diff --git a/tools/ngcontainer/Dockerfile b/tools/ngcontainer/Dockerfile
new file mode 100644
index 0000000000..69828df569
--- /dev/null
+++ b/tools/ngcontainer/Dockerfile
@@ -0,0 +1,77 @@
+FROM circleci/node:8.9.2-browsers
+
+USER root
+
+###
+# Java install
+# See https://github.com/docker-library/openjdk/blob/415b0cc42d91ef5d70597d8a24d942967728242b/8-jdk/Dockerfile
+# see https://bugs.debian.org/775775
+# and https://github.com/docker-library/java/issues/19#issuecomment-70546872
+RUN JAVA_DEBIAN_VERSION="8u131-b11-1~bpo8+1" \
+ && CA_CERTIFICATES_JAVA_VERSION="20161107~bpo8+1" \
+ && echo 'deb http://deb.debian.org/debian jessie-backports main' > /etc/apt/sources.list.d/jessie-backports.list \
+ && apt-get update \
+ && apt-get install -y \
+    openjdk-8-jre-headless="$JAVA_DEBIAN_VERSION" \
+    ca-certificates-java="$CA_CERTIFICATES_JAVA_VERSION" \
+ && rm -rf /var/lib/apt/lists/*
+
+###
+# Bazel install
+# See https://bazel.build/versions/master/docs/install-ubuntu.html#using-bazel-custom-apt-repository-recommended
+RUN BAZEL_VERSION="0.11.1" \
+ && wget -q -O - https://bazel.build/bazel-release.pub.gpg | apt-key add - \
+ && echo "deb [arch=amd64] http://storage.googleapis.com/bazel-apt stable jdk1.8" > /etc/apt/sources.list.d/bazel.list \
+ && apt-get update \
+ && apt-get install -y bazel=$BAZEL_VERSION \
+ && rm -rf /var/lib/apt/lists/*
+
+###
+# Brotli compression
+# Not available on backports so we have to pull from Debian 9
+# See https://packages.debian.org/search?keywords=brotli
+RUN echo "deb http://deb.debian.org/debian stretch main contrib" > /etc/apt/sources.list.d/stretch.list \
+ && apt-get update \
+ && apt-get install -y --no-install-recommends brotli/stretch
+
+###
+# Buildifier
+# BUILD file formatter
+# 'bazel clean --expunge' conserves size of the image
+RUN git clone https://github.com/bazelbuild/buildtools.git \
+ && (cd buildtools \
+  && bazel build //buildifier \
+  && cp bazel-bin/buildifier/linux_amd64_stripped/buildifier /usr/local/bin/ \
+  && bazel clean --expunge \
+  ) && rm -rf buildtools
+
+###
+# Skylint
+# .bzl file linter
+# Follows readme at https://github.com/bazelbuild/bazel/blob/master/site/docs/skylark/skylint.md#building-the-linter
+# 'bazel clean --expunge' conserves size of the image
+RUN git clone https://github.com/bazelbuild/bazel.git \
+ && (cd bazel \
+  && bazel build //src/tools/skylark/java/com/google/devtools/skylark/skylint:Skylint_deploy.jar \
+  && cp bazel-bin/src/tools/skylark/java/com/google/devtools/skylark/skylint/Skylint_deploy.jar /usr/local/bin \
+  && bazel clean --expunge \
+  ) && rm -rf bazel
+
+USER circleci
+
+###
+# Fix up npm global installation
+# See https://docs.npmjs.com/getting-started/fixing-npm-permissions
+RUN mkdir ~/.npm-global \
+ && npm config set prefix '~/.npm-global' \
+ && echo "export PATH=~/.npm-global/bin:$PATH" >> ~/.profile
+
+###
+# This version of ChromeDriver works with the Chrome version included
+# in the circleci/*-browsers base image above.
+# This variable is intended to be used by passing it as an argument to
+# "postinstall": "webdriver-manager update ..."
+ENV CHROMEDRIVER_VERSION_ARG "--versions.chrome 2.33"
+
+WORKDIR /home/circleci
+ENTRYPOINT ["/bin/bash", "--login"]
diff --git a/tools/ngcontainer/README.md b/tools/ngcontainer/README.md
new file mode 100644
index 0000000000..9037feadf2
--- /dev/null
+++ b/tools/ngcontainer/README.md
@@ -0,0 +1,52 @@
+# ngcontainer
+
+This docker container provides everything needed to build and test Angular applications:
+
+- node 8.9.2
+- npm 5.5.1
+- yarn 1.3.2
+- Java 8 (for Closure Compiler and Bazel)
+- Bazel build tool v0.11.1 - http://bazel.build
+- Google Chrome 63.0.3239.84
+- Mozilla Firefox 47.0.1
+- xvfb (virtual framebuffer) for headless testing
+- Brotli compression utility, making smaller files than gzip
+
+By using this, you avoid installation steps in your CI scripts and get a more consistent dev environment.
+
+## Example
+
+See https://github.com/angular/closure-demo/blob/master/.circleci/config.yml
+where this container is used in CircleCI.
+
+To run locally:
+
+```
+$ docker run -it --rm angular/ngcontainer
+```
+
+## Running tests
+
+Any program that needs to talk to a browser (eg. protractor) should be run under xvfb when executing on a headless machine like on CI. The nice way to factor this is to have your top-level test command which you run locally:
+
+```
+$ yarn test
+```
+
+Then in your CI configuration, you'd run
+
+```
+$ xvfb-run -a yarn test
+```
+
+## For Developers
+
+Install Docker on your machine in order to build/pull/push this image.
+
+Get the teamangular password from http://valentine and log in:
+
+`$ docker login`
+
+Publish a new version:
+
+`$ tools/ngcontainer/publish.sh [tag eg. 0.2.3]`
diff --git a/tools/ngcontainer/publish.sh b/tools/ngcontainer/publish.sh
new file mode 100755
index 0000000000..c3ee330f08
--- /dev/null
+++ b/tools/ngcontainer/publish.sh
@@ -0,0 +1,13 @@
+set -e
+
+TAG=$1
+if [ -z $TAG ]
+  then echo "usage: $0 [tag]"; exit 1
+fi
+
+docker build . -t angular/ngcontainer:$TAG
+docker tag angular/ngcontainer:$TAG angular/ngcontainer:latest
+docker push angular/ngcontainer:$TAG
+docker push angular/ngcontainer:latest
+git tag -a "ngcontainer_${TAG}" -m "published to docker"
+git push --tags