "x86_64-unknown-linux-gnu";
+              "x86_64-linux" = "x86_64-unknown-linux-musl";
             }.${
               system
             } or (throw "Unsupported Nix exec platform: ${system}");

From b563734c75504781b810cb38eb86a9a93923df69 Mon Sep 17 00:00:00 2001
From: Tom Parker-Shemilt <tom@tracemachina.com>
Date: Thu, 21 May 2026 15:22:42 +0100
Subject: [PATCH 13/16] Default exec_triple to musl, not gnu

---
 local-remote-execution/rust/BUILD.bazel | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/local-remote-execution/rust/BUILD.bazel b/local-remote-execution/rust/BUILD.bazel
index 0b0990ede..637cca645 100644
--- a/local-remote-execution/rust/BUILD.bazel
+++ b/local-remote-execution/rust/BUILD.bazel
@@ -99,12 +99,12 @@ config_setting(
         env = {},
         exec_triple = {
             "x86_64-linux": select({
-                "@local-remote-execution//libc:musl": "x86_64-unknown-linux-musl",
-                "//conditions:default": "x86_64-unknown-linux-gnu",
+                "@local-remote-execution//libc:glibc": "x86_64-unknown-linux-gnu",
+                "//conditions:default": "x86_64-unknown-linux-musl",
             }),
             "aarch64-linux": select({
-                "@local-remote-execution//libc:musl": "aarch64-unknown-linux-musl",
-                "//conditions:default": "aarch64-unknown-linux-gnu",
+                "@local-remote-execution//libc:glibc": "aarch64-unknown-linux-gnu",
+                "//conditions:default": "aarch64-unknown-linux-musl",
             }),
             "x86_64-darwin": "x86_64-apple-darwin",
             "aarch64-darwin": "aarch64-apple-darwin",

From 9c3bb00de513bf1df628899e4cb8d3d51a219502 Mon Sep 17 00:00:00 2001
From: Tom Parker-Shemilt <tom@tracemachina.com>
Date: Fri, 22 May 2026 10:25:12 +0100
Subject: [PATCH 14/16] More musl attempts

---
 local-remote-execution/cpp_env.json          | 2 +-
 local-remote-execution/generated-cc/cc/BUILD | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/local-remote-execution/cpp_env.json b/local-remote-execution/cpp_env.json
index 965bdcfad..c89c697c0 100644
--- a/local-remote-execution/cpp_env.json
+++ b/local-remote-execution/cpp_env.json
@@ -1,5 +1,5 @@
 {
   "ABI_LIBC_VERSION": "glibc_2.38",
-  "BAZEL_HOST_SYSTEM": "x86_64-unknown-linux-gnu",
+  "BAZEL_HOST_SYSTEM": "x86_64-unknown-linux-musl",
   "BAZEL_TARGET_LIBC": "glibc_2.38"
 }
diff --git a/local-remote-execution/generated-cc/cc/BUILD b/local-remote-execution/generated-cc/cc/BUILD
index a3a3f6a8d..9d07bfa6f 100644
--- a/local-remote-execution/generated-cc/cc/BUILD
+++ b/local-remote-execution/generated-cc/cc/BUILD
@@ -134,7 +134,7 @@ cc_toolchain_config(
         "-Xclang",
         "-fno-cxx-modules",
     ]},
-    host_system_name = "x86_64-unknown-linux-gnu",
+    host_system_name = "x86_64-unknown-linux-musl",
     link_flags = [
         "-fuse-ld=/nix/store/lrp069m8jb7gm0xaj8ww4gp37zwczc0z-llvm-binutils-wrapper-22.1.0-rc3/bin/ld.mold",
         "-B/nix/store/5b69ajvn84dh0hyick8l3s0fl51kv776-customClang/bin",

From 089dabb4761076bae08cd3a8cce68f0896ce16de Mon Sep 17 00:00:00 2001
From: Tom Parker-Shemilt <tom@tracemachina.com>
Date: Fri, 22 May 2026 15:11:53 +0100
Subject: [PATCH 15/16] Drop gnu from nixSystemToRustTargets

---
 local-remote-execution/overlays/rust-config.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/local-remote-execution/overlays/rust-config.nix b/local-remote-execution/overlays/rust-config.nix
index 6da471486..2f52cc241 100644
--- a/local-remote-execution/overlays/rust-config.nix
+++ b/local-remote-execution/overlays/rust-config.nix
@@ -18,9 +18,7 @@ in rec {
       "x86_64-unknown-linux-musl"
     ];
     "aarch64-linux" = [
-      "aarch64-unknown-linux-gnu"
       "aarch64-unknown-linux-musl"
-      "x86_64-unknown-linux-gnu"
       "x86_64-unknown-linux-musl"
     ];
     "x86_64-darwin" = [
@@ -32,9 +30,7 @@ in rec {
       "x86_64-unknown-linux-musl"
     ];
     "x86_64-linux" = [
-      "aarch64-unknown-linux-gnu"
       "aarch64-unknown-linux-musl"
-      "x86_64-unknown-linux-gnu"
       "x86_64-unknown-linux-musl"
     ];
   };

From 52517b75ea921a625d9263eab26f85b2fa60e052 Mon Sep 17 00:00:00 2001
From: Tom Parker-Shemilt <tom@tracemachina.com>
Date: Fri, 22 May 2026 15:21:58 +0100
Subject: [PATCH 16/16] Actually update lre-rs files

---
 MODULE.bazel.lock                             | 10 +++---
 .../rust/aarch64-linux.BUILD.bazel            | 36 -------------------
 local-remote-execution/rust/extension.bzl     |  8 ++---
 .../rust/platforms/BUILD.bazel                |  8 ++---
 .../rust/x86_64-linux.BUILD.bazel             | 36 -------------------
 5 files changed, 13 insertions(+), 85 deletions(-)

diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock
index cddd3115e..964210bd7 100644
--- a/MODULE.bazel.lock
+++ b/MODULE.bazel.lock
@@ -249,7 +249,7 @@
     },
     "@@local-remote-execution+//rust:extension.bzl%lre_rs": {
       "general": {
-        "bzlTransitiveDigest": "Dkt35a5IireKBJP+WmtVzou5W8d/2hLGhl6MJRRA0eg=",
+        "bzlTransitiveDigest": "6KWLEr4b/Vs5oaBrbbiRA1OErX/xjYA+KlyfXg28FLw=",
         "usagesDigest": "R9P8gnprFTJ/SsXLiQE5qx+Sqsa8YOFAOmRUyDO3tLY=",
         "recordedInputs": [
           "REPO_MAPPING:local-remote-execution+,bazel_tools bazel_tools"
@@ -273,14 +273,14 @@
             "repoRuleId": "@@bazel_tools//tools/build_defs/repo:local.bzl%new_local_repository",
             "attributes": {
               "build_file": "@@local-remote-execution+//rust:aarch64-linux.BUILD.bazel",
-              "path": "/nix/store/5vqbs2b3296x8c82xm5scz29n8y2zm0h-rust-default-1.93.1"
+              "path": "/nix/store/xi6z5j85rsgnqs2qspipk88x614brcq0-rust-default-1.93.1"
             }
           },
           "lre-rs-nightly-aarch64-linux": {
             "repoRuleId": "@@bazel_tools//tools/build_defs/repo:local.bzl%new_local_repository",
             "attributes": {
               "build_file": "@@local-remote-execution+//rust:aarch64-linux.BUILD.bazel",
-              "path": "/nix/store/vji1aridxgaiqrcpagnb6iqf3003b50r-rust-default-1.96.0-nightly-2026-03-24"
+              "path": "/nix/store/6w0cw646m1yj9gda7fah6r9xmfmqg75c-rust-default-1.96.0-nightly-2026-03-24"
             }
           },
           "lre-rs-stable-x86_64-darwin": {
@@ -301,14 +301,14 @@
             "repoRuleId": "@@bazel_tools//tools/build_defs/repo:local.bzl%new_local_repository",
             "attributes": {
               "build_file": "@@local-remote-execution+//rust:x86_64-linux.BUILD.bazel",
-              "path": "/nix/store/1sg0jgxw6k6jy8a3wvfacmnrdii236i0-rust-default-1.93.1"
+              "path": "/nix/store/89vs2amznbxs300phn64m24w2lq2ci0n-rust-default-1.93.1"
             }
           },
           "lre-rs-nightly-x86_64-linux": {
             "repoRuleId": "@@bazel_tools//tools/build_defs/repo:local.bzl%new_local_repository",
             "attributes": {
               "build_file": "@@local-remote-execution+//rust:x86_64-linux.BUILD.bazel",
-              "path": "/nix/store/j7v0r10lpysj1ak70g32rz8rdwbwn5sl-rust-default-1.96.0-nightly-2026-03-24"
+              "path": "/nix/store/vkkixs1yfd7zjyv7wibxhma29lwsp8ar-rust-default-1.96.0-nightly-2026-03-24"
             }
           }
         }
diff --git a/local-remote-execution/rust/aarch64-linux.BUILD.bazel b/local-remote-execution/rust/aarch64-linux.BUILD.bazel
index 8c41080fe..45643b4c9 100644
--- a/local-remote-execution/rust/aarch64-linux.BUILD.bazel
+++ b/local-remote-execution/rust/aarch64-linux.BUILD.bazel
@@ -39,15 +39,6 @@ load("@rules_rust//rust:toolchain.bzl", "rust_stdlib_filegroup")
 filegroup(
     name = "rustc_lib",
     srcs = select({
-        "@local-remote-execution//rust/triple:aarch64-unknown-linux-gnu": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/aarch64-unknown-linux-gnu/codegen-backends/*.so",
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.so",
-            ] + ["lib/rustlib/aarch64-unknown-linux-gnu/bin/rust-lld"],
-            allow_empty = True,
-        ),
         "@local-remote-execution//rust/triple:aarch64-unknown-linux-musl": glob(
             [
                 "bin/*.so",
@@ -57,15 +48,6 @@ filegroup(
             ] + ["lib/rustlib/aarch64-unknown-linux-musl/bin/rust-lld"],
             allow_empty = True,
         ),
-        "@local-remote-execution//rust/triple:x86_64-unknown-linux-gnu": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/*.so",
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.so",
-            ] + ["lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld"],
-            allow_empty = True,
-        ),
         "@local-remote-execution//rust/triple:x86_64-unknown-linux-musl": glob(
             [
                 "bin/*.so",
@@ -82,15 +64,6 @@ filegroup(
 rust_stdlib_filegroup(
     name = "rust_std",
     srcs = select({
-        "@local-remote-execution//rust/triple:aarch64-unknown-linux-gnu": glob(
-            [
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.rlib",
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.so",
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.a",
-            ],
-            allow_empty = True,
-        ),
         "@local-remote-execution//rust/triple:aarch64-unknown-linux-musl": glob(
             [
                 "lib/rustlib/aarch64-unknown-linux-musl/lib/*.rlib",
@@ -101,15 +74,6 @@ rust_stdlib_filegroup(
             ],
             allow_empty = True,
         ),
-        "@local-remote-execution//rust/triple:x86_64-unknown-linux-gnu": glob(
-            [
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.rlib",
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.so",
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.a",
-            ],
-            allow_empty = True,
-        ),
         "@local-remote-execution//rust/triple:x86_64-unknown-linux-musl": glob(
             [
                 "lib/rustlib/x86_64-unknown-linux-musl/lib/*.rlib",
diff --git a/local-remote-execution/rust/extension.bzl b/local-remote-execution/rust/extension.bzl
index 646f0a0af..60511b549 100644
--- a/local-remote-execution/rust/extension.bzl
+++ b/local-remote-execution/rust/extension.bzl
@@ -40,12 +40,12 @@ def _lre_rs_impl(_mctx):
     new_local_repository(
         name = "lre-rs-stable-aarch64-linux",
         build_file = "@local-remote-execution//rust:aarch64-linux.BUILD.bazel",
-        path = "/nix/store/5vqbs2b3296x8c82xm5scz29n8y2zm0h-rust-default-1.93.1",
+        path = "/nix/store/xi6z5j85rsgnqs2qspipk88x614brcq0-rust-default-1.93.1",
     )
     new_local_repository(
         name = "lre-rs-nightly-aarch64-linux",
         build_file = "@local-remote-execution//rust:aarch64-linux.BUILD.bazel",
-        path = "/nix/store/vji1aridxgaiqrcpagnb6iqf3003b50r-rust-default-1.96.0-nightly-2026-03-24",
+        path = "/nix/store/6w0cw646m1yj9gda7fah6r9xmfmqg75c-rust-default-1.96.0-nightly-2026-03-24",
     )
     new_local_repository(
         name = "lre-rs-stable-x86_64-darwin",
@@ -60,12 +60,12 @@ def _lre_rs_impl(_mctx):
     new_local_repository(
         name = "lre-rs-stable-x86_64-linux",
         build_file = "@local-remote-execution//rust:x86_64-linux.BUILD.bazel",
-        path = "/nix/store/1sg0jgxw6k6jy8a3wvfacmnrdii236i0-rust-default-1.93.1",
+        path = "/nix/store/89vs2amznbxs300phn64m24w2lq2ci0n-rust-default-1.93.1",
     )
     new_local_repository(
         name = "lre-rs-nightly-x86_64-linux",
         build_file = "@local-remote-execution//rust:x86_64-linux.BUILD.bazel",
-        path = "/nix/store/j7v0r10lpysj1ak70g32rz8rdwbwn5sl-rust-default-1.96.0-nightly-2026-03-24",
+        path = "/nix/store/vkkixs1yfd7zjyv7wibxhma29lwsp8ar-rust-default-1.96.0-nightly-2026-03-24",
     )
 
 lre_rs = module_extension(implementation = _lre_rs_impl)
diff --git a/local-remote-execution/rust/platforms/BUILD.bazel b/local-remote-execution/rust/platforms/BUILD.bazel
index a034fb991..718625254 100644
--- a/local-remote-execution/rust/platforms/BUILD.bazel
+++ b/local-remote-execution/rust/platforms/BUILD.bazel
@@ -33,7 +33,7 @@ platform(
     constraint_values = ["@local-remote-execution//libc:glibc"],
     exec_properties = {
         # tag is from nix eval .#packages.aarch64-linux.nativelink-worker-lre-rs.imageTag
-        "container-image": "ghcr.io/tracemachina/nativelink-worker-lre-rs:8h9253qs3c1dcz80xjdj352b66ksm58c",
+        "container-image": "ghcr.io/tracemachina/nativelink-worker-lre-rs:1w6zash4shai1sknzvbbspr2gxs90q5a",
     },
     parents = ["@local-remote-execution//platforms:aarch64-linux"],
 )
@@ -43,7 +43,7 @@ platform(
     constraint_values = ["@local-remote-execution//libc:musl"],
     exec_properties = {
         # tag is from nix eval .#packages.aarch64-linux.nativelink-worker-lre-rs.imageTag
-        "container-image": "ghcr.io/tracemachina/nativelink-worker-lre-rs:8h9253qs3c1dcz80xjdj352b66ksm58c",
+        "container-image": "ghcr.io/tracemachina/nativelink-worker-lre-rs:1w6zash4shai1sknzvbbspr2gxs90q5a",
     },
     parents = ["@local-remote-execution//platforms:aarch64-linux"],
 )
@@ -62,7 +62,7 @@ platform(
     constraint_values = ["@local-remote-execution//libc:glibc"],
     exec_properties = {
         # tag is from nix eval .#packages.x86_64-linux.nativelink-worker-lre-rs.imageTag
-        "container-image": "ghcr.io/tracemachina/nativelink-worker-lre-rs:l9azdnlsva9az170z9l61ph78xpcxjbw",
+        "container-image": "ghcr.io/tracemachina/nativelink-worker-lre-rs:w0wry4676g4m65kn3lk4ps3glv05z8mc",
     },
     parents = ["@local-remote-execution//platforms:x86_64-linux"],
 )
@@ -72,7 +72,7 @@ platform(
     constraint_values = ["@local-remote-execution//libc:musl"],
     exec_properties = {
         # tag is from nix eval .#packages.x86_64-linux.nativelink-worker-lre-rs.imageTag
-        "container-image": "ghcr.io/tracemachina/nativelink-worker-lre-rs:l9azdnlsva9az170z9l61ph78xpcxjbw",
+        "container-image": "ghcr.io/tracemachina/nativelink-worker-lre-rs:w0wry4676g4m65kn3lk4ps3glv05z8mc",
     },
     parents = ["@local-remote-execution//platforms:x86_64-linux"],
 )
diff --git a/local-remote-execution/rust/x86_64-linux.BUILD.bazel b/local-remote-execution/rust/x86_64-linux.BUILD.bazel
index 0e6aae951..0d5fe3402 100644
--- a/local-remote-execution/rust/x86_64-linux.BUILD.bazel
+++ b/local-remote-execution/rust/x86_64-linux.BUILD.bazel
@@ -39,15 +39,6 @@ load("@rules_rust//rust:toolchain.bzl", "rust_stdlib_filegroup")
 filegroup(
     name = "rustc_lib",
     srcs = select({
-        "@local-remote-execution//rust/triple:aarch64-unknown-linux-gnu": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/aarch64-unknown-linux-gnu/codegen-backends/*.so",
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.so",
-            ] + ["lib/rustlib/aarch64-unknown-linux-gnu/bin/rust-lld"],
-            allow_empty = True,
-        ),
         "@local-remote-execution//rust/triple:aarch64-unknown-linux-musl": glob(
             [
                 "bin/*.so",
@@ -57,15 +48,6 @@ filegroup(
             ] + ["lib/rustlib/aarch64-unknown-linux-musl/bin/rust-lld"],
             allow_empty = True,
         ),
-        "@local-remote-execution//rust/triple:x86_64-unknown-linux-gnu": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/*.so",
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.so",
-            ] + ["lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld"],
-            allow_empty = True,
-        ),
         "@local-remote-execution//rust/triple:x86_64-unknown-linux-musl": glob(
             [
                 "bin/*.so",
@@ -82,15 +64,6 @@ filegroup(
 rust_stdlib_filegroup(
     name = "rust_std",
     srcs = select({
-        "@local-remote-execution//rust/triple:aarch64-unknown-linux-gnu": glob(
-            [
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.rlib",
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.so",
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.a",
-            ],
-            allow_empty = True,
-        ),
         "@local-remote-execution//rust/triple:aarch64-unknown-linux-musl": glob(
             [
                 "lib/rustlib/aarch64-unknown-linux-musl/lib/*.rlib",
@@ -101,15 +74,6 @@ rust_stdlib_filegroup(
             ],
             allow_empty = True,
         ),
-        "@local-remote-execution//rust/triple:x86_64-unknown-linux-gnu": glob(
-            [
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.rlib",
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.so",
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.a",
-            ],
-            allow_empty = True,
-        ),
         "@local-remote-execution//rust/triple:x86_64-unknown-linux-musl": glob(
             [
                 "lib/rustlib/x86_64-unknown-linux-musl/lib/*.rlib",