Description of the problem / feature request:

We are using container_test from rules_docker and for ci need to pass in DOCKER_HOST, DOCKER_TLS_VERIFY and DOCKER_CERT_PATH so these can work. But passing that flag like bazel test ... --test_env=DOCKER_HOST or putting it into the .bazelrc passes that into all test sandbox environments. It would be nice to have a way of specifying which target these environment variables should be passed in. We had a similar use-case once for action_env but could work around that, though I still think it would be nice to have it there also.

Feature requests: what underlying problem are you trying to solve with this feature?

By passing these environment variables to all tests/actions invoked in that one command it invalidates the cache and reruns tests/actions that do not actually need the env variables. Further in our case that also means that the remote cache for all affected targets can not be shared between ci and non-ci.

Bugs: what's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

Have a workspace with multiple tests, run bazel test ... and then bazel test --test_env=SOME_ENV=a ... and see that all tests get re-executed. It behaves similarly for --action_env

What operating system are you running Bazel on?

Ubuntu 16.04

What's the output of bazel info release?

release 0.17.0rc1