--- a/taskcluster/ci/docker-image/kind.yml
+++ b/taskcluster/ci/docker-image/kind.yml
@@ -1,30 +1,37 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 loader: taskgraph.loader.transform:loader
 
+kind-dependencies:
+  - packages
+
 transforms:
   - taskgraph.transforms.docker_image:transforms
   - taskgraph.transforms.task:transforms
 
 # make a task for each docker-image we might want.  For the moment, since we
 # write artifacts for each, these are whitelisted, but ideally that will change
 # (to use subdirectory clones of the proper directory), at which point we can
 # generate tasks for every docker image in the directory, secure in the
 # knowledge that unnecessary images will be omitted from the target task graph
 jobs:
   desktop1604-test:
     symbol: I(dt16t)
   desktop-build:
     symbol: I(db)
   valgrind-build:
     symbol: I(vb)
+  toolchain-build:
+    symbol: I(toolchain)
+    packages:
+      - deb7-python
   lint:
     symbol: I(lnt)
   android-build:
     symbol: I(agb)
   index-task:
     symbol: I(idx)
   funsize-update-generator:
     symbol: I(pg)

new file mode 100644
--- /dev/null
+++ b/taskcluster/docker/toolchain-build/Dockerfile
@@ -0,0 +1,102 @@
+FROM debian:wheezy-20171210
+MAINTAINER Mike Hommey <mhommey@mozilla.com>
+
+### Add worker user and setup its workspace.
+RUN mkdir /builds && \
+    groupadd -g 500 worker && \
+    useradd -u 500 -g 500 -d /builds/worker -s /bin/bash -m worker && \
+    mkdir -p /builds/worker/workspace && \
+    chown -R worker:worker /builds
+
+# Declare default working folder
+WORKDIR /builds/worker
+
+VOLUME /builds/worker/checkouts
+VOLUME /builds/worker/workspace
+VOLUME /builds/worker/tooltool-cache
+
+# Set variable normally configured at login, by the shells parent process, these
+# are taken from GNU su manual
+ENV HOME=/builds/worker \
+    SHELL=/bin/bash \
+    USER=worker \
+    LOGNAME=worker \
+    HOSTNAME=taskcluster-worker \
+    DEBIAN_FRONTEND=noninteractive
+
+# Set a default command useful for debugging
+CMD ["/bin/bash", "--login"]
+
+# Set apt sources list to a snapshot.
+RUN for s in debian_wheezy debian_wheezy-updates debian_wheezy-backports debian-security_wheezy/updates; do \
+      echo "deb http://snapshot.debian.org/archive/${s%_*}/20171210T214726Z/ ${s#*_} main"; \
+    done > /etc/apt/sources.list
+
+RUN apt-get -o Acquire::Check-Valid-Until=false update -q && \
+    apt-get install -yyq --no-install-recommends \
+      apt-transport-https \
+      ca-certificates
+
+# %ARG DOCKER_IMAGE_PACKAGES
+RUN for task in $DOCKER_IMAGE_PACKAGES; do \
+      echo "deb [trusted=yes] https://queue.taskcluster.net/v1/task/$task/runs/0/artifacts/public/build/ debian/" >> /etc/apt/sources.list; \
+    done
+
+RUN dpkg --add-architecture i386
+
+RUN apt-get -o Acquire::Check-Valid-Until=false update -q && \
+    apt-get install -yyq --no-install-recommends \
+      autoconf \
+      automake \
+      bison \
+      build-essential \
+      curl \
+      flex \
+      gawk \
+      gcc-multilib \
+      git \
+      gnupg \
+      libtool \
+      make \
+      p7zip-full \
+      procps \
+      pxz/wheezy-backports \
+      python-dev \
+      python-pip \
+      python-setuptools \
+      python-virtualenv \
+      subversion \
+      tar \
+      unzip \
+      uuid \
+      wget \
+      xz-utils \
+      zip \
+    && \
+    apt-get clean
+
+# %include python/mozbuild/mozbuild/action/tooltool.py
+COPY topsrcdir/python/mozbuild/mozbuild/action/tooltool.py /setup/tooltool.py
+
+# %include testing/mozharness/external_tools/robustcheckout.py
+COPY topsrcdir/testing/mozharness/external_tools/robustcheckout.py /usr/local/mercurial/robustcheckout.py
+
+# %include taskcluster/docker/recipes/common.sh
+COPY topsrcdir/taskcluster/docker/recipes/common.sh /setup/common.sh
+
+# %include taskcluster/docker/recipes/install-mercurial.sh
+COPY topsrcdir/taskcluster/docker/recipes/install-mercurial.sh /setup/install-mercurial.sh
+
+# %include taskcluster/docker/recipes/debian-build-system-setup.sh
+COPY topsrcdir/taskcluster/docker/recipes/debian-build-system-setup.sh /setup/system-setup.sh
+
+RUN bash /setup/system-setup.sh
+
+# Add pip configuration, among other things.
+# %include taskcluster/docker/recipes/dot-config
+COPY topsrcdir/taskcluster/docker/recipes/dot-config /builds/worker/.config
+
+# %include taskcluster/docker/recipes/run-task
+COPY topsrcdir/taskcluster/docker/recipes/run-task /builds/worker/bin/run-task
+
+RUN chown -R worker:worker /builds/worker/bin && chmod 755 /builds/worker/bin/*