Refactor the Makefile to avoid recursive Make.

Recursive make is difficult to follow and debug. Drop this by using
internal functions, which, while difficult, are easier than trying to
following recursive invokations.

Further simplify the Makefile by collapsing the image bits and removing
the tools/vm directory, which is effectively unused.

Fixes #4952

PiperOrigin-RevId: 346569133

14 files changed, 0 insertions, 915 deletions

diff --git a/tools/vm/BUILD b/tools/vm/BUILD
deleted file mode 100644
index d95ca6c63..000000000
--- a/tools/vm/BUILD
+++ /dev/null
@@ -1,63 +0,0 @@
-load("//tools:defs.bzl", "bzl_library", "cc_binary", "gtest")
-load("//tools/vm:defs.bzl", "vm_image", "vm_test")
-
-package(
-    default_visibility = ["//:sandbox"],
-    licenses = ["notice"],
-)
-
-sh_binary(
-    name = "zone",
-    srcs = ["zone.sh"],
-)
-
-sh_binary(
-    name = "builder",
-    srcs = ["build.sh"],
-)
-
-sh_binary(
-    name = "executer",
-    srcs = ["execute.sh"],
-)
-
-cc_binary(
-    name = "test",
-    testonly = 1,
-    srcs = ["test.cc"],
-    linkstatic = 1,
-    deps = [
-        gtest,
-        "//test/util:test_main",
-    ],
-)
-
-vm_image(
-    name = "ubuntu1604",
-    family = "ubuntu-1604-lts",
-    project = "ubuntu-os-cloud",
-    scripts = [
-        "//tools/vm/ubuntu1604",
-    ],
-)
-
-vm_image(
-    name = "ubuntu1804",
-    family = "ubuntu-1804-lts",
-    project = "ubuntu-os-cloud",
-    scripts = [
-        "//tools/vm/ubuntu1804",
-    ],
-)
-
-vm_test(
-    name = "vm_test",
-    shard_count = 2,
-    targets = [":test"],
-)
-
-bzl_library(
-    name = "defs_bzl",
-    srcs = ["defs.bzl"],
-    visibility = ["//visibility:private"],
-)
diff --git a/tools/vm/README.md b/tools/vm/README.md
deleted file mode 100644
index 1e9859e66..000000000
--- a/tools/vm/README.md
+++ /dev/null
@@ -1,48 +0,0 @@
-# VM Images & Tests
-
-All commands in this directory require the `gcloud` project to be set.
-
-For example: `gcloud config set project gvisor-kokoro-testing`.
-
-Images can be generated by using the `vm_image` rule. This rule will generate a
-binary target that builds an image in an idempotent way, and can be referenced
-from other rules.
-
-For example:
-
-```
-vm_image(
-    name = "ubuntu",
-    project = "ubuntu-1604-lts",
-    family = "ubuntu-os-cloud",
-    scripts = [
-        "script.sh",
-        "other.sh",
-    ],
-)
-```
-
-These images can be built manually by executing the target. The output on
-`stdout` will be the image id (in the current project).
-
-For example:
-
-```
-$ bazel build :ubuntu
-```
-
-Images are always named per the hash of all the hermetic input scripts. This
-allows images to be memoized quickly and easily.
-
-The `vm_test` rule can be used to execute a command remotely. This is still
-under development however, and will likely change over time.
-
-For example:
-
-```
-vm_test(
-    name = "mycommand",
-    image = ":ubuntu",
-    targets = [":test"],
-)
-```
diff --git a/tools/vm/build.sh b/tools/vm/build.sh
deleted file mode 100755
index 752b2b77b..000000000
--- a/tools/vm/build.sh
+++ /dev/null
@@ -1,117 +0,0 @@
-#!/bin/bash
-
-# Copyright 2019 The gVisor Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# This script is responsible for building a new GCP image that: 1) has nested
-# virtualization enabled, and 2) has been completely set up with the
-# image_setup.sh script. This script should be idempotent, as we memoize the
-# setup script with a hash and check for that name.
-
-set -eou pipefail
-
-# Parameters.
-declare -r USERNAME=${USERNAME:-test}
-declare -r IMAGE_PROJECT=${IMAGE_PROJECT:-ubuntu-os-cloud}
-declare -r IMAGE_FAMILY=${IMAGE_FAMILY:-ubuntu-1604-lts}
-declare -r ZONE=${ZONE:-us-central1-f}
-
-# Random names.
-declare -r DISK_NAME=$(mktemp -u disk-XXXXXX | tr A-Z a-z)
-declare -r SNAPSHOT_NAME=$(mktemp -u snapshot-XXXXXX | tr A-Z a-z)
-declare -r INSTANCE_NAME=$(mktemp -u build-XXXXXX | tr A-Z a-z)
-
-# Hash inputs in order to memoize the produced image.
-declare -r SETUP_HASH=$( (echo ${USERNAME} ${IMAGE_PROJECT} ${IMAGE_FAMILY} && cat "$@") | sha256sum - | cut -d' ' -f1 | cut -c 1-16)
-declare -r IMAGE_NAME=${IMAGE_FAMILY:-image}-${SETUP_HASH}
-
-# Does the image already exist? Skip the build.
-declare -r existing=$(set -x; gcloud compute images list --filter="name=(${IMAGE_NAME})" --format="value(name)")
-if ! [[ -z "${existing}" ]]; then
-  echo "${existing}"
-  exit 0
-fi
-
-# Standard arguments (applies only on script execution).
-declare -ar SSH_ARGS=("-o" "ConnectTimeout=60" "--")
-
-# gcloud has path errors; is this a result of being a genrule?
-export PATH=${PATH:-/bin:/usr/bin:/usr/local/bin}
-
-# Start a unique instance. Note that this instance will have a unique persistent
-# disk as it's boot disk with the same name as the instance.
-(set -x; gcloud compute instances create \
-    --quiet \
-    --image-project "${IMAGE_PROJECT}" \
-    --image-family "${IMAGE_FAMILY}" \
-    --boot-disk-size "200GB" \
-    --zone "${ZONE}" \
-    "${INSTANCE_NAME}" >/dev/null)
-function cleanup {
-  (set -x; gcloud compute instances delete --quiet --zone "${ZONE}" "${INSTANCE_NAME}")
-}
-trap cleanup EXIT
-
-# Wait for the instance to become available (up to 5 minutes).
-echo -n "Waiting for ${INSTANCE_NAME}" >&2
-declare timeout=300
-declare success=0
-declare internal=""
-declare -r start=$(date +%s)
-declare -r end=$((${start}+${timeout}))
-while [[ "$(date +%s)" -lt "${end}" ]] && [[ "${success}" -lt 3 ]]; do
-  echo -n "." >&2
-  if gcloud compute ssh --zone "${ZONE}" "${USERNAME}"@"${INSTANCE_NAME}" -- true 2>/dev/null; then
-    success=$((${success}+1))
-  elif gcloud compute ssh --internal-ip --zone "${ZONE}" "${USERNAME}"@"${INSTANCE_NAME}" -- true 2>/dev/null; then
-    success=$((${success}+1))
-    internal="--internal-ip"
-  fi
-done
-
-if [[ "${success}" -eq "0" ]]; then
-  echo "connect timed out after ${timeout} seconds." >&2
-  exit 1
-else
-  echo "done." >&2
-fi
-
-# Run the install scripts provided.
-for arg; do
-  (set -x; gcloud compute ssh ${internal} \
-      --zone "${ZONE}" \
-      "${USERNAME}"@"${INSTANCE_NAME}" -- \
-      "${SSH_ARGS[@]}" \
-      sudo bash - <"${arg}" >/dev/null)
-done
-
-# Stop the instance; required before creating an image.
-(set -x; gcloud compute instances stop --quiet --zone "${ZONE}" "${INSTANCE_NAME}" >/dev/null)
-
-# Create a snapshot of the instance disk.
-(set -x; gcloud compute disks snapshot \
-    --quiet \
-    --zone "${ZONE}" \
-    --snapshot-names="${SNAPSHOT_NAME}" \
-    "${INSTANCE_NAME}" >/dev/null)
-
-# Create the disk image.
-(set -x; gcloud compute images create \
-    --quiet \
-    --source-snapshot="${SNAPSHOT_NAME}" \
-    --licenses="https://www.googleapis.com/compute/v1/projects/vm-options/global/licenses/enable-vmx" \
-    "${IMAGE_NAME}" >/dev/null)
-
-# Finish up.
-echo "${IMAGE_NAME}"
diff --git a/tools/vm/defs.bzl b/tools/vm/defs.bzl
deleted file mode 100644
index 9af5ad3b4..000000000
--- a/tools/vm/defs.bzl
+++ /dev/null
@@ -1,202 +0,0 @@
-"""Image configuration. See README.md."""
-
-load("//tools:defs.bzl", "default_installer")
-
-# vm_image_builder is a rule that will construct a shell script that actually
-# generates a given VM image. Note that this does not _run_ the shell script
-# (although it can be run manually). It will be run manually during generation
-# of the vm_image target itself. This level of indirection is used so that the
-# build system itself only runs the builder once when multiple targets depend
-# on it, avoiding a set of races and conflicts.
-def _vm_image_builder_impl(ctx):
-    # Generate a binary that actually builds the image.
-    builder = ctx.actions.declare_file(ctx.label.name)
-    script_paths = []
-    for script in ctx.files.scripts:
-        script_paths.append(script.short_path)
-    builder_content = "\n".join([
-        "#!/bin/bash",
-        "export ZONE=$(%s)" % ctx.files.zone[0].short_path,
-        "export USERNAME=%s" % ctx.attr.username,
-        "export IMAGE_PROJECT=%s" % ctx.attr.project,
-        "export IMAGE_FAMILY=%s" % ctx.attr.family,
-        "%s %s" % (ctx.files._builder[0].short_path, " ".join(script_paths)),
-        "",
-    ])
-    ctx.actions.write(builder, builder_content, is_executable = True)
-
-    # Note that the scripts should only be files, and should not include any
-    # indirect transitive dependencies. The build script wouldn't work.
-    return [DefaultInfo(
-        executable = builder,
-        runfiles = ctx.runfiles(
-            files = ctx.files.scripts + ctx.files._builder + ctx.files.zone,
-        ),
-    )]
-
-vm_image_builder = rule(
-    attrs = {
-        "_builder": attr.label(
-            executable = True,
-            default = "//tools/vm:builder",
-            cfg = "host",
-        ),
-        "username": attr.string(default = "$(whoami)"),
-        "zone": attr.label(
-            executable = True,
-            default = "//tools/vm:zone",
-            cfg = "host",
-        ),
-        "family": attr.string(mandatory = True),
-        "project": attr.string(mandatory = True),
-        "scripts": attr.label_list(allow_files = True),
-    },
-    executable = True,
-    implementation = _vm_image_builder_impl,
-)
-
-# See vm_image_builder above.
-def _vm_image_impl(ctx):
-    # Run the builder to generate our output.
-    echo = ctx.actions.declare_file(ctx.label.name)
-    resolved_inputs, argv, runfiles_manifests = ctx.resolve_command(
-        command = "\n".join([
-            "set -e",
-            "image=$(%s)" % ctx.files.builder[0].path,
-            "echo -ne \"#!/bin/bash\\necho ${image}\\n\" > %s" % echo.path,
-            "chmod 0755 %s" % echo.path,
-        ]),
-        tools = [ctx.attr.builder],
-    )
-    ctx.actions.run_shell(
-        tools = resolved_inputs,
-        outputs = [echo],
-        progress_message = "Building image...",
-        execution_requirements = {"local": "true"},
-        command = argv,
-        input_manifests = runfiles_manifests,
-    )
-
-    # Return just the echo command. All of the builder runfiles have been
-    # resolved and consumed in the generation of the trivial echo script.
-    return [DefaultInfo(executable = echo)]
-
-_vm_image_test = rule(
-    attrs = {
-        "builder": attr.label(
-            executable = True,
-            cfg = "host",
-        ),
-    },
-    test = True,
-    implementation = _vm_image_impl,
-)
-
-def vm_image(name, **kwargs):
-    vm_image_builder(
-        name = name + "_builder",
-        **kwargs
-    )
-    _vm_image_test(
-        name = name,
-        builder = ":" + name + "_builder",
-        tags = [
-            "local",
-            "manual",
-        ],
-    )
-
-def _vm_test_impl(ctx):
-    runner = ctx.actions.declare_file("%s-executer" % ctx.label.name)
-
-    # Note that the remote execution case must actually generate an
-    # intermediate target in order to collect all the relevant runfiles so that
-    # they can be copied over for remote execution.
-    runner_content = "\n".join([
-        "#!/bin/bash",
-        "export ZONE=$(%s)" % ctx.files.zone[0].short_path,
-        "export USERNAME=%s" % ctx.attr.username,
-        "export IMAGE=$(%s)" % ctx.files.image[0].short_path,
-        "export SUDO=%s" % "true" if ctx.attr.sudo else "false",
-        "%s %s" % (
-            ctx.executable.executer.short_path,
-            " ".join([
-                target.files_to_run.executable.short_path
-                for target in ctx.attr.targets
-            ]),
-        ),
-        "",
-    ])
-    ctx.actions.write(runner, runner_content, is_executable = True)
-
-    # Return with all transitive files.
-    runfiles = ctx.runfiles(
-        transitive_files = depset(transitive = [
-            depset(target.data_runfiles.files)
-            for target in ctx.attr.targets
-            if hasattr(target, "data_runfiles")
-        ]),
-        files = ctx.files.executer + ctx.files.zone + ctx.files.image +
-                ctx.files.targets,
-        collect_default = True,
-        collect_data = True,
-    )
-    return [DefaultInfo(executable = runner, runfiles = runfiles)]
-
-_vm_test = rule(
-    attrs = {
-        "image": attr.label(
-            executable = True,
-            default = "//tools/vm:ubuntu1804",
-            cfg = "host",
-        ),
-        "executer": attr.label(
-            executable = True,
-            default = "//tools/vm:executer",
-            cfg = "host",
-        ),
-        "username": attr.string(default = "$(whoami)"),
-        "zone": attr.label(
-            executable = True,
-            default = "//tools/vm:zone",
-            cfg = "host",
-        ),
-        "sudo": attr.bool(default = True),
-        "machine": attr.string(default = "n1-standard-1"),
-        "targets": attr.label_list(
-            mandatory = True,
-            allow_empty = False,
-            cfg = "target",
-        ),
-    },
-    test = True,
-    implementation = _vm_test_impl,
-)
-
-def vm_test(
-        installers = None,
-        **kwargs):
-    """Runs the given targets as a remote test.
-
-    Args:
-      installer: Script to run before all targets.
-      **kwargs: All test arguments. Should include targets and image.
-    """
-    targets = kwargs.pop("targets", [])
-    if installers == None:
-        installers = [
-            "//tools/installers:head",
-            "//tools/installers:images",
-        ]
-    targets = installers + targets
-    if default_installer():
-        targets = [default_installer()] + targets
-    _vm_test(
-        tags = [
-            "local",
-            "manual",
-        ],
-        targets = targets,
-        local = 1,
-        **kwargs
-    )
diff --git a/tools/vm/execute.sh b/tools/vm/execute.sh
deleted file mode 100755
index 1f1f3ce01..000000000
--- a/tools/vm/execute.sh
+++ /dev/null
@@ -1,160 +0,0 @@
-#!/bin/bash
-
-# Copyright 2019 The gVisor Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-set -xeo pipefail
-
-# Required input.
-if ! [[ -v IMAGE ]]; then
-  echo "no image provided: set IMAGE."
-  exit 1
-fi
-
-# Parameters.
-declare -r USERNAME=${USERNAME:-test}
-declare -r KEYNAME=$(mktemp --tmpdir -u key-XXXXXX)
-declare -r SSHKEYS=$(mktemp --tmpdir -u sshkeys-XXXXXX)
-declare -r INSTANCE_NAME=$(mktemp -u test-XXXXXX | tr A-Z a-z)
-declare -r MACHINE=${MACHINE:-n1-standard-1}
-declare -r ZONE=${ZONE:-us-central1-f}
-declare -r SUDO=${SUDO:-false}
-
-# Standard arguments (applies only on script execution).
-declare -ar SSH_ARGS=("-o" "ConnectTimeout=60" "--")
-
-# This script is executed as a test rule, which will reset the value of HOME.
-# Unfortunately, it is needed to load the gconfig credentials. We will reset
-# HOME when we actually execute in the remote environment, defined below.
-export HOME=$(eval echo ~$(whoami))
-
-# Generate unique keys for this test.
-[[ -f "${KEYNAME}" ]] || ssh-keygen -t rsa -N "" -f "${KEYNAME}" -C "${USERNAME}"
-cat > "${SSHKEYS}" <<EOF
-${USERNAME}:$(cat ${KEYNAME}.pub)
-EOF
-
-# Start a unique instance. This means that we first generate a unique set of ssh
-# keys to ensure that only we have access to this instance. Note that we must
-# constrain ourselves to Haswell or greater in order to have nested
-# virtualization available.
-gcloud compute instances create \
-    --min-cpu-platform "Intel Haswell" \
-    --preemptible \
-    --no-scopes \
-    --metadata block-project-ssh-keys=TRUE \
-    --metadata-from-file ssh-keys="${SSHKEYS}" \
-    --machine-type "${MACHINE}" \
-    --image "${IMAGE}" \
-    --zone "${ZONE}" \
-    "${INSTANCE_NAME}"
-function cleanup {
-    gcloud compute instances delete --quiet --zone "${ZONE}" "${INSTANCE_NAME}"
-}
-trap cleanup EXIT
-
-# Wait for the instance to become available (up to 5 minutes).
-declare timeout=300
-declare success=0
-declare -r start=$(date +%s)
-declare -r end=$((${start}+${timeout}))
-while [[ "$(date +%s)" -lt "${end}" ]] && [[ "${success}" -lt 3 ]]; do
-  if gcloud compute ssh --ssh-key-file="${KEYNAME}" --zone "${ZONE}" "${USERNAME}"@"${INSTANCE_NAME}" -- true 2>/dev/null; then
-    success=$((${success}+1))
-  fi
-done
-if [[ "${success}" -eq "0" ]]; then
-  echo "connect timed out after ${timeout} seconds."
-  exit 1
-fi
-
-# Copy the local directory over.
-tar czf - --dereference --exclude=.git . |
-    gcloud compute ssh \
-        --ssh-key-file="${KEYNAME}" \
-        --zone "${ZONE}" \
-        "${USERNAME}"@"${INSTANCE_NAME}" -- \
-        "${SSH_ARGS[@]}" \
-        tar xzf -
-
-# Execute the command remotely.
-for cmd; do
-  # Setup relevant environment.
-  #
-  # N.B. This is not a complete test environment, but is complete enough to
-  # provide rudimentary sharding and test output support.
-  declare -a PREFIX=( "env" )
-  if [[ -v TEST_SHARD_INDEX ]]; then
-    PREFIX+=( "TEST_SHARD_INDEX=${TEST_SHARD_INDEX}" )
-  fi
-  if [[ -v TEST_SHARD_STATUS_FILE ]]; then
-    SHARD_STATUS_FILE=$(mktemp -u test-shard-status-XXXXXX)
-    PREFIX+=( "TEST_SHARD_STATUS_FILE=/tmp/${SHARD_STATUS_FILE}" )
-  fi
-  if [[ -v TEST_TOTAL_SHARDS ]]; then
-    PREFIX+=( "TEST_TOTAL_SHARDS=${TEST_TOTAL_SHARDS}" )
-  fi
-  if [[ -v TEST_TMPDIR ]]; then
-    REMOTE_TMPDIR=$(mktemp -u test-XXXXXX)
-    PREFIX+=( "TEST_TMPDIR=/tmp/${REMOTE_TMPDIR}" )
-    # Create remotely.
-    gcloud compute ssh \
-      --ssh-key-file="${KEYNAME}" \
-      --zone "${ZONE}" \
-      "${USERNAME}"@"${INSTANCE_NAME}" -- \
-      "${SSH_ARGS[@]}" \
-      mkdir -p "/tmp/${REMOTE_TMPDIR}"
-  fi
-  if [[ -v XML_OUTPUT_FILE ]]; then
-    TEST_XML_OUTPUT=$(mktemp -u xml-output-XXXXXX)
-    PREFIX+=( "XML_OUTPUT_FILE=/tmp/${TEST_XML_OUTPUT}" )
-  fi
-  if [[ "${SUDO}" == "true" ]]; then
-    PREFIX+=( "sudo" "-E" )
-  fi
-
-  # Execute the command.
-  gcloud compute ssh \
-    --ssh-key-file="${KEYNAME}" \
-    --zone "${ZONE}" \
-    "${USERNAME}"@"${INSTANCE_NAME}" -- \
-    "${SSH_ARGS[@]}" \
-    "${PREFIX[@]}" "${cmd}"
-
-  # Collect relevant results.
-  if [[ -v TEST_SHARD_STATUS_FILE ]]; then
-    gcloud compute scp \
-        --ssh-key-file="${KEYNAME}" \
-        --zone "${ZONE}" \
-        "${USERNAME}"@"${INSTANCE_NAME}":/tmp/"${SHARD_STATUS_FILE}" \
-        "${TEST_SHARD_STATUS_FILE}" 2>/dev/null || true # Allowed to fail.
-  fi
-  if [[ -v XML_OUTPUT_FILE ]]; then
-    gcloud compute scp \
-        --ssh-key-file="${KEYNAME}" \
-        --zone "${ZONE}" \
-        "${USERNAME}"@"${INSTANCE_NAME}":/tmp/"${TEST_XML_OUTPUT}" \
-        "${XML_OUTPUT_FILE}" 2>/dev/null || true # Allowed to fail.
-  fi
-
-  # Clean up the temporary directory.
-  if [[ -v TEST_TMPDIR ]]; then
-    gcloud compute ssh \
-      --ssh-key-file="${KEYNAME}" \
-      --zone "${ZONE}" \
-      "${USERNAME}"@"${INSTANCE_NAME}" -- \
-      "${SSH_ARGS[@]}" \
-      rm -rf "/tmp/${REMOTE_TMPDIR}"
-  fi
-done
diff --git a/tools/vm/test.cc b/tools/vm/test.cc
deleted file mode 100644
index c0ceacda1..000000000
--- a/tools/vm/test.cc
+++ /dev/null
@@ -1,27 +0,0 @@
-// Copyright 2020 The gVisor Authors.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "gtest/gtest.h"
-
-namespace {
-
-TEST(Image, Sanity0) {
-  // Do nothing (in shard 0).
-}
-
-TEST(Image, Sanity1) {
-  // Do nothing (in shard 1).
-}
-
-}  // namespace
diff --git a/tools/vm/ubuntu1604/10_core.sh b/tools/vm/ubuntu1604/10_core.sh
deleted file mode 100755
index 629f7cf7a..000000000
--- a/tools/vm/ubuntu1604/10_core.sh
+++ /dev/null
@@ -1,43 +0,0 @@
-#!/bin/bash
-
-# Copyright 2019 The gVisor Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-set -xeo pipefail
-
-# Install all essential build tools.
-while true; do
-  if (apt-get update && apt-get install -y \
-      make \
-      git-core \
-      build-essential \
-      linux-headers-$(uname -r) \
-      pkg-config); then
-    break
-  fi
-  result=$?
-  if [[ $result -ne 100 ]]; then
-    exit $result
-  fi
-done
-
-# Install a recent go toolchain.
-if ! [[ -d /usr/local/go ]]; then
-    wget https://dl.google.com/go/go1.13.5.linux-amd64.tar.gz
-    tar -xvf go1.13.5.linux-amd64.tar.gz
-    mv go /usr/local
-fi
-
-# Link the Go binary from /usr/bin; replacing anything there.
-(cd /usr/bin && rm -f go && ln -fs /usr/local/go/bin/go go)
diff --git a/tools/vm/ubuntu1604/15_gcloud.sh b/tools/vm/ubuntu1604/15_gcloud.sh
deleted file mode 100755
index bc2e5eccc..000000000
--- a/tools/vm/ubuntu1604/15_gcloud.sh
+++ /dev/null
@@ -1,50 +0,0 @@
-#!/bin/bash
-
-# Copyright 2019 The gVisor Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-set -xeo pipefail
-
-# Install all essential build tools.
-while true; do
-  if (apt-get update && apt-get install -y \
-      apt-transport-https \
-      ca-certificates \
-      gnupg); then
-    break
-  fi
-  result=$?
-  if [[ $result -ne 100 ]]; then
-    exit $result
-  fi
-done
-
-# Add gcloud repositories.
-echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | \
-  tee -a /etc/apt/sources.list.d/google-cloud-sdk.list
-
-# Add the appropriate key.
-curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | \
-  apt-key --keyring /usr/share/keyrings/cloud.google.gpg add -
-
-# Install the gcloud SDK.
-while true; do
-  if (apt-get update && apt-get install -y google-cloud-sdk); then
-    break
-  fi
-  result=$?
-  if [[ $result -ne 100 ]]; then
-    exit $result
-  fi
-done
diff --git a/tools/vm/ubuntu1604/20_bazel.sh b/tools/vm/ubuntu1604/20_bazel.sh
deleted file mode 100755
index bb7afa676..000000000
--- a/tools/vm/ubuntu1604/20_bazel.sh
+++ /dev/null
@@ -1,38 +0,0 @@
-#!/bin/bash
-
-# Copyright 2019 The gVisor Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-set -xeo pipefail
-
-declare -r BAZEL_VERSION=2.0.0
-
-# Install bazel dependencies.
-while true; do
-  if (apt-get update && apt-get install -y \
-      openjdk-8-jdk-headless \
-      unzip); then
-    break
-  fi
-  result=$?
-  if [[ $result -ne 100 ]]; then
-    exit $result
-  fi
-done
-
-# Use the release installer.
-curl -L -o bazel-${BAZEL_VERSION}-installer-linux-x86_64.sh https://github.com/bazelbuild/bazel/releases/download/${BAZEL_VERSION}/bazel-${BAZEL_VERSION}-installer-linux-x86_64.sh
-chmod a+x bazel-${BAZEL_VERSION}-installer-linux-x86_64.sh
-./bazel-${BAZEL_VERSION}-installer-linux-x86_64.sh
-rm -f bazel-${BAZEL_VERSION}-installer-linux-x86_64.sh
diff --git a/tools/vm/ubuntu1604/30_docker.sh b/tools/vm/ubuntu1604/30_docker.sh
deleted file mode 100755
index d393133e4..000000000
--- a/tools/vm/ubuntu1604/30_docker.sh
+++ /dev/null
@@ -1,64 +0,0 @@
-#!/bin/bash
-
-# Copyright 2019 The gVisor Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Add dependencies.
-while true; do
-  if (apt-get update && apt-get install -y \
-      apt-transport-https \
-      ca-certificates \
-      curl \
-      gnupg-agent \
-      software-properties-common); then
-    break
-  fi
-  result=$?
-  if [[ $result -ne 100 ]]; then
-    exit $result
-  fi
-done
-
-# Install the key.
-curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add -
-
-# Add the repository.
-add-apt-repository \
-   "deb [arch=amd64] https://download.docker.com/linux/ubuntu \
-   $(lsb_release -cs) \
-   stable"
-
-# Install docker.
-while true; do
-  if (apt-get update && apt-get install -y \
-      docker-ce \
-      docker-ce-cli \
-      containerd.io); then
-    break
-  fi
-  result=$?
-  if [[ $result -ne 100 ]]; then
-    exit $result
-  fi
-done
-
-# Enable experimental features, for cross-building aarch64 images.
-# Enable Docker IPv6.
-cat > /etc/docker/daemon.json <<EOF
-{
-    "experimental": true,
-    "fixed-cidr-v6": "2001:db8:1::/64",
-    "ipv6": true
-}
-EOF
diff --git a/tools/vm/ubuntu1604/40_kokoro.sh b/tools/vm/ubuntu1604/40_kokoro.sh
deleted file mode 100755
index d3b96c9ad..000000000
--- a/tools/vm/ubuntu1604/40_kokoro.sh
+++ /dev/null
@@ -1,72 +0,0 @@
-#!/bin/bash
-
-# Copyright 2019 The gVisor Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-set -xeo pipefail
-
-# Declare kokoro's required public keys.
-declare -r ssh_public_keys=(
-    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDg7L/ZaEauETWrPklUTky3kvxqQfe2Ax/2CsSqhNIGNMnK/8d79CHlmY9+dE1FFQ/RzKNCaltgy7XcN/fCYiCZr5jm2ZtnLuGNOTzupMNhaYiPL419qmL+5rZXt4/dWTrsHbFRACxT8j51PcRMO5wgbL0Bg2XXimbx8kDFaurL2gqduQYqlu4lxWCaJqOL71WogcimeL63Nq/yeH5PJPWpqE4P9VUQSwAzBWFK/hLeds/AiP3MgVS65qHBnhq0JsHy8JQsqjZbG7Iidt/Ll0+gqzEbi62gDIcczG4KC0iOVzDDP/1BxDtt1lKeA23ll769Fcm3rJyoBMYxjvdw1TDx sabujp@trigger.mtv.corp.google.com"
-    "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNgGK/hCdjmulHfRE3hp4rZs38NCR8yAh0eDsztxqGcuXnuSnL7jOlRrbcQpremJ84omD4eKrIpwJUs+YokMdv4= sabujp@trigger.svl.corp.google.com"
-)
-
-# Install dependencies.
-while true; do
-  if (apt-get update && apt-get install -y \
-      rsync \
-      coreutils \
-      python-psutil \
-      qemu-kvm \
-      python-pip \
-      python3-pip \
-      zip); then
-    break
-  fi
-  result=$?
-  if [[ $result -ne 100 ]]; then
-    exit $result
-  fi
-done
-
-# junitparser is used to merge junit xml files.
-pip install --no-cache-dir junitparser
-
-# We need a kbuilder user, which may already exist.
-useradd -c "kbuilder user" -m -s /bin/bash kbuilder || true
-
-# We need to provision appropriate keys.
-mkdir -p ~kbuilder/.ssh
-(IFS=$'\n'; echo "${ssh_public_keys[*]}") > ~kbuilder/.ssh/authorized_keys
-chmod 0600 ~kbuilder/.ssh/authorized_keys
-chown -R kbuilder ~kbuilder/.ssh
-
-# Give passwordless sudo access.
-cat > /etc/sudoers.d/kokoro <<EOF
-kbuilder ALL=(ALL) NOPASSWD:ALL
-EOF
-
-# Ensure we can run Docker without sudo.
-usermod -aG docker kbuilder
-
-# Ensure that we can access kvm.
-usermod -aG kvm kbuilder
-
-# Ensure that /tmpfs exists and is writable by kokoro.
-#
-# Note that kokoro will typically attach a second disk (sdb) to the instance
-# that is used for the /tmpfs volume. In the future we could setup an init
-# script that formats and mounts this here; however, we don't expect our build
-# artifacts to be that large.
-mkdir -p /tmpfs && chmod 0777 /tmpfs && touch /tmpfs/READY
diff --git a/tools/vm/ubuntu1604/BUILD b/tools/vm/ubuntu1604/BUILD
deleted file mode 100644
index ab1df0c4c..000000000
--- a/tools/vm/ubuntu1604/BUILD
+++ /dev/null
@@ -1,7 +0,0 @@
-package(licenses = ["notice"])
-
-filegroup(
-    name = "ubuntu1604",
-    srcs = glob(["*.sh"]),
-    visibility = ["//:sandbox"],
-)
diff --git a/tools/vm/ubuntu1804/BUILD b/tools/vm/ubuntu1804/BUILD
deleted file mode 100644
index 0c8856dde..000000000
--- a/tools/vm/ubuntu1804/BUILD
+++ /dev/null
@@ -1,7 +0,0 @@
-package(licenses = ["notice"])
-
-alias(
-    name = "ubuntu1804",
-    actual = "//tools/vm/ubuntu1604",
-    visibility = ["//:sandbox"],
-)
diff --git a/tools/vm/zone.sh b/tools/vm/zone.sh
deleted file mode 100755
index 79569fb19..000000000
--- a/tools/vm/zone.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/bin/bash
-
-# Copyright 2020 The gVisor Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-exec gcloud config get-value compute/zone