diff --git a/lang/image.bzl b/lang/image.bzl
index c2db8f4..16a1f57 100644
--- a/lang/image.bzl
+++ b/lang/image.bzl
@@ -34,8 +34,8 @@ def _binary_name(ctx):
     # /app/foo/bar/baz/blah
     return "/".join([
         ctx.attr.directory,
-        ctx.attr.binary.label.package,
-        ctx.attr.binary.label.name,
+        ctx.attr.binary[0].label.package,
+        ctx.attr.binary[0].label.name,
     ])
 
 def _runfiles_dir(ctx):
@@ -148,7 +148,7 @@ def _app_layer_impl(ctx, runfiles = None, emptyfiles = None):
     parent_parts = _get_layers(ctx, ctx.attr.name, ctx.attr.base)
     filepath = _final_file_path if ctx.attr.binary else layer_file_path
     emptyfilepath = _final_emptyfile_path if ctx.attr.binary else _layer_emptyfile_path
-    dep = ctx.attr.dep or ctx.attr.binary
+    dep = (ctx.attr.dep or ctx.attr.binary)[0]
     top_layer = ctx.attr.binary and not ctx.attr.dep
 
     if ctx.attr.create_empty_workspace_dir:
@@ -239,6 +239,18 @@ def _app_layer_impl(ctx, runfiles = None, emptyfiles = None):
         null_cmd = args == [],
     )
 
+def _container_transition_impl(settings, attr):
+    _ignore = (settings, attr)
+    return {
+        "//command_line_option:platforms": "@io_bazel_rules_docker//platforms:linux_amd64",
+    }
+
+container_transition = transition(
+    implementation = _container_transition_impl,
+    inputs = [],
+    outputs = ["//command_line_option:platforms"],
+)
+
 image = struct(
     attrs = dicts.add(_container.image.attrs, {
         # The base image on which to overlay the dependency layers.
@@ -250,7 +262,7 @@ image = struct(
         # the runfiles dir.
         "binary": attr.label(
             executable = True,
-            cfg = "target",
+            cfg = container_transition,
         ),
         # Set this to true to create an empty workspace directory under the
         # app directory specified as the 'directory' attribute.
@@ -263,11 +275,14 @@ image = struct(
         # The dependency whose runfiles we're appending.
         # If not specified, then the layer will be treated as the top layer,
         # and all remaining deps of "binary" will be added under runfiles.
-        "dep": attr.label(),
+        "dep": attr.label(cfg = container_transition),
         "directory": attr.string(default = "/app"),
         "entrypoint": attr.string_list(default = []),
         "legacy_run_behavior": attr.bool(default = False),
         "workdir": attr.string(default = ""),
+        "_whitelist_function_transition": attr.label(
+            default = "//tools/whitelists/function_transition_whitelist",
+        ),
     }),
     outputs = _container.image.outputs,
     toolchains = ["@io_bazel_rules_docker//toolchains/docker:toolchain_type"],
diff --git a/platforms/BUILD b/platforms/BUILD
index 50b8593..b4f25c9 100644
--- a/platforms/BUILD
+++ b/platforms/BUILD
@@ -56,3 +56,11 @@ platform(
     ],
     parents = ["@buildkite_config//config:platform"],
 )
+
+platform(
+    name = "linux_amd64",
+    constraint_values = [
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+    ],
+)
diff --git a/toolchains/BUILD b/toolchains/BUILD
index 55f7560..bf56cd0 100644
--- a/toolchains/BUILD
+++ b/toolchains/BUILD
@@ -56,13 +56,13 @@ toolchain(
     name = "rbe_container_cc_toolchain",
     exec_compatible_with = [
         "@io_bazel_rules_docker//platforms:run_in_container",
-        "@bazel_tools//platforms:x86_64",
-        "@bazel_tools//platforms:linux",
+        "@platforms//cpu:x86_64",
+        "@platforms//os:linux",
         "@bazel_tools//tools/cpp:clang",
     ],
     target_compatible_with = [
-        "@bazel_tools//platforms:linux",
-        "@bazel_tools//platforms:x86_64",
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
     ],
     toolchain = "@buildkite_config//cc:cc-compiler-k8",
     toolchain_type = "@bazel_tools//tools/cpp:toolchain_type",
diff --git a/toolchains/docker/BUILD b/toolchains/docker/BUILD
index 42e83e1..b7c9c5f 100644
--- a/toolchains/docker/BUILD
+++ b/toolchains/docker/BUILD
@@ -42,7 +42,7 @@ docker_toolchain(
 toolchain(
     name = "default_linux_toolchain",
     target_compatible_with = [
-        "@bazel_tools//platforms:linux",
+        "@platforms//os:linux",
     ],
     toolchain = "@docker_config//:toolchain",
     toolchain_type = ":toolchain_type",
@@ -51,7 +51,7 @@ toolchain(
 toolchain(
     name = "default_windows_toolchain",
     target_compatible_with = [
-        "@bazel_tools//platforms:windows",
+        "@platforms//os:windows",
     ],
     toolchain = "@docker_config//:toolchain",
     toolchain_type = ":toolchain_type",
@@ -60,7 +60,7 @@ toolchain(
 toolchain(
     name = "default_osx_toolchain",
     target_compatible_with = [
-        "@bazel_tools//platforms:osx",
+        "@platforms//os:osx",
     ],
     toolchain = "@docker_config//:toolchain",
     toolchain_type = ":toolchain_type",
diff --git a/tools/whitelists/function_transition_whitelist/BUILD b/tools/whitelists/function_transition_whitelist/BUILD
new file mode 100644
index 0000000..640d44f
--- /dev/null
+++ b/tools/whitelists/function_transition_whitelist/BUILD
@@ -0,0 +1,6 @@
+package_group(
+    name = "function_transition_whitelist",
+    packages = [
+        "//lang/...",
+    ],
+)