fix

Author: zirain

.bazelrc

@@ -14,7 +14,7 @@ build:remote --remote_timeout=7200
 # ========================================
 
 # Enable libc++ and C++20 by default.
-# build --repo_env=BAZEL_LLVM_PATH=/usr/lib/llvm
+build --repo_env=BAZEL_LLVM_PATH=/usr/lib/llvm
 build:linux --config=clang
 
 # put /usr/local/bin before /usr/bin to avoid picking up wrong python3.6 when building envoy.tls.key_providers.cryptomb

WORKSPACE

@@ -22,10 +22,10 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 # 1. Determine SHA256 `wget https://github.com/envoyproxy/envoy/archive/$COMMIT.tar.gz && sha256sum $COMMIT.tar.gz`
 # 2. Update .bazelversion, envoy.bazelrc and .bazelrc if needed.
 #
-# Commit date: 2025-12-03
-ENVOY_SHA = "1caf0d7396786bac7f4fcf7b9d291ed761191b68"
+# Commit date: 2025-12-05
+ENVOY_SHA = "df7ddf53f997efd9e080f5940bd996ee9827405b"
 
-ENVOY_SHA256 = "10df99872f4f4c24c456970fdbedae1a25ecf2de4d4db57a34cd271f46fc7ac0"
+ENVOY_SHA256 = "481954044392c767e58b5971f3f0e53baa1707b62f20fca63794fefd279b9c90"
 
 ENVOY_ORG = "envoyproxy"
 
@@ -78,11 +78,29 @@ load("@envoy//bazel:repo.bzl", "envoy_repo")
 
 envoy_repo()
 
-load("@envoy//bazel:toolchains.bzl", "envoy_toolchains")
 
-envoy_toolchains()
+# this's workaround for use local LLVM toolchain
+load("@envoy_repo//:compiler.bzl", "LLVM_PATH")
+load("@envoy_toolshed//repository:utils.bzl", "arch_alias")
+load("@toolchains_llvm//toolchain:rules.bzl", "llvm_toolchain")
+
+register_toolchains("@envoy//bazel/rbe/toolchains/configs/linux/gcc/config:cc-toolchain")
+
+arch_alias(
+    name = "clang_platform",
+    aliases = {
+        "amd64": "@envoy//bazel/platforms/rbe:linux_x64",
+        "aarch64": "@envoy//bazel/platforms/rbe:linux_arm64",
+    },
+)
+
+llvm_toolchain(
+    name = "llvm_toolchain",
+    cxx_standard = {"": "c++20"},
+    llvm_version = "18.1.8",
+    toolchain_roots = {"": LLVM_PATH} if LLVM_PATH else {},
+)
 
 load("@llvm_toolchain//:toolchains.bzl", "llvm_register_toolchains")
 
 llvm_register_toolchains()
-

envoy.bazelrc

@@ -391,6 +391,9 @@ build:remote --strategy=Javac=remote,sandboxed,local
 build:remote --strategy=Closure=remote,sandboxed,local
 build:remote --strategy=Genrule=remote,sandboxed,local
 build:remote --action_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
+# This flag may be more generally useful - it sets foreign_cc builds -jauto.
+# It is only set here because if it were the default it risks OOMing on local builds.
+build:remote --@envoy//bazel/foreign_cc:parallel_builds
 
 ## RBE (Engflow Envoy)