diff --git a/docker/contrib/BUILD b/docker/contrib/BUILD
index 727a7eac2..17e4c5466 100644
--- a/docker/contrib/BUILD
+++ b/docker/contrib/BUILD
@@ -15,4 +15,4 @@ package(default_visibility = ["//visibility:public"])
 
 licenses(["notice"])  # Apache 2.0
 
-exports_files(["push-tag.sh.tpl"])
+exports_files(["push-all.sh.tpl"])
diff --git a/docker/contrib/push-all.bzl b/docker/contrib/push-all.bzl
index 0cf9af0f8..0af247d37 100644
--- a/docker/contrib/push-all.bzl
+++ b/docker/contrib/push-all.bzl
@@ -17,6 +17,14 @@ This variant of docker_push accepts a docker_bundle target and publishes
 the embedded image references.
 """
 
+load(
+    "//docker:path.bzl",
+    "runfile",
+)
+
+def _get_runfile_path(ctx, f):
+  return "${RUNFILES}/%s" % runfile(ctx, f)
+
 def _impl(ctx):
   """Core implementation of docker_push."""
   stamp = ctx.attr.bundle.stamp
@@ -26,7 +34,7 @@ def _impl(ctx):
   if stamp:
     stamp_inputs = [ctx.info_file, ctx.version_file]
 
-  stamp_arg = " ".join(["--stamp-info-file=%s" % f.short_path for f in stamp_inputs])
+  stamp_arg = " ".join(["--stamp-info-file=%s" % _get_runfile_path(ctx, f) for f in stamp_inputs])
 
   scripts = []
   runfiles = []
@@ -41,14 +49,14 @@ def _impl(ctx):
             "docker_build, consider dropping the '.tar' extension. " +
             "If the image is checked in, consider using " +
             "docker_import instead.")
-      legacy_base_arg = "--tarball=%s" % image["legacy"].short_path
+      legacy_base_arg = "--tarball=%s" % _get_runfile_path(ctx, image["legacy"])
       runfiles += [image["legacy"]]
 
     blobsums = image.get("blobsum", [])
-    digest_arg = " ".join(["--digest=%s" % f.short_path for f in blobsums])
+    digest_arg = " ".join(["--digest=%s" % _get_runfile_path(ctx, f) for f in blobsums])
     blobs = image.get("zipped_layer", [])
-    layer_arg = " ".join(["--layer=%s" % f.short_path for f in blobs])
-    config_arg = "--config=%s" % image["config"].short_path
+    layer_arg = " ".join(["--layer=%s" % _get_runfile_path(ctx, f) for f in blobs])
+    config_arg = "--config=%s" % _get_runfile_path(ctx, image["config"])
 
     runfiles += [image["config"]] + blobsums + blobs
 
@@ -60,7 +68,7 @@ def _impl(ctx):
             "%{tag}": ctx.expand_make_variables("tag", tag, {}),
             "%{image}": "%s %s %s %s" % (
                 legacy_base_arg, config_arg, digest_arg, layer_arg),
-            "%{docker_pusher}": ctx.executable._pusher.short_path,
+            "%{docker_pusher}": _get_runfile_path(ctx, ctx.executable._pusher)
         },
         output = out,
         executable=True,
@@ -70,11 +78,14 @@ def _impl(ctx):
     runfiles += [out]
     index += 1
 
-  ctx.file_action(
-    content = "\n".join(["#!/bin/bash -e"] + [
-      command.short_path + "&"
-      for command in scripts
-    ] + ["wait"]),
+  ctx.template_action(
+    template = ctx.file._all_tpl,
+    substitutions = {
+      "%{push_statements}": "\n".join([
+        _get_runfile_path(ctx, command) + "&"
+        for command in scripts
+      ]),
+    },
     output = ctx.outputs.executable,
     executable=True,
   )
@@ -86,8 +97,13 @@ def _impl(ctx):
 docker_push = rule(
     attrs = {
         "bundle": attr.label(mandatory = True),
+        "_all_tpl": attr.label(
+            default = Label("//docker/contrib:push-all.sh.tpl"),
+            single_file = True,
+            allow_files = True,
+        ),
         "_tag_tpl": attr.label(
-            default = Label("//docker/contrib:push-tag.sh.tpl"),
+            default = Label("//docker:push-tag.sh.tpl"),
             single_file = True,
             allow_files = True,
         ),
diff --git a/docker/contrib/push-tag.sh.tpl b/docker/contrib/push-all.sh.tpl
similarity index 73%
rename from docker/contrib/push-tag.sh.tpl
rename to docker/contrib/push-all.sh.tpl
index 3a9e61dbb..6c9d41828 100644
--- a/docker/contrib/push-tag.sh.tpl
+++ b/docker/contrib/push-all.sh.tpl
@@ -1,4 +1,4 @@
-#!/bin/bash -xe
+#!/bin/bash
 # Copyright 2017 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -13,4 +13,15 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-%{docker_pusher} --name=%{tag} %{stamp} %{image} "$@"
+set -eu
+
+function guess_runfiles() {
+    pushd ${BASH_SOURCE[0]}.runfiles > /dev/null 2>&1
+    pwd
+    popd > /dev/null 2>&1
+}
+
+RUNFILES="${PYTHON_RUNFILES:-$(guess_runfiles)}"
+
+%{push_statements}
+wait
diff --git a/docker/push-tag.sh.tpl b/docker/push-tag.sh.tpl
index 2e1677edd..7db1d7f98 100644
--- a/docker/push-tag.sh.tpl
+++ b/docker/push-tag.sh.tpl
@@ -1,4 +1,4 @@
-#!/bin/bash -xe
+#!/bin/bash
 # Copyright 2017 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -13,6 +13,14 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-%{docker_pusher} \
-  --name=%{registry}/%{repository}:%{tag} \
-  %{stamp} %{image} "$@"
+set -eu
+
+function guess_runfiles() {
+    pushd ${BASH_SOURCE[0]}.runfiles > /dev/null 2>&1
+    pwd
+    popd > /dev/null 2>&1
+}
+
+RUNFILES="${PYTHON_RUNFILES:-$(guess_runfiles)}"
+
+%{docker_pusher} --name=%{tag} %{stamp} %{image} "$@"
diff --git a/docker/push.bzl b/docker/push.bzl
index de8cee6d0..b369f45cf 100644
--- a/docker/push.bzl
+++ b/docker/push.bzl
@@ -19,7 +19,7 @@ Bazel rule for publishing base images without a Docker client.
 
 load(
     ":path.bzl",
-    _get_runfile_path = "runfile",
+    "runfile",
 )
 load(
     ":layers.bzl",
@@ -27,6 +27,9 @@ load(
     _layer_tools = "tools",
 )
 
+def _get_runfile_path(ctx, f):
+  return "${RUNFILES}/%s" % runfile(ctx, f)
+
 def _impl(ctx):
   """Core implementation of docker_push."""
   stamp_inputs = []
@@ -35,7 +38,7 @@ def _impl(ctx):
 
   image = _get_layers(ctx, ctx.attr.image, ctx.files.image)
 
-  stamp_arg = " ".join(["--stamp-info-file=%s" % f.short_path for f in stamp_inputs])
+  stamp_arg = " ".join(["--stamp-info-file=%s" % _get_runfile_path(ctx, f) for f in stamp_inputs])
 
   # Leverage our efficient intermediate representation to push.
   legacy_base_arg = ""
@@ -45,27 +48,28 @@ def _impl(ctx):
           "docker_build, consider dropping the '.tar' extension. " +
           "If the image is checked in, consider using " +
           "docker_import instead.")
-    legacy_base_arg = "--tarball=%s" % image["legacy"].short_path
+    legacy_base_arg = "--tarball=%s" % _get_runfile_path(ctx, image["legacy"])
 
   blobsums = image.get("blobsum", [])
-  digest_arg = " ".join(["--digest=%s" % f.short_path for f in blobsums])
+  digest_arg = " ".join(["--digest=%s" % _get_runfile_path(ctx, f) for f in blobsums])
   blobs = image.get("zipped_layer", [])
-  layer_arg = " ".join(["--layer=%s" % f.short_path for f in blobs])
-  config_arg = "--config=%s" % image["config"].short_path
+  layer_arg = " ".join(["--layer=%s" % _get_runfile_path(ctx, f) for f in blobs])
+  config_arg = "--config=%s" % _get_runfile_path(ctx, image["config"])
 
   ctx.template_action(
       template = ctx.file._tag_tpl,
       substitutions = {
-          "%{registry}": ctx.expand_make_variables(
+          "%{tag}": "{registry}/{repository}:{tag}".format(
+            registry=ctx.expand_make_variables(
               "registry", ctx.attr.registry, {}),
-          "%{repository}": ctx.expand_make_variables(
+            repository=ctx.expand_make_variables(
               "repository", ctx.attr.repository, {}),
+            tag=ctx.expand_make_variables(
+              "tag", ctx.attr.tag, {})),
           "%{stamp}": stamp_arg,
-          "%{tag}": ctx.expand_make_variables(
-              "tag", ctx.attr.tag, {}),
           "%{image}": "%s %s %s %s" % (
               legacy_base_arg, config_arg, digest_arg, layer_arg),
-          "%{docker_pusher}": ctx.executable._pusher.short_path,
+          "%{docker_pusher}": _get_runfile_path(ctx, ctx.executable._pusher),
       },
       output = ctx.outputs.executable,
       executable=True,