diff --git a/WORKSPACE b/WORKSPACE
index 88321e329..9d51579f5 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -158,7 +158,7 @@ git_repository(
 #
 git_repository(
     name = "io_bazel_rules_go",
-    commit = "76c63b5cd0d47c1f2b47ab4953db96c574af1c1d",
+    commit = "2d9f328a9723baf2d037ba9db28d9d0e30683938", # Apr 6, 2017 (buildifier fix)
     remote = "https://github.com/bazelbuild/rules_go.git",
 )
 
diff --git a/docker/ingress/build.sh b/docker/ingress/build.sh
index a3dd507b5..2771e40b1 100755
--- a/docker/ingress/build.sh
+++ b/docker/ingress/build.sh
@@ -43,4 +43,4 @@ cp $DEB                                 $ROOT/docker/ingress
 cp $ROOT/bazel-bin/test/src/ingress     $ROOT/docker/ingress
 cp $ROOT/test/src/controller/nginx.tmpl $ROOT/docker/ingress
 docker build -t ${IMAGE} $ROOT/docker/ingress || error_exit "Failed to build"
-gcloud docker push ${IMAGE}                   || error_exit "Failed to upload docker image"
+gcloud docker -- push ${IMAGE}                   || error_exit "Failed to upload docker image"
diff --git a/script/jenkins-build-docker-slave b/script/jenkins-build-docker-slave
index d0fe07ba3..4a3dd8f31 100755
--- a/script/jenkins-build-docker-slave
+++ b/script/jenkins-build-docker-slave
@@ -43,7 +43,7 @@ TOOLS_BUCKET=''
 function update_image() {
   local image="${1}"
   [[ ${FORCE} == true ]] && return 0
-  ${GCLOUD} docker pull "${image}"
+  ${GCLOUD} docker -- pull "${image}"
   local image_exists=${?}
   [[ ${image_exists} -eq 0 ]] && return 1
   return 0
@@ -75,7 +75,7 @@ if [[ "${BUILD}" == true ]]; then
     run retry -n 10 docker build --build-arg TOOLS_BUCKET="${TOOLS_BUCKET}" --no-cache -t ${IMAGE} \
       -f "${DOCKER_FILE}" . || error_exit "Could not build ${SLAVE}"
     echo "Pushing Docker image: ${IMAGE}"
-    retry -n 3 ${GCLOUD} docker push "${IMAGE}" \
+    retry -n 3 ${GCLOUD} docker -- push "${IMAGE}" \
       || error_exit "Failed to push tag ${IMAGE}."
   fi
 fi
@@ -86,7 +86,7 @@ if [[ -n "${TAG}" ]]; then
   retry -n 3 docker tag "${IMAGE}" ${TAG}
 
   echo "Pushing Docker image: ${TAG}"
-  retry -n 3 ${GCLOUD} docker push "${TAG}" \
+  retry -n 3 ${GCLOUD} docker -- push "${TAG}" \
     || error_exit "Failed to push tag ${TAG}."
 fi
 
diff --git a/script/linux-build-docker b/script/linux-build-docker
index fa38bcae5..12389783e 100755
--- a/script/linux-build-docker
+++ b/script/linux-build-docker
@@ -48,7 +48,7 @@ done
 [[ -f "${DEB}" ]] || error_exit "Cannot find Debian package ${DEB}"
 
 echo "Checking if docker image ${IMAGE} exists.."
-gcloud docker pull "${IMAGE}" \
+gcloud docker -- pull "${IMAGE}" \
   && { echo "Image ${IMAGE} already exists; skipping"; exit 0; }
 
 echo "Building Endpoints Runtime docker image."
@@ -86,7 +86,7 @@ if  [[ -n "${CONFIG}" ]]; then
 
   echo "Pushing Custom Docker image: ${IMAGE}"
   retry -n 10 -s 10 \
-      gcloud docker push "${IMAGE}" \
+      gcloud docker -- push "${IMAGE}" \
     || error_exit "Failed to upload custom Docker image to gcr."
 else
 
@@ -94,6 +94,6 @@ else
 
   # Try 10 times, shortest wait is 10 seconds, exponential back-off.
   retry -n 10 -s 10 \
-      gcloud docker push "${IMAGE}" \
+      gcloud docker -- push "${IMAGE}" \
     || error_exit "Failed to upload Docker image to gcr."
 fi
diff --git a/script/linux-gae-instance b/script/linux-gae-instance
index 343c9cc0c..62c2fb5b3 100755
--- a/script/linux-gae-instance
+++ b/script/linux-gae-instance
@@ -177,7 +177,7 @@ function download_nginx_logs() {
 
   retry -n 2 -s 10 \
     ${GCLOUD} compute ssh --project=${PROJECT} --zone=${vm_zone} ${vm_name} \
-        "sudo tar czf \"${remote_archive}\" /var/log/ ; sudo chmod 777 \"${remote_archive}\"" \
+        --command="sudo tar czf ${remote_archive} /var/log/; sudo chmod 777 ${remote_archive}" \
     || error_exit "Cannot tar backend VM logs."
 
   retry -n 2 -s 10 \
diff --git a/script/release-stable b/script/release-stable
index f07713500..00cab9b08 100755
--- a/script/release-stable
+++ b/script/release-stable
@@ -82,7 +82,7 @@ function tag_stable_image() {
 
   docker_tag_f "${image}" "${stable}"
 
-  retry "${GCLOUD}" docker push "${stable}" \
+  retry "${GCLOUD}" docker -- push "${stable}" \
     || error_exit "ERROR: failed to push '${stable}'"
 }
 
diff --git a/test/bookstore/linux-build-bookstore-docker b/test/bookstore/linux-build-bookstore-docker
index 3b5e2cf5b..0ad905962 100755
--- a/test/bookstore/linux-build-bookstore-docker
+++ b/test/bookstore/linux-build-bookstore-docker
@@ -42,7 +42,7 @@ done
 [[ -n "${IMAGE}" ]] || error_exit "Specify required image argument via '-i'"
 
 echo "Checking if docker image ${IMAGE} exists.."
-gcloud docker pull "${IMAGE}" \
+gcloud docker -- pull "${IMAGE}" \
   && echo "Image ${IMAGE} already exists; skipping" \
   && exit 0
 
@@ -54,5 +54,5 @@ retry -n 3 docker build --no-cache -t ${IMAGE} \
 echo "Pushing Docker image: ${IMAGE}"
 # Try 10 times, shortest wait is 10 seconds, exponential back-off.
 retry -n 10 -s 10 \
-    gcloud docker push "${IMAGE}" \
+    gcloud docker -- push "${IMAGE}" \
   || error_exit "Failed to upload Docker image to gcr."
diff --git a/test/echo/docker-remote/build-docker.sh b/test/echo/docker-remote/build-docker.sh
index 23fe5599b..ec5d35abf 100755
--- a/test/echo/docker-remote/build-docker.sh
+++ b/test/echo/docker-remote/build-docker.sh
@@ -44,7 +44,7 @@ sed "s/\${PROJECT}/${PROJECT}/" ../service.json.temp >  ./service.json
 
 ${GCLOUD} docker -- build --no-cache -t ${TAG} .
 docker tag -f ${TAG} gcr.io/${PROJECT}/${TAG}
-${GCLOUD} docker push gcr.io/${PROJECT}/${TAG}
+${GCLOUD} docker -- push gcr.io/${PROJECT}/${TAG}
 
 rm service.json
 
diff --git a/test/echo/docker/build-docker.sh b/test/echo/docker/build-docker.sh
index ad84494a9..9504f48a5 100755
--- a/test/echo/docker/build-docker.sh
+++ b/test/echo/docker/build-docker.sh
@@ -44,7 +44,7 @@ sed "s/\${PROJECT}/${PROJECT}/" ../service.json.temp >  ./service.json
 
 docker build --no-cache -t ${TAG} .
 docker tag -f ${TAG} gcr.io/${PROJECT}/${TAG}
-${GCLOUD} docker push gcr.io/${PROJECT}/${TAG}
+${GCLOUD} docker -- push gcr.io/${PROJECT}/${TAG}
 
 rm service.json
 
diff --git a/test/grpc/Dockerfile.temp b/test/grpc/Dockerfile.temp
index 575c2dab9..47110258c 100644
--- a/test/grpc/Dockerfile.temp
+++ b/test/grpc/Dockerfile.temp
@@ -7,7 +7,7 @@
 # 2) cp bazel-bin/test/grpc/grpc-test-server test/grpc
 # 3) IMAGE=gcr.io/endpointsv2/grpc-test-server:latest
 # 4) docker build --no-cache -t "${IMAGE}" test/grpc
-# 5) gcloud docker push "${IMAGE}"
+# 5) gcloud docker -- push "${IMAGE}"
 
 FROM debian:jessie
 
diff --git a/test/grpc/linux-build-grpc-docker b/test/grpc/linux-build-grpc-docker
index 25e462bfd..a5756939d 100755
--- a/test/grpc/linux-build-grpc-docker
+++ b/test/grpc/linux-build-grpc-docker
@@ -57,7 +57,7 @@ done
 [[ -n "${IMAGE}" ]] || error_exit "Specify required image argument via '-i'"
 
 echo "Checking if docker image ${IMAGE} exists.."
-gcloud docker pull "${IMAGE}" \
+gcloud docker -- pull "${IMAGE}" \
   && { echo "Image ${IMAGE} already exists; skipping"; exit 0; }
 
 BAZEL_TARGET="${ROOT}/bazel-bin/${TEST_SERVER_BIN}"
@@ -82,5 +82,5 @@ retry -n 3 docker build --no-cache -t "${IMAGE}" \
 echo "Pushing Docker image: ${IMAGE}"
 # Try 10 times, shortest wait is 10 seconds, exponential back-off.
 retry -n 10 -s 10 \
-    gcloud docker push "${IMAGE}" \
+    gcloud docker -- push "${IMAGE}" \
   || error_exit "Failed to upload Docker image to gcr."
diff --git a/test/transcoding/Dockerfile b/test/transcoding/Dockerfile
index 20c14ceaa..a01f41971 100644
--- a/test/transcoding/Dockerfile
+++ b/test/transcoding/Dockerfile
@@ -8,7 +8,7 @@
 # 2) cp bazel-bin/test/transcoding/bookstore-server test/transcoding
 # 3) IMAGE=gcr.io/endpointsv2/bookstore-grpc:latest
 # 4) docker build --no-cache -t "${IMAGE}" test/transcoding
-# 5) gcloud docker push "${IMAGE}"
+# 5) gcloud docker -- push "${IMAGE}"
 
 FROM debian:jessie
 
diff --git a/third_party/BUILD.golang_protobuf b/third_party/BUILD.golang_protobuf
index e9b0c65f5..24f0b8930 100644
--- a/third_party/BUILD.golang_protobuf
+++ b/third_party/BUILD.golang_protobuf
@@ -15,6 +15,7 @@ go_library(
         "proto/lib.go",
         "proto/message_set.go",
         "proto/pointer_reflect.go",
+        "proto/pointer_unsafe.go",
         "proto/properties.go",
         "proto/text.go",
         "proto/text_parser.go",