diff --git a/.buildkite/pipeline.yaml b/.buildkite/pipeline.yaml
index df5fd7c12c..4e71dbf783 100644
--- a/.buildkite/pipeline.yaml
+++ b/.buildkite/pipeline.yaml
@@ -80,6 +80,12 @@ steps:
       GLIBC_TUNABLES: glibc.pthread.rseq=0
     label: ":fire: Smoke race tests"
     command: make smoke-race-tests
+  - <<: *common
+    <<: *source_test
+    label: ":speedboat: Compile runsc-plugin-stack (AMD64)"
+    command: make runsc-plugin-stack
+    agents:
+      arch: "amd64"
 
   # Build runsc and pkg (presubmits only).
   - <<: *common
diff --git a/Makefile b/Makefile
index cc314f5316..a2fcf38333 100644
--- a/Makefile
+++ b/Makefile
@@ -200,6 +200,10 @@ runsc: ## Builds the runsc binary.
 	@$(call build,-c opt //runsc)
 .PHONY: runsc
 
+runsc-plugin-stack:
+	@$(call build,-c opt $(PLUGIN_STACK_FLAGS) //runsc:runsc-plugin-stack)
+.PHONY: runsc-plugin-stack
+
 debian: ## Builds the debian packages.
 	@$(call build,-c opt //debian:debian)
 .PHONY: debian
diff --git a/WORKSPACE b/WORKSPACE
index fdeb84023a..808a1b3c70 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -199,6 +199,7 @@ register_toolchains("//:cc_toolchain_k8", "//:cc_toolchain_aarch64")
 
 # Load LLVM dependencies.
 LLVM_COMMIT = "926f85db98aae66ab8f57b9981f47ddddb868c51"
+
 LLVM_SHA256 = "c78c94b2a03b2cf6ef1ba035c31a6f1b0bb7913da8af5aa8d5c2061f6499d589"
 
 http_archive(
@@ -239,12 +240,12 @@ maybe(
 
 # Load other C++ dependencies.
 http_archive(
-  name = "nlohmann_json",
-  sha256 = "ba6e7817353793d13e5214ed819ea5b0defc0ffb2a348f4e34b10ac6f1c50154",
-  strip_prefix = "json-960b763ecd144f156d05ec61f577b04107290137",
-  urls = [
-    "https://github.com/nlohmann/json/archive/960b763ecd144f156d05ec61f577b04107290137.tar.gz"
-  ]
+    name = "nlohmann_json",
+    sha256 = "ba6e7817353793d13e5214ed819ea5b0defc0ffb2a348f4e34b10ac6f1c50154",
+    strip_prefix = "json-960b763ecd144f156d05ec61f577b04107290137",
+    urls = [
+        "https://github.com/nlohmann/json/archive/960b763ecd144f156d05ec61f577b04107290137.tar.gz",
+    ],
 )
 
 http_archive(
@@ -3355,6 +3356,6 @@ go_repository(
 
 new_local_repository(
     name = "libpluginstack",
-    path = "tools/plugin-stack",
     build_file = "tools/plugin-stack/plugin-stack.BUILD",
+    path = "external/tools/plugin-stack",
 )
diff --git a/tools/plugin-stack/plugin-stack.BUILD b/external/tools/plugin-stack/plugin-stack.BUILD
similarity index 57%
rename from tools/plugin-stack/plugin-stack.BUILD
rename to external/tools/plugin-stack/plugin-stack.BUILD
index 493b1d9b49..6dcf797d13 100644
--- a/tools/plugin-stack/plugin-stack.BUILD
+++ b/external/tools/plugin-stack/plugin-stack.BUILD
@@ -6,12 +6,12 @@ config_setting(
 genrule(
     name = "pluginstack_genrule",
     outs = ["libpluginstack.a"],
-    local = 1,
     cmd = select({
         # Support IVB and later machines.
-        ":plugin_tldk_condition": "git clone git@github.com:alipay/tldk.git; cd tldk; git checkout 9efb0dacb67da1da62ca78785e8cffb0c5a82785; make -j 1 DPDK_MACHINE=ivb EXTRA_CFLAGS='-g -O3 -fPIC -fno-omit-frame-pointer -DLOOK_ASIDE_BACKEND -Wno-error' all; cd ..; cp -f tldk/libtldk.a $(RULEDIR)/libpluginstack.a",
+        ":plugin_tldk_condition": "git clone https://github.com/avagin/tldk.git; cd tldk; git checkout 79c6a4f90faa9058cbe721b31875d1d810b6f32c; make -j 1 DPDK_MACHINE=ivb EXTRA_CFLAGS='-g -O3 -fPIC -fno-omit-frame-pointer -DLOOK_ASIDE_BACKEND -Wno-error -Wno-use-after-free' all; cd ..; cp -f tldk/libtldk.a $(RULEDIR)/libpluginstack.a",
         "//conditions:default": "",
     }),
+    local = 1,
     visibility = ["//visibility:public"],
 )
 
diff --git a/images/default/Dockerfile b/images/default/Dockerfile
index 9ae7005d08..a800cd1f47 100644
--- a/images/default/Dockerfile
+++ b/images/default/Dockerfile
@@ -9,7 +9,7 @@ RUN apt-get update && apt-get install -y curl gnupg2 git \
         software-properties-common \
         pkg-config libffi-dev patch diffutils libssl-dev iptables kmod \
         clang crossbuild-essential-amd64 erofs-utils busybox-static libbpf-dev \
-        iproute2 netcat
+        iproute2 netcat libnuma-dev
 
 # This package is needed to build eBPF on amd64, but not on arm64 where it
 # doesn't exist.
diff --git a/tools/bazel.mk b/tools/bazel.mk
index 6d3372cf48..cae1e7a331 100644
--- a/tools/bazel.mk
+++ b/tools/bazel.mk
@@ -48,6 +48,7 @@ BRANCH_NAME := $(shell (git branch --show-current 2>/dev/null || \
   xargs -n 1 basename 2>/dev/null)
 BUILD_ROOTS := bazel-bin/ bazel-out/
 RACE_FLAGS := --config=race
+PLUGIN_STACK_FLAGS := --config=plugin-tldk
 
 # Bazel container configuration (see below).
 USER := $(shell whoami)