diff --git a/tools/rbcrun/Android.bp b/tools/rbcrun/Android.bp
new file mode 100644
index 0000000..b5f7155
--- /dev/null
+++ b/tools/rbcrun/Android.bp
@@ -0,0 +1,36 @@
+//
+// Copyright (C) 2021 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+blueprint_go_binary {
+    name: "rbcrun",
+    srcs: ["cmd/rbcrun.go"],
+    deps: ["rbcrun-module"],
+}
+
+bootstrap_go_package {
+    name: "rbcrun-module",
+    srcs: [
+        "host.go",
+    ],
+    testSrcs: [
+        "host_test.go",
+    ],
+    pkgPath: "rbcrun",
+    deps: [
+        "go-starlark-starlark",
+        "go-starlark-starlarkstruct",
+        "go-starlark-starlarktest",
+    ],
+}
diff --git a/tools/rbcrun/README.md b/tools/rbcrun/README.md
new file mode 100644
index 0000000..fb58c89
--- /dev/null
+++ b/tools/rbcrun/README.md
@@ -0,0 +1,84 @@
+# Roboleaf configuration files interpreter
+
+Reads and executes Roboleaf product configuration files.
+
+## Usage
+
+`rbcrun` *options* *VAR=value*... [ *file* ]
+
+A Roboleaf configuration file is a Starlark script. Usually it is read from *file*. The option `-c` allows to provide a
+script directly on the command line. The option `-f` is there to allow the name of a file script to contain (`=`).
+(i.e., `my=file.rbc` sets `my` to `file.rbc`, `-f my=file.rbc` runs the script from `my=file.rbc`).
+
+### Options
+
+`-d` *dir*\
+Root directory for load("//path",...)
+
+`-c` *text*\
+Read script from *text*
+
+`--perf` *file*\
+Gather performance statistics and save it to *file*. Use \
+`       go tool prof -top`*file*\
+to show top CPU users
+
+`-f` *file*\
+File to run.
+
+## Extensions
+
+The runner allows Starlark scripts to use the following features that Bazel's Starlark interpreter does not support:
+
+### Load statement URI
+
+Starlark does not define the format of the load statement's first argument.
+The Roboleaf configuration interpreter supports the format that Bazel uses
+(`":file"` or `"//path:file"`). In addition, it allows the URI to end with
+`"|symbol"` which defines a single variable `symbol` with `None` value if a
+module does not exist. Thus,
+
+```
+load(":mymodule.rbc|init", mymodule_init="init")
+```
+
+will load the module `mymodule.rbc` and export a symbol `init` in it as
+`mymodule_init` if `mymodule.rbc` exists. If `mymodule.rbc` is missing,
+`mymodule_init` will be set to `None`
+
+### Predefined Symbols
+
+#### rblf_env
+
+A `struct` containing environment variables. E.g., `rblf_env.USER` is the username when running on Unix.
+
+#### rblf_cli
+
+A `struct` containing the variable set by the interpreter's command line. That is, running
+
+```
+rbcrun FOO=bar myfile.rbc
+```
+
+will have the value of `rblf_cli.FOO` be `"bar"`
+
+### Predefined Functions
+
+#### rblf_file_exists(*file*)
+
+Returns `True`  if *file* exists
+
+#### rblf_wildcard(*glob*, *top* = None)
+
+Expands *glob*. If *top* is supplied, expands "*top*/*glob*", then removes
+"*top*/" prefix from the matching file names.
+
+#### rblf_regex(*pattern*, *text*)
+
+Returns *True* if *text* matches *pattern*.
+
+#### rblf_shell(*command*)
+
+Runs `sh -c "`*command*`"`, reads its output, converts all newlines into spaces, chops trailing newline returns this
+string. This is equivalent to Make's
+`shell` builtin function. *This function will be eventually removed*.
diff --git a/tools/rbcrun/cmd/rbcrun.go b/tools/rbcrun/cmd/rbcrun.go
new file mode 100644
index 0000000..7848562
--- /dev/null
+++ b/tools/rbcrun/cmd/rbcrun.go
@@ -0,0 +1,98 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import (
+	"flag"
+	"fmt"
+	"go.starlark.net/starlark"
+	"os"
+	"rbcrun"
+	"strings"
+)
+
+var (
+	execprog = flag.String("c", "", "execute program `prog`")
+	rootdir  = flag.String("d", ".", "the value of // for load paths")
+	file     = flag.String("f", "", "file to execute")
+	perfFile = flag.String("perf", "", "save performance data")
+)
+
+func main() {
+	flag.Parse()
+	filename := *file
+	var src interface{}
+	var env []string
+
+	rc := 0
+	for _, arg := range flag.Args() {
+		if strings.Contains(arg, "=") {
+			env = append(env, arg)
+		} else if filename == "" {
+			filename = arg
+		} else {
+			quit("only one file can be executed\n")
+		}
+	}
+	if *execprog != "" {
+		if filename != "" {
+			quit("either -c or file name should be present\n")
+		}
+		filename = "<cmdline>"
+		src = *execprog
+	}
+	if filename == "" {
+		if len(env) > 0 {
+			fmt.Fprintln(os.Stderr,
+				"no file to run -- if your file's name contains '=', use -f to specify it")
+		}
+		flag.Usage()
+		os.Exit(1)
+	}
+	if stat, err := os.Stat(*rootdir); os.IsNotExist(err) || !stat.IsDir() {
+		quit("%s is not a directory\n", *rootdir)
+	}
+	if *perfFile != "" {
+		pprof, err := os.Create(*perfFile)
+		if err != nil {
+			quit("%s: err", *perfFile)
+		}
+		defer pprof.Close()
+		if err := starlark.StartProfile(pprof); err != nil {
+			quit("%s\n", err)
+		}
+	}
+	rbcrun.LoadPathRoot = *rootdir
+	err := rbcrun.Run(filename, src, env)
+	if *perfFile != "" {
+		if err2 := starlark.StopProfile(); err2 != nil {
+			fmt.Fprintln(os.Stderr, err2)
+			rc = 1
+		}
+	}
+	if err != nil {
+		if evalErr, ok := err.(*starlark.EvalError); ok {
+			quit("%s\n", evalErr.Backtrace())
+		} else {
+			quit("%s\n", err)
+		}
+	}
+	os.Exit(rc)
+}
+
+func quit(format string, s ...interface{}) {
+	fmt.Fprintln(os.Stderr, format, s)
+	os.Exit(2)
+}
diff --git a/tools/rbcrun/go.mod b/tools/rbcrun/go.mod
new file mode 100644
index 0000000..a029eb4
--- /dev/null
+++ b/tools/rbcrun/go.mod
@@ -0,0 +1,10 @@
+module rbcrun
+
+require (
+	github.com/nbutton23/zxcvbn-go v0.0.0-20180912185939-ae427f1e4c1d // indirect
+	go.starlark.net v0.0.0-20201006213952-227f4aabceb5
+)
+
+replace go.starlark.net => ../../../../external/starlark-go
+
+go 1.15
diff --git a/tools/rbcrun/go.sum b/tools/rbcrun/go.sum
new file mode 100644
index 0000000..db4d51e
--- /dev/null
+++ b/tools/rbcrun/go.sum
@@ -0,0 +1,75 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/chzyer/logex v1.1.10 h1:Swpa1K6QvQznwJRcfTfQJmTE72DqScAa40E+fbHEXEE=
+github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
+github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e h1:fY5BOSpyZCqRo5OhCuC+XN+r/bBCmeuuJtjz+bCNIf8=
+github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
+github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1 h1:q763qf9huN11kDQavWsoZXJNW3xEE4JJyHa5Q25/sd8=
+github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/nbutton23/zxcvbn-go v0.0.0-20180912185939-ae427f1e4c1d h1:AREM5mwr4u1ORQBMvzfzBgpsctsbQikCVpvC+tX285E=
+github.com/nbutton23/zxcvbn-go v0.0.0-20180912185939-ae427f1e4c1d/go.mod h1:o96djdrsSGy3AWPyBgZMAGfxZNfgntdJG+11KU4QvbU=
+github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae h1:Ih9Yo4hSPImZOpfGuA4bR/ORKTAbhZo2AbWNRCnevdo=
+golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f h1:+Nyd8tzPX9R7BWHguqsrbFdRx3WQ/1ib8I44HXV5yTA=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
diff --git a/tools/rbcrun/host.go b/tools/rbcrun/host.go
new file mode 100644
index 0000000..f1697f1
--- /dev/null
+++ b/tools/rbcrun/host.go
@@ -0,0 +1,263 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rbcrun
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strings"
+
+	"go.starlark.net/starlark"
+	"go.starlark.net/starlarkstruct"
+)
+
+const callerDirKey = "callerDir"
+
+var LoadPathRoot = "."
+var shellPath string
+
+type modentry struct {
+	globals starlark.StringDict
+	err     error
+}
+
+var moduleCache = make(map[string]*modentry)
+
+var builtins starlark.StringDict
+
+func moduleName2AbsPath(moduleName string, callerDir string) (string, error) {
+	path := moduleName
+	if ix := strings.LastIndex(path, ":"); ix >= 0 {
+		path = path[0:ix] + string(os.PathSeparator) + path[ix+1:]
+	}
+	if strings.HasPrefix(path, "//") {
+		return filepath.Abs(filepath.Join(LoadPathRoot, path[2:]))
+	} else if strings.HasPrefix(moduleName, ":") {
+		return filepath.Abs(filepath.Join(callerDir, path[1:]))
+	} else {
+		return filepath.Abs(path)
+	}
+}
+
+// loader implements load statement. The format of the loaded module URI is
+//  [//path]:base[|symbol]
+// The file path is $ROOT/path/base if path is present, <caller_dir>/base otherwise.
+// The presence of `|symbol` indicates that the loader should return a single 'symbol'
+// bound to None if file is missing.
+func loader(thread *starlark.Thread, module string) (starlark.StringDict, error) {
+	pipePos := strings.LastIndex(module, "|")
+	mustLoad := pipePos < 0
+	var defaultSymbol string
+	if !mustLoad {
+		defaultSymbol = module[pipePos+1:]
+		module = module[:pipePos]
+	}
+	modulePath, err := moduleName2AbsPath(module, thread.Local(callerDirKey).(string))
+	if err != nil {
+		return nil, err
+	}
+	e, ok := moduleCache[modulePath]
+	if e == nil {
+		if ok {
+			return nil, fmt.Errorf("cycle in load graph")
+		}
+
+		// Add a placeholder to indicate "load in progress".
+		moduleCache[modulePath] = nil
+
+		// Decide if we should load.
+		if !mustLoad {
+			if _, err := os.Stat(modulePath); err == nil {
+				mustLoad = true
+			}
+		}
+
+		// Load or return default
+		if mustLoad {
+			childThread := &starlark.Thread{Name: "exec " + module, Load: thread.Load}
+			// Cheating for the sake of testing:
+			// propagate starlarktest's Reporter key, otherwise testing
+			// the load function may cause panic in starlarktest code.
+			const testReporterKey = "Reporter"
+			if v := thread.Local(testReporterKey); v != nil {
+				childThread.SetLocal(testReporterKey, v)
+			}
+
+			childThread.SetLocal(callerDirKey, filepath.Dir(modulePath))
+			globals, err := starlark.ExecFile(childThread, modulePath, nil, builtins)
+			e = &modentry{globals, err}
+		} else {
+			e = &modentry{starlark.StringDict{defaultSymbol: starlark.None}, nil}
+		}
+
+		// Update the cache.
+		moduleCache[modulePath] = e
+	}
+	return e.globals, e.err
+}
+
+// fileExists returns True if file with given name exists.
+func fileExists(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple,
+	kwargs []starlark.Tuple) (starlark.Value, error) {
+	var path string
+	if err := starlark.UnpackPositionalArgs(b.Name(), args, kwargs, 1, &path); err != nil {
+		return starlark.None, err
+	}
+	if stat, err := os.Stat(path); err != nil || stat.IsDir() {
+		return starlark.False, nil
+	}
+	return starlark.True, nil
+}
+
+// regexMatch(pattern, s) returns True if s matches pattern (a regex)
+func regexMatch(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple,
+	kwargs []starlark.Tuple) (starlark.Value, error) {
+	var pattern, s string
+	if err := starlark.UnpackPositionalArgs(b.Name(), args, kwargs, 2, &pattern, &s); err != nil {
+		return starlark.None, err
+	}
+	match, err := regexp.MatchString(pattern, s)
+	if err != nil {
+		return starlark.None, err
+	}
+	if match {
+		return starlark.True, nil
+	}
+	return starlark.False, nil
+}
+
+// wildcard(pattern, top=None) expands shell's glob pattern. If 'top' is present,
+// the 'top/pattern' is globbed and then 'top/' prefix is removed.
+func wildcard(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple,
+	kwargs []starlark.Tuple) (starlark.Value, error) {
+	var pattern string
+	var top string
+
+	if err := starlark.UnpackPositionalArgs(b.Name(), args, kwargs, 1, &pattern, &top); err != nil {
+		return starlark.None, err
+	}
+
+	var files []string
+	var err error
+	if top == "" {
+		if files, err = filepath.Glob(pattern); err != nil {
+			return starlark.None, err
+		}
+	} else {
+		prefix := top + string(filepath.Separator)
+		if files, err = filepath.Glob(prefix + pattern); err != nil {
+			return starlark.None, err
+		}
+		for i := range files {
+			files[i] = strings.TrimPrefix(files[i], prefix)
+		}
+	}
+	return makeStringList(files), nil
+}
+
+// shell(command) runs OS shell with given command and returns back
+// its output the same way as Make's $(shell ) function. The end-of-lines
+// ("\n" or "\r\n") are replaced with " " in the result, and the trailing
+// end-of-line is removed.
+func shell(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple,
+	kwargs []starlark.Tuple) (starlark.Value, error) {
+	var command string
+	if err := starlark.UnpackPositionalArgs(b.Name(), args, kwargs, 1, &command); err != nil {
+		return starlark.None, err
+	}
+	if shellPath == "" {
+		return starlark.None,
+			fmt.Errorf("cannot run shell, SHELL environment variable is not set (running on Windows?)")
+	}
+	cmd := exec.Command(shellPath, "-c", command)
+	// We ignore command's status
+	bytes, _ := cmd.Output()
+	output := string(bytes)
+	if strings.HasSuffix(output, "\n") {
+		output = strings.TrimSuffix(output, "\n")
+	} else {
+		output = strings.TrimSuffix(output, "\r\n")
+	}
+
+	return starlark.String(
+		strings.ReplaceAll(
+			strings.ReplaceAll(output, "\r\n", " "),
+			"\n", " ")), nil
+}
+
+func makeStringList(items []string) *starlark.List {
+	elems := make([]starlark.Value, len(items))
+	for i, item := range items {
+		elems[i] = starlark.String(item)
+	}
+	return starlark.NewList(elems)
+}
+
+// propsetFromEnv constructs a propset from the array of KEY=value strings
+func structFromEnv(env []string) *starlarkstruct.Struct {
+	sd := make(map[string]starlark.Value, len(env))
+	for _, x := range env {
+		kv := strings.SplitN(x, "=", 2)
+		sd[kv[0]] = starlark.String(kv[1])
+	}
+	return starlarkstruct.FromStringDict(starlarkstruct.Default, sd)
+}
+
+func setup(env []string) {
+	// Create the symbols that aid makefile conversion. See README.md
+	builtins = starlark.StringDict{
+		"struct":   starlark.NewBuiltin("struct", starlarkstruct.Make),
+		"rblf_cli": structFromEnv(env),
+		"rblf_env": structFromEnv(os.Environ()),
+		// To convert makefile's $(wildcard foo)
+		"rblf_file_exists": starlark.NewBuiltin("rblf_file_exists", fileExists),
+		// To convert makefile's $(filter ...)/$(filter-out)
+		"rblf_regex": starlark.NewBuiltin("rblf_regex", regexMatch),
+		// To convert makefile's $(shell cmd)
+		"rblf_shell": starlark.NewBuiltin("rblf_shell", shell),
+		// To convert makefile's $(wildcard foo*)
+		"rblf_wildcard": starlark.NewBuiltin("rblf_wildcard", wildcard),
+	}
+
+	// NOTE(asmundak): OS-specific.
+	shellPath, _ = os.LookupEnv("SHELL")
+}
+
+// Parses, resolves, and executes a Starlark file.
+// filename and src parameters are as for starlark.ExecFile:
+// * filename is the name of the file to execute,
+//   and the name that appears in error messages;
+// * src is an optional source of bytes to use instead of filename
+//   (it can be a string, or a byte array, or an io.Reader instance)
+// * commandVars is an array of "VAR=value" items. They are accessible from
+//   the starlark script as members of the `rblf_cli` propset.
+func Run(filename string, src interface{}, commandVars []string) error {
+	setup(commandVars)
+
+	mainThread := &starlark.Thread{
+		Name:  "main",
+		Print: func(_ *starlark.Thread, msg string) { fmt.Println(msg) },
+		Load:  loader,
+	}
+	absPath, err := filepath.Abs(filename)
+	if err == nil {
+		mainThread.SetLocal(callerDirKey, filepath.Dir(absPath))
+		_, err = starlark.ExecFile(mainThread, absPath, src, builtins)
+	}
+	return err
+}
diff --git a/tools/rbcrun/host_test.go b/tools/rbcrun/host_test.go
new file mode 100644
index 0000000..3be5ee6
--- /dev/null
+++ b/tools/rbcrun/host_test.go
@@ -0,0 +1,159 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rbcrun
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"go.starlark.net/resolve"
+	"go.starlark.net/starlark"
+	"go.starlark.net/starlarktest"
+)
+
+// In order to use "assert.star" from go/starlark.net/starlarktest in the tests,
+// provide:
+//  * load function that handles "assert.star"
+//  * starlarktest.DataFile function that finds its location
+
+func init() {
+	starlarktestSetup()
+}
+
+func starlarktestSetup() {
+	resolve.AllowLambda = true
+	starlarktest.DataFile = func(pkgdir, filename string) string {
+		// The caller expects this function to return the path to the
+		// data file. The implementation assumes that the source file
+		// containing the caller and the data file are in the same
+		// directory. It's ugly. Not sure what's the better way.
+		// TODO(asmundak): handle Bazel case
+		_, starlarktestSrcFile, _, _ := runtime.Caller(1)
+		if filepath.Base(starlarktestSrcFile) != "starlarktest.go" {
+			panic(fmt.Errorf("this function should be called from starlarktest.go, got %s",
+				starlarktestSrcFile))
+		}
+		return filepath.Join(filepath.Dir(starlarktestSrcFile), filename)
+	}
+}
+
+// Common setup for the tests: create thread, change to the test directory
+func testSetup(t *testing.T, env []string) *starlark.Thread {
+	setup(env)
+	thread := &starlark.Thread{
+		Load: func(thread *starlark.Thread, module string) (starlark.StringDict, error) {
+			if module == "assert.star" {
+				return starlarktest.LoadAssertModule()
+			}
+			return nil, fmt.Errorf("load not implemented")
+		}}
+	starlarktest.SetReporter(thread, t)
+	if err := os.Chdir(dataDir()); err != nil {
+		t.Fatal(err)
+	}
+	return thread
+}
+
+func dataDir() string {
+	_, thisSrcFile, _, _ := runtime.Caller(0)
+	return filepath.Join(filepath.Dir(thisSrcFile), "testdata")
+
+}
+
+func exerciseStarlarkTestFile(t *testing.T, starFile string) {
+	// In order to use "assert.star" from go/starlark.net/starlarktest in the tests, provide:
+	//  * load function that handles "assert.star"
+	//  * starlarktest.DataFile function that finds its location
+	setup(nil)
+	thread := &starlark.Thread{
+		Load: func(thread *starlark.Thread, module string) (starlark.StringDict, error) {
+			if module == "assert.star" {
+				return starlarktest.LoadAssertModule()
+			}
+			return nil, fmt.Errorf("load not implemented")
+		}}
+	starlarktest.SetReporter(thread, t)
+	_, thisSrcFile, _, _ := runtime.Caller(0)
+	filename := filepath.Join(filepath.Dir(thisSrcFile), starFile)
+	if _, err := starlark.ExecFile(thread, filename, nil, builtins); err != nil {
+		if err, ok := err.(*starlark.EvalError); ok {
+			t.Fatal(err.Backtrace())
+		}
+		t.Fatal(err)
+	}
+}
+
+func TestCliAndEnv(t *testing.T) {
+	// TODO(asmundak): convert this to use exerciseStarlarkTestFile
+	if err := os.Setenv("TEST_ENVIRONMENT_FOO", "test_environment_foo"); err != nil {
+		t.Fatal(err)
+	}
+	thread := testSetup(t, []string{"CLI_FOO=foo"})
+	if _, err := starlark.ExecFile(thread, "cli_and_env.star", nil, builtins); err != nil {
+		if err, ok := err.(*starlark.EvalError); ok {
+			t.Fatal(err.Backtrace())
+		}
+		t.Fatal(err)
+	}
+}
+
+func TestFileOps(t *testing.T) {
+	// TODO(asmundak): convert this to use exerciseStarlarkTestFile
+	if err := os.Setenv("TEST_DATA_DIR", dataDir()); err != nil {
+		t.Fatal(err)
+	}
+	thread := testSetup(t, nil)
+	if _, err := starlark.ExecFile(thread, "file_ops.star", nil, builtins); err != nil {
+		if err, ok := err.(*starlark.EvalError); ok {
+			t.Fatal(err.Backtrace())
+		}
+		t.Fatal(err)
+	}
+}
+
+func TestLoad(t *testing.T) {
+	// TODO(asmundak): convert this to use exerciseStarlarkTestFile
+	thread := testSetup(t, nil)
+	thread.Load = func(thread *starlark.Thread, module string) (starlark.StringDict, error) {
+		if module == "assert.star" {
+			return starlarktest.LoadAssertModule()
+		} else {
+			return loader(thread, module)
+		}
+	}
+	dir := dataDir()
+	thread.SetLocal(callerDirKey, dir)
+	LoadPathRoot = filepath.Dir(dir)
+	if _, err := starlark.ExecFile(thread, "load.star", nil, builtins); err != nil {
+		if err, ok := err.(*starlark.EvalError); ok {
+			t.Fatal(err.Backtrace())
+		}
+		t.Fatal(err)
+	}
+}
+
+func TestRegex(t *testing.T) {
+	exerciseStarlarkTestFile(t, "testdata/regex.star")
+}
+
+func TestShell(t *testing.T) {
+	if err := os.Setenv("TEST_DATA_DIR", dataDir()); err != nil {
+		t.Fatal(err)
+	}
+	exerciseStarlarkTestFile(t, "testdata/shell.star")
+}
diff --git a/tools/rbcrun/testdata/cli_and_env.star b/tools/rbcrun/testdata/cli_and_env.star
new file mode 100644
index 0000000..d6f464a
--- /dev/null
+++ b/tools/rbcrun/testdata/cli_and_env.star
@@ -0,0 +1,11 @@
+# Tests rblf_env access
+load("assert.star", "assert")
+
+
+def test():
+    assert.eq(rblf_env.TEST_ENVIRONMENT_FOO, "test_environment_foo")
+    assert.fails(lambda: rblf_env.FOO_BAR_BAZ, ".*struct has no .FOO_BAR_BAZ attribute$")
+    assert.eq(rblf_cli.CLI_FOO, "foo")
+
+
+test()
diff --git a/tools/rbcrun/testdata/file_ops.star b/tools/rbcrun/testdata/file_ops.star
new file mode 100644
index 0000000..e1f1ac2
--- /dev/null
+++ b/tools/rbcrun/testdata/file_ops.star
@@ -0,0 +1,18 @@
+# Tests file ops builtins
+load("assert.star", "assert")
+
+
+def test():
+    myname = "file_ops.star"
+    assert.true(rblf_file_exists(myname), "the file %s does exist" % myname)
+    assert.true(not rblf_file_exists("no_such_file"), "the file no_such_file does not exist")
+    files = rblf_wildcard("*.star")
+    assert.true(myname in files, "expected %s in  %s" % (myname, files))
+    # RBCDATADIR is set by the caller to the path where this file resides
+    files = rblf_wildcard("*.star", rblf_env.TEST_DATA_DIR)
+    assert.true(myname in files, "expected %s in %s" % (myname, files))
+    files = rblf_wildcard("*.xxx")
+    assert.true(len(files) == 0, "expansion should be empty but contains %s" % files)
+
+
+test()
diff --git a/tools/rbcrun/testdata/load.star b/tools/rbcrun/testdata/load.star
new file mode 100644
index 0000000..b14f2bb
--- /dev/null
+++ b/tools/rbcrun/testdata/load.star
@@ -0,0 +1,14 @@
+# Test load, simple and conditional
+load("assert.star", "assert")
+load(":module1.star", test1="test")
+load("//testdata:module2.star", test2="test")
+load(":module3|test", test3="test")
+
+
+def test():
+    assert.eq(test1, "module1")
+    assert.eq(test2, "module2")
+    assert.eq(test3, None)
+
+
+test()
diff --git a/tools/rbcrun/testdata/module1.star b/tools/rbcrun/testdata/module1.star
new file mode 100644
index 0000000..913fb7d
--- /dev/null
+++ b/tools/rbcrun/testdata/module1.star
@@ -0,0 +1,7 @@
+# Module loaded my load.star
+load("assert.star", "assert")
+
+# Make sure that builtins are defined for the loaded module, too
+assert.true(rblf_file_exists("module1.star"))
+assert.true(not rblf_file_exists("no_such file"))
+test = "module1"
diff --git a/tools/rbcrun/testdata/module2.star b/tools/rbcrun/testdata/module2.star
new file mode 100644
index 0000000..f6818a2
--- /dev/null
+++ b/tools/rbcrun/testdata/module2.star
@@ -0,0 +1,2 @@
+# Module loaded my load.star
+test = "module2"
diff --git a/tools/rbcrun/testdata/regex.star b/tools/rbcrun/testdata/regex.star
new file mode 100644
index 0000000..04e1d42
--- /dev/null
+++ b/tools/rbcrun/testdata/regex.star
@@ -0,0 +1,13 @@
+# Tests rblf_regex
+load("assert.star", "assert")
+
+
+def test():
+    pattern = "^(foo.*bar|abc.*d|1.*)$"
+    for w in ("foobar", "fooxbar", "abcxd", "123"):
+        assert.true(rblf_regex(pattern, w), "%s should match %s" % (w, pattern))
+    for w in ("afoobar", "abcde"):
+        assert.true(not rblf_regex(pattern, w), "%s should not match %s" % (w, pattern))
+
+
+test()
diff --git a/tools/rbcrun/testdata/shell.star b/tools/rbcrun/testdata/shell.star
new file mode 100644
index 0000000..ad10697
--- /dev/null
+++ b/tools/rbcrun/testdata/shell.star
@@ -0,0 +1,5 @@
+# Tests "queue" data type
+load("assert.star", "assert")
+
+assert.eq("load.star shell.star", rblf_shell("cd %s && ls -1 shell.star load.star 2>&1" % rblf_env.TEST_DATA_DIR))
+assert.eq("shell.star", rblf_shell("cd %s && echo shell.sta*" % rblf_env.TEST_DATA_DIR))