tcmalloc (and the dependent gperftools) seems to be only be linked in non-asan builds. As far as I'm aware, when tcmalloc is linked, it should allow gperftools to detect leaks through a heap checker. However, in the process of tracking down some internal leaks, I introduced the following sample leak into router.h:

Filter(FilterConfig& config)
      : config_(config), downstream_response_started_(false), downstream_end_stream_(false),
        do_shadowing_(false) {
          int *leak = new int;
          std::cout << "leak address: " << leak << ", leak data: " << *leak << std::endl;
          leak = new int;
          std::cout << "leak address: " << leak << ", leak data: " << *leak << std::endl;
        }

This leak is only detected by the bazel.asan docker command by the asan LeakSanitizer. Other docker builds/tests (bazel.dev, bazel.debug, bazel.release, bazel.tsan) pass. If this is the expected behavior, that's fine. It just seemed surprising that gperftools either wasn't enabled or detecting this unambiguous leak on any of the docker commands where one might expect it to.