diff --git a/bazel/BUILD b/bazel/BUILD
index 2484a9d0c3190..8b682d020d17a 100644
--- a/bazel/BUILD
+++ b/bazel/BUILD
@@ -1,3 +1,23 @@
 package(default_visibility = ["//visibility:public"])
 
 exports_files(["gen_sh_test_runner.sh"])
+
+config_setting(
+    name = "opt_build",
+    values = {"compilation_mode": "opt"},
+)
+
+config_setting(
+    name = "fastbuild_build",
+    values = {"compilation_mode": "fastbuild"},
+)
+
+config_setting(
+    name = "dbg_build",
+    values = {"compilation_mode": "dbg"},
+)
+
+config_setting(
+    name = "debug_symbols",
+    values = {"define": "debug_symbols=yes"},
+)
diff --git a/bazel/envoy_build_system.bzl b/bazel/envoy_build_system.bzl
index 3078656b763d2..52326a78a275e 100644
--- a/bazel/envoy_build_system.bzl
+++ b/bazel/envoy_build_system.bzl
@@ -3,22 +3,24 @@ load("@protobuf_bzl//:protobuf.bzl", "cc_proto_library")
 ENVOY_COPTS = [
     # TODO(htuch): Remove this when Bazel bringup is done.
     "-DBAZEL_BRINGUP",
-    "-fno-omit-frame-pointer",
-    # TODO(htuch): Clang wants -ferror-limit, should support both. Commented out for now.
-    # "-fmax-errors=3",
     "-Wall",
-    # TODO(htuch): Figure out why protobuf-3.2.0 causes the CI build to fail
-    # with this but not the developer-local build.
-    #"-Wextra",
+    "-Wextra",
     "-Werror",
     "-Wnon-virtual-dtor",
     "-Woverloaded-virtual",
-    # TODO(htuch): Figure out how to use this in the presence of headers in
-    # openssl/tclap which use old style casts.
-    # "-Wold-style-cast",
+    "-Wold-style-cast",
     "-std=c++0x",
     "-includeprecompiled/precompiled.h",
-]
+] + select({
+    # Bazel adds an implicit -DNDEBUG for opt.
+    "//bazel:opt_build": [],
+    "//bazel:fastbuild_build": [],
+    "//bazel:dbg_build": ["-ggdb3"],
+}) + select({
+    # Allow debug symbols to be added to opt/fastbuild as well.
+    "//bazel:debug_symbols": ["-ggdb3"],
+    "//conditions:default": [],
+})
 
 # References to Envoy external dependencies should be wrapped with this function.
 def envoy_external_dep_path(dep):
@@ -70,6 +72,8 @@ def envoy_cc_binary(name,
         linkopts = [
             "-pthread",
             "-lrt",
+            "-static-libstdc++",
+            "-static-libgcc",
         ],
         linkstatic = 1,
         visibility = visibility,
diff --git a/ci/prebuilt/BUILD b/ci/prebuilt/BUILD
index 52a61c12877dc..1fae694e09672 100644
--- a/ci/prebuilt/BUILD
+++ b/ci/prebuilt/BUILD
@@ -4,21 +4,21 @@ cc_library(
     name = "ares",
     srcs = ["thirdparty_build/lib/libcares.a"],
     hdrs = glob(["thirdparty_build/include/ares*.h"]),
-    strip_include_prefix = "thirdparty_build/include",
+    includes = ["thirdparty_build/include"],
 )
 
 cc_library(
     name = "crypto",
     srcs = ["thirdparty_build/lib/libcrypto.a"],
     hdrs = glob(["thirdparty_build/include/openssl/**/*.h"]),
-    strip_include_prefix = "thirdparty_build/include",
+    includes = ["thirdparty_build/include"],
 )
 
 cc_library(
     name = "event",
     srcs = ["thirdparty_build/lib/libevent.a"],
     hdrs = glob(["thirdparty_build/include/event2/**/*.h"]),
-    strip_include_prefix = "thirdparty_build/include",
+    includes = ["thirdparty_build/include"],
 )
 
 cc_library(
@@ -37,14 +37,14 @@ cc_library(
         "thirdparty_build/include/gmock/**/*.h",
         "thirdparty_build/include/gtest/**/*.h",
     ]),
-    strip_include_prefix = "thirdparty_build/include",
+    includes = ["thirdparty_build/include"],
 )
 
 cc_library(
     name = "http_parser",
     srcs = ["thirdparty_build/lib/libhttp_parser.a"],
     hdrs = glob(["thirdparty_build/include/http_parser.h"]),
-    strip_include_prefix = "thirdparty_build/include",
+    includes = ["thirdparty_build/include"],
 )
 
 cc_library(
@@ -57,7 +57,7 @@ cc_library(
         "thirdparty_build/include/collector.pb.h",
         "thirdparty_build/include/lightstep_carrier.pb.h",
     ],
-    strip_include_prefix = "thirdparty_build/include",
+    includes = ["thirdparty_build/include"],
     deps = [":protobuf"],
 )
 
@@ -65,14 +65,14 @@ cc_library(
     name = "nghttp2",
     srcs = ["thirdparty_build/lib/libnghttp2.a"],
     hdrs = glob(["thirdparty_build/include/nghttp2/**/*.h"]),
-    strip_include_prefix = "thirdparty_build/include",
+    includes = ["thirdparty_build/include"],
 )
 
 cc_library(
     name = "protobuf",
     srcs = glob(["thirdparty_build/lib/libproto*.a"]),
     hdrs = glob(["thirdparty_build/include/google/protobuf/**/*.h"]),
-    strip_include_prefix = "thirdparty_build/include",
+    includes = ["thirdparty_build/include"],
 )
 
 filegroup(
@@ -83,7 +83,7 @@ filegroup(
 cc_library(
     name = "rapidjson",
     hdrs = glob(["thirdparty/rapidjson-1.1.0/include/**/*.h"]),
-    strip_include_prefix = "thirdparty/rapidjson-1.1.0/include",
+    includes = ["thirdparty/rapidjson-1.1.0/include"],
 )
 
 cc_library(
@@ -92,7 +92,7 @@ cc_library(
         "thirdparty/spdlog-0.11.0/include/**/*.cc",
         "thirdparty/spdlog-0.11.0/include/**/*.h",
     ]),
-    strip_include_prefix = "thirdparty/spdlog-0.11.0/include",
+    includes = ["thirdparty/spdlog-0.11.0/include"],
 )
 
 cc_library(
@@ -104,5 +104,5 @@ cc_library(
 cc_library(
     name = "tclap",
     hdrs = glob(["thirdparty/tclap-1.2.1/include/**/*.h"]),
-    strip_include_prefix = "thirdparty/tclap-1.2.1/include",
+    includes = ["thirdparty/tclap-1.2.1/include"],
 )