diff --git a/sandboxed_api/BUILD.bazel b/sandboxed_api/BUILD.bazel
index 302f702..5717df9 100644
--- a/sandboxed_api/BUILD.bazel
+++ b/sandboxed_api/BUILD.bazel
@@ -47,6 +47,7 @@ cc_library(
         "//sandboxed_api/sandbox2:util",
         "//sandboxed_api/util:fileops",
         "//sandboxed_api/util:raw_logging",
+        "@com_google_absl//absl/base:core_headers",
         "@com_google_absl//absl/container:flat_hash_map",
         "@com_google_absl//absl/strings",
         "@com_google_absl//absl/synchronization",
@@ -82,11 +83,11 @@ cc_library(
         "//sandboxed_api/util:raw_logging",
         "//sandboxed_api/util:runfiles",
         "//sandboxed_api/util:status",
-        "@com_google_absl//absl/base",
         "@com_google_absl//absl/base:core_headers",
         "@com_google_absl//absl/base:dynamic_annotations",
         "@com_google_absl//absl/container:flat_hash_map",
         "@com_google_absl//absl/log",
+        "@com_google_absl//absl/log:check",
         "@com_google_absl//absl/status",
         "@com_google_absl//absl/status:statusor",
         "@com_google_absl//absl/strings",
@@ -101,10 +102,7 @@ cc_library(
     name = "call",
     hdrs = ["call.h"],
     copts = sapi_platform_copts(),
-    deps = [
-        ":var_type",
-        "@com_google_absl//absl/base:core_headers",
-    ],
+    deps = [":var_type"],
 )
 
 cc_library(
@@ -188,6 +186,7 @@ cc_library(
         "@com_google_absl//absl/log",
         "@com_google_absl//absl/log:check",
         "@com_google_absl//absl/log:initialize",
+        "@com_google_absl//absl/status:statusor",
         "@com_google_absl//absl/strings",
         "@com_google_protobuf//:protobuf",
         "@org_sourceware_libffi//:libffi",
@@ -205,9 +204,10 @@ cc_test(
         "//sandboxed_api/examples/stringop:stringop-sapi",
         "//sandboxed_api/examples/stringop:stringop_params_cc_proto",
         "//sandboxed_api/examples/sum:sum-sapi",
-        "//sandboxed_api/examples/sum:sum-sapi_embed",
         "//sandboxed_api/util:status_matchers",
         "@com_google_absl//absl/status",
+        "@com_google_absl//absl/status:statusor",
+        "@com_google_absl//absl/time",
         "@com_google_benchmark//:benchmark",
         "@com_google_googletest//:gtest_main",
     ],
diff --git a/sandboxed_api/CMakeLists.txt b/sandboxed_api/CMakeLists.txt
index 702aa87..1a8361b 100644
--- a/sandboxed_api/CMakeLists.txt
+++ b/sandboxed_api/CMakeLists.txt
@@ -52,7 +52,8 @@ add_library(sapi_embed_file ${SAPI_LIB_TYPE}
 )
 add_library(sapi::embed_file ALIAS sapi_embed_file)
 target_link_libraries(sapi_embed_file
-  PRIVATE absl::strings
+  PRIVATE absl::core_headers
+          absl::strings
           sandbox2::util
           sapi::base
           sapi::fileops
@@ -85,7 +86,8 @@ target_link_libraries(sapi_sapi
           sandbox2::util
           sapi::embed_file
           sapi::vars
-  PUBLIC absl::core_headers
+  PUBLIC absl::check
+         absl::core_headers
          sandbox2::client
          sandbox2::sandbox2
          sapi::base
@@ -98,7 +100,6 @@ add_library(sapi_call ${SAPI_LIB_TYPE}
 )
 add_library(sapi::call ALIAS sapi_call)
 target_link_libraries(sapi_call PRIVATE
-  absl::core_headers
   sapi::var_type
   sapi::base
 )
@@ -166,10 +167,13 @@ add_library(sapi_client ${SAPI_LIB_TYPE}
 )
 add_library(sapi::client ALIAS sapi_client)
 target_link_libraries(sapi_client
-  PRIVATE absl::core_headers
+  PRIVATE absl::check
+          absl::core_headers
           absl::dynamic_annotations
           absl::flags_parse
+          absl::log
           absl::log_initialize
+          absl::statusor
           absl::strings
           libffi::libffi
           sandbox2::comms
@@ -181,8 +185,6 @@ target_link_libraries(sapi_client
           sapi::proto_arg_proto
           sapi::vars
           ${CMAKE_DL_LIBS}
-  PUBLIC absl::check
-         absl::log
 )
 
 if(BUILD_TESTING AND SAPI_BUILD_TESTING AND NOT CMAKE_CROSSCOMPILING)
@@ -208,6 +210,7 @@ if(BUILD_TESTING AND SAPI_BUILD_TESTING AND NOT CMAKE_CROSSCOMPILING)
   target_link_libraries(sapi_test PRIVATE
     absl::status
     absl::statusor
+    absl::time
     benchmark
     sandbox2::result
     sapi::proto_arg_proto
diff --git a/sandboxed_api/bazel/BUILD b/sandboxed_api/bazel/BUILD
index ae84701..0396047 100644
--- a/sandboxed_api/bazel/BUILD
+++ b/sandboxed_api/bazel/BUILD
@@ -57,3 +57,9 @@ bzl_library(
     srcs = ["sapi.bzl"],
     visibility = ["//visibility:private"],
 )
+
+bzl_library(
+    name = "llvm_config_bzl",
+    srcs = ["llvm_config.bzl"],
+    visibility = ["//visibility:private"],
+)
diff --git a/sandboxed_api/call.h b/sandboxed_api/call.h
index 2aec92c..6709925 100644
--- a/sandboxed_api/call.h
+++ b/sandboxed_api/call.h
@@ -15,6 +15,7 @@
 #ifndef SANDBOXED_API_CALL_H_
 #define SANDBOXED_API_CALL_H_
 
+#include <cstddef>
 #include <cstdint>
 
 #include "sandboxed_api/var_type.h"
diff --git a/sandboxed_api/client.cc b/sandboxed_api/client.cc
index 7515566..8aa3244 100644
--- a/sandboxed_api/client.cc
+++ b/sandboxed_api/client.cc
@@ -13,7 +13,8 @@
 // limitations under the License.
 
 #include <dlfcn.h>
-#include <sys/syscall.h>
+#include <syscall.h>
+#include <unistd.h>
 
 #include <algorithm>
 #include <cstdint>
@@ -21,6 +22,7 @@
 #include <cstring>
 #include <iterator>
 #include <list>
+#include <string>
 #include <type_traits>
 #include <utility>
 #include <vector>
@@ -33,6 +35,7 @@
 #include "absl/log/check.h"
 #include "absl/log/initialize.h"
 #include "absl/log/log.h"
+#include "absl/status/statusor.h"
 #include "absl/strings/str_cat.h"
 #include "sandboxed_api/call.h"
 #include "sandboxed_api/lenval_core.h"
diff --git a/sandboxed_api/config.h b/sandboxed_api/config.h
index da1b2de..caa8966 100644
--- a/sandboxed_api/config.h
+++ b/sandboxed_api/config.h
@@ -15,6 +15,7 @@
 #ifndef SANDBOXED_API_CONFIG_H_
 #define SANDBOXED_API_CONFIG_H_
 
+#include <features.h>
 #include <cstdint>
 #include <string>
 
diff --git a/sandboxed_api/embed_file.cc b/sandboxed_api/embed_file.cc
index d7413f4..62dfc5a 100644
--- a/sandboxed_api/embed_file.cc
+++ b/sandboxed_api/embed_file.cc
@@ -16,10 +16,10 @@
 
 #include <fcntl.h>
 #include <sys/stat.h>
-#include <sys/syscall.h>
-#include <sys/types.h>
 #include <unistd.h>
 
+#include <string>
+
 #include "sandboxed_api/file_toc.h"
 #include "absl/strings/str_cat.h"
 #include "absl/synchronization/mutex.h"
diff --git a/sandboxed_api/embed_file.h b/sandboxed_api/embed_file.h
index 89ac606..131da31 100644
--- a/sandboxed_api/embed_file.h
+++ b/sandboxed_api/embed_file.h
@@ -16,6 +16,7 @@
 #define SANDBOXED_API_EMBED_FILE_H_
 
 #include "sandboxed_api/file_toc.h"
+#include "absl/base/thread_annotations.h"
 #include "absl/container/flat_hash_map.h"
 #include "absl/synchronization/mutex.h"
 
diff --git a/sandboxed_api/examples/stringop/BUILD.bazel b/sandboxed_api/examples/stringop/BUILD.bazel
index 12cf735..e337152 100644
--- a/sandboxed_api/examples/stringop/BUILD.bazel
+++ b/sandboxed_api/examples/stringop/BUILD.bazel
@@ -76,8 +76,10 @@ cc_test(
         "//sandboxed_api/util:status",
         "//sandboxed_api/util:status_matchers",
         "@com_google_absl//absl/log",
+        "@com_google_absl//absl/memory",
         "@com_google_absl//absl/status",
-        "@com_google_absl//absl/time",
+        "@com_google_absl//absl/status:statusor",
+        "@com_google_absl//absl/strings:string_view",
         "@com_google_googletest//:gtest_main",
     ],
 )
diff --git a/sandboxed_api/examples/stringop/CMakeLists.txt b/sandboxed_api/examples/stringop/CMakeLists.txt
index e5b6085..e65e0e9 100644
--- a/sandboxed_api/examples/stringop/CMakeLists.txt
+++ b/sandboxed_api/examples/stringop/CMakeLists.txt
@@ -71,9 +71,10 @@ if(SAPI_BUILD_TESTING)
   )
   set_target_properties(sapi_main_stringop PROPERTIES OUTPUT_NAME main_stringop)
   target_link_libraries(sapi_main_stringop PRIVATE
-    absl::strings
-    absl::time
+    absl::memory
     absl::log
+    absl::statusor
+    absl::strings
     sapi::sapi
     sapi::status
     sapi::stringop_sapi
diff --git a/sandboxed_api/examples/stringop/main_stringop.cc b/sandboxed_api/examples/stringop/main_stringop.cc
index 3aaa4a5..dfc8e09 100644
--- a/sandboxed_api/examples/stringop/main_stringop.cc
+++ b/sandboxed_api/examples/stringop/main_stringop.cc
@@ -12,17 +12,16 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#include <fcntl.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-
-#include <memory>
+#include <cstring>
+#include <string>
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
 #include "absl/log/log.h"
+#include "absl/memory/memory.h"
 #include "absl/status/status.h"
-#include "absl/time/time.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
 #include "sandboxed_api/examples/stringop/stringop_params.pb.h"
 #include "sandboxed_api/transaction.h"
 #include "sandboxed_api/util/status_macros.h"
diff --git a/sandboxed_api/examples/stringop/stringop.cc b/sandboxed_api/examples/stringop/stringop.cc
index 502b283..e3e704a 100644
--- a/sandboxed_api/examples/stringop/stringop.cc
+++ b/sandboxed_api/examples/stringop/stringop.cc
@@ -15,10 +15,10 @@
 #include <sys/ptrace.h>
 
 #include <algorithm>
-#include <iostream>
+#include <cstdlib>
+#include <string>
 
 #include "absl/base/attributes.h"
-#include "absl/base/optimization.h"
 #include "sandboxed_api/examples/stringop/stringop_params.pb.h"
 #include "sandboxed_api/lenval_core.h"
 
diff --git a/sandboxed_api/examples/sum/BUILD.bazel b/sandboxed_api/examples/sum/BUILD.bazel
index b00c8c8..803ca15 100644
--- a/sandboxed_api/examples/sum/BUILD.bazel
+++ b/sandboxed_api/examples/sum/BUILD.bazel
@@ -82,14 +82,15 @@ cc_binary(
         ":sum_params_cc_proto",
         "//sandboxed_api:sapi",
         "//sandboxed_api:vars",
+        "@com_google_absl//absl/base:core_headers",
         "@com_google_absl//absl/base:log_severity",
-        "@com_google_absl//absl/flags:flag",
         "@com_google_absl//absl/flags:parse",
         "@com_google_absl//absl/log",
         "@com_google_absl//absl/log:check",
         "@com_google_absl//absl/log:globals",
         "@com_google_absl//absl/log:initialize",
         "@com_google_absl//absl/status",
+        "@com_google_absl//absl/status:statusor",
         "@com_google_absl//absl/strings",
     ],
 )
diff --git a/sandboxed_api/examples/sum/CMakeLists.txt b/sandboxed_api/examples/sum/CMakeLists.txt
index 7986fe9..c5e71eb 100644
--- a/sandboxed_api/examples/sum/CMakeLists.txt
+++ b/sandboxed_api/examples/sum/CMakeLists.txt
@@ -78,10 +78,12 @@ add_executable(sapi_main_sum
 set_target_properties(sapi_main_sum PROPERTIES OUTPUT_NAME main_sum)
 add_executable(sapi::main_sum ALIAS sapi_main_sum)
 target_link_libraries(sapi_main_sum PRIVATE
+  absl::core_headers
   absl::log
   absl::log_initialize
-  absl::flags
   absl::flags_parse
+  absl::status
+  absl::statusor
   absl::strings
   sapi::base
   sapi::sapi
diff --git a/sandboxed_api/examples/sum/main_sum.cc b/sandboxed_api/examples/sum/main_sum.cc
index 2f5da37..6ed74a4 100644
--- a/sandboxed_api/examples/sum/main_sum.cc
+++ b/sandboxed_api/examples/sum/main_sum.cc
@@ -13,19 +13,22 @@
 // limitations under the License.
 
 #include <fcntl.h>
-#include <sys/stat.h>
-#include <sys/types.h>
 
+#include <cstring>
+#include <ctime>
 #include <memory>
+#include <string>
+#include <utility>
 
 #include "absl/base/log_severity.h"
-#include "absl/flags/flag.h"
+#include "absl/base/macros.h"
 #include "absl/flags/parse.h"
 #include "absl/log/check.h"
 #include "absl/log/globals.h"
 #include "absl/log/initialize.h"
 #include "absl/log/log.h"
 #include "absl/status/status.h"
+#include "absl/status/statusor.h"
 #include "absl/strings/str_cat.h"
 #include "sandboxed_api/examples/sum/sum-sapi.sapi.h"
 #include "sandboxed_api/examples/sum/sum_params.pb.h"
diff --git a/sandboxed_api/examples/sum/sum.c b/sandboxed_api/examples/sum/sum.c
index 3600c49..c87bed9 100644
--- a/sandboxed_api/examples/sum/sum.c
+++ b/sandboxed_api/examples/sum/sum.c
@@ -13,10 +13,9 @@
 // limitations under the License.
 
 #include <stdio.h>
-#include <stdint.h>
-#include <unistd.h>
 #include <stdlib.h>
 #include <sys/ptrace.h>
+#include <unistd.h>
 
 int sumsymbol = 5;
 
diff --git a/sandboxed_api/examples/zlib/BUILD.bazel b/sandboxed_api/examples/zlib/BUILD.bazel
index 6047246..2193264 100644
--- a/sandboxed_api/examples/zlib/BUILD.bazel
+++ b/sandboxed_api/examples/zlib/BUILD.bazel
@@ -44,11 +44,12 @@ cc_binary(
         ":zlib-sapi",
         "//sandboxed_api:vars",
         "@com_google_absl//absl/base:core_headers",
-        "@com_google_absl//absl/flags:flag",
+        "@com_google_absl//absl/base:log_severity",
         "@com_google_absl//absl/flags:parse",
         "@com_google_absl//absl/log",
         "@com_google_absl//absl/log:globals",
         "@com_google_absl//absl/log:initialize",
+        "@com_google_absl//absl/status",
         "@com_google_absl//absl/status:statusor",
     ],
 )
diff --git a/sandboxed_api/examples/zlib/CMakeLists.txt b/sandboxed_api/examples/zlib/CMakeLists.txt
index 5be549a..df10b10 100644
--- a/sandboxed_api/examples/zlib/CMakeLists.txt
+++ b/sandboxed_api/examples/zlib/CMakeLists.txt
@@ -34,11 +34,12 @@ add_executable(sapi_main_zlib
 set_target_properties(sapi_main_zlib PROPERTIES OUTPUT_NAME main_zlib)
 target_link_libraries(sapi_main_zlib PRIVATE
   sapi::base
-  absl::flags
   absl::flags_parse
   absl::log
   absl::log_initialize
+  absl::log_severity
   absl::status
+  absl::statusor
   sapi::sapi
   sapi::status
   sapi::zlib_sapi
diff --git a/sandboxed_api/examples/zlib/main_zlib.cc b/sandboxed_api/examples/zlib/main_zlib.cc
index 9360260..cf1bc55 100644
--- a/sandboxed_api/examples/zlib/main_zlib.cc
+++ b/sandboxed_api/examples/zlib/main_zlib.cc
@@ -12,17 +12,17 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#include <linux/audit.h>
-#include <sys/syscall.h>
-
+#include <cassert>
+#include <cstdio>
 #include <cstdlib>
 
+#include "absl/base/log_severity.h"
 #include "absl/base/macros.h"
-#include "absl/flags/flag.h"
 #include "absl/flags/parse.h"
 #include "absl/log/globals.h"
 #include "absl/log/initialize.h"
 #include "absl/log/log.h"
+#include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "sandboxed_api/examples/zlib/zlib-sapi.sapi.h"
 #include "sandboxed_api/vars.h"
diff --git a/sandboxed_api/file_toc.h b/sandboxed_api/file_toc.h
index 71b6629..49c81c4 100644
--- a/sandboxed_api/file_toc.h
+++ b/sandboxed_api/file_toc.h
@@ -22,6 +22,8 @@
 
 #include <sys/types.h>
 
+#include <cstddef>
+
 struct FileToc {
   const char* name;
   const char* data;
diff --git a/sandboxed_api/proto_helper.cc b/sandboxed_api/proto_helper.cc
index 21eb0d5..868033d 100644
--- a/sandboxed_api/proto_helper.cc
+++ b/sandboxed_api/proto_helper.cc
@@ -14,7 +14,13 @@
 
 #include "sandboxed_api/proto_helper.h"
 
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <vector>
+
 #include "absl/status/status.h"
+#include "absl/status/statusor.h"
 
 namespace sapi {
 
diff --git a/sandboxed_api/proto_helper.h b/sandboxed_api/proto_helper.h
index 23819d8..267bbba 100644
--- a/sandboxed_api/proto_helper.h
+++ b/sandboxed_api/proto_helper.h
@@ -17,7 +17,8 @@
 #ifndef SANDBOXED_API_PROTO_HELPER_H_
 #define SANDBOXED_API_PROTO_HELPER_H_
 
-#include <cinttypes>
+#include <cstddef>
+#include <cstdint>
 #include <type_traits>
 #include <vector>
 
diff --git a/sandboxed_api/rpcchannel.cc b/sandboxed_api/rpcchannel.cc
index eb61665..7eeb447 100644
--- a/sandboxed_api/rpcchannel.cc
+++ b/sandboxed_api/rpcchannel.cc
@@ -14,7 +14,12 @@
 
 #include "sandboxed_api/rpcchannel.h"
 
+#include <cstdint>
+#include <cstring>
+#include <string>
+
 #include "absl/log/log.h"
+#include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/str_cat.h"
 #include "absl/synchronization/mutex.h"
diff --git a/sandboxed_api/rpcchannel.h b/sandboxed_api/rpcchannel.h
index 803be3a..defe4e8 100644
--- a/sandboxed_api/rpcchannel.h
+++ b/sandboxed_api/rpcchannel.h
@@ -16,6 +16,7 @@
 #define SANDBOXED_API_RPCCHANNEL_H_
 
 #include <cstddef>
+#include <cstdint>
 
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
diff --git a/sandboxed_api/sandbox.cc b/sandboxed_api/sandbox.cc
index c452af3..b134ac9 100644
--- a/sandboxed_api/sandbox.cc
+++ b/sandboxed_api/sandbox.cc
@@ -14,16 +14,18 @@
 
 #include "sandboxed_api/sandbox.h"
 
-#include <sys/ioctl.h>
 #include <sys/resource.h>
+#include <sys/types.h>
 #include <sys/uio.h>
+#include <syscall.h>
 
-#include <algorithm>
-#include <cstdarg>
 #include <cstdio>
+#include <initializer_list>
 #include <memory>
+#include <string>
+#include <utility>
+#include <vector>
 
-#include "absl/base/casts.h"
 #include "absl/base/dynamic_annotations.h"
 #include "absl/base/macros.h"
 #include "absl/log/log.h"
diff --git a/sandboxed_api/sandbox.h b/sandboxed_api/sandbox.h
index e2126df..a3f7900 100644
--- a/sandboxed_api/sandbox.h
+++ b/sandboxed_api/sandbox.h
@@ -15,13 +15,20 @@
 #ifndef SANDBOXED_API_SANDBOX_H_
 #define SANDBOXED_API_SANDBOX_H_
 
+#include <ctime>
+#include <initializer_list>
 #include <memory>
 #include <string>
+#include <utility>
 #include <vector>
 
 #include "sandboxed_api/file_toc.h"
+#include "absl/base/attributes.h"
 #include "absl/base/macros.h"
+#include "absl/log/log.h"
+#include "absl/status/status.h"
 #include "absl/status/statusor.h"
+#include "absl/time/time.h"
 #include "sandboxed_api/config.h"
 #include "sandboxed_api/rpcchannel.h"
 #include "sandboxed_api/sandbox2/client.h"
diff --git a/sandboxed_api/sandbox2/BUILD.bazel b/sandboxed_api/sandbox2/BUILD.bazel
index 39df77f..51d2977 100644
--- a/sandboxed_api/sandbox2/BUILD.bazel
+++ b/sandboxed_api/sandbox2/BUILD.bazel
@@ -116,7 +116,7 @@ cc_library(
         ":util",
         "//sandboxed_api:config",
         "@com_google_absl//absl/algorithm:container",
-        "@com_google_absl//absl/log",
+        "@com_google_absl//absl/status:statusor",
         "@com_google_absl//absl/strings",
         "@com_google_absl//absl/strings:str_format",
         "@com_google_absl//absl/types:span",
@@ -147,7 +147,6 @@ cc_library(
         ":util",
         "//sandboxed_api:config",
         "@com_google_absl//absl/status",
-        "@com_google_absl//absl/status:statusor",
         "@com_google_absl//absl/strings",
     ],
 )
@@ -179,6 +178,7 @@ cc_library(
     deps = [
         ":comms",
         ":logserver_cc_proto",
+        "@com_google_absl//absl/base:log_severity",
         "@com_google_absl//absl/log:log_entry",
         "@com_google_absl//absl/log:log_sink",
         "@com_google_absl//absl/log:log_sink_registry",
@@ -198,6 +198,7 @@ cc_library(
         ":logserver",
         ":logsink",
         "//sandboxed_api/util:raw_logging",
+        "@com_google_absl//absl/base:core_headers",
         "@com_google_absl//absl/log",
         "@com_google_absl//absl/strings",
     ],
@@ -218,9 +219,9 @@ cc_library(
         "//sandboxed_api/sandbox2/network_proxy:filtering",
         "//sandboxed_api/sandbox2/util:bpf_helper",
         "//sandboxed_api/util:raw_logging",
-        "@com_google_absl//absl/base:core_headers",
         "@com_google_absl//absl/flags:flag",
         "@com_google_absl//absl/log",
+        "@com_google_absl//absl/strings:string_view",
     ],
 )
 
@@ -262,7 +263,9 @@ cc_binary(
         ":sanitizer",
         "//sandboxed_api/sandbox2/unwind",
         "//sandboxed_api/util:raw_logging",
+        "@com_google_absl//absl/base:log_severity",
         "@com_google_absl//absl/log:globals",
+        "@com_google_absl//absl/status",
     ],
 )
 
@@ -333,6 +336,7 @@ cc_library(
         "@com_google_absl//absl/log",
         "@com_google_absl//absl/log:check",
         "@com_google_absl//absl/status",
+        "@com_google_absl//absl/status:statusor",
         "@com_google_absl//absl/strings",
         "@com_google_absl//absl/types:span",
     ],
@@ -425,10 +429,12 @@ cc_library(
         "@com_google_absl//absl/cleanup",
         "@com_google_absl//absl/flags:flag",
         "@com_google_absl//absl/log",
+        "@com_google_absl//absl/log:check",
         "@com_google_absl//absl/memory",
         "@com_google_absl//absl/status",
         "@com_google_absl//absl/status:statusor",
         "@com_google_absl//absl/strings",
+        "@com_google_absl//absl/time",
     ],
 )
 
@@ -452,13 +458,17 @@ cc_library(
         "//sandboxed_api:config",
         "//sandboxed_api/util:raw_logging",
         "//sandboxed_api/util:status",
+        "@com_google_absl//absl/base:core_headers",
         "@com_google_absl//absl/cleanup",
         "@com_google_absl//absl/container:flat_hash_map",
         "@com_google_absl//absl/container:flat_hash_set",
         "@com_google_absl//absl/flags:flag",
         "@com_google_absl//absl/log",
+        "@com_google_absl//absl/log:check",
         "@com_google_absl//absl/status",
+        "@com_google_absl//absl/status:statusor",
         "@com_google_absl//absl/strings",
+        "@com_google_absl//absl/strings:str_format",
         "@com_google_absl//absl/synchronization",
         "@com_google_absl//absl/time",
     ],
@@ -478,10 +488,13 @@ cc_library(
         ":policy",
         "//sandboxed_api/util:fileops",
         "//sandboxed_api/util:raw_logging",
+        "@com_google_absl//absl/base:core_headers",
         "@com_google_absl//absl/cleanup",
         "@com_google_absl//absl/log",
+        "@com_google_absl//absl/log:check",
         "@com_google_absl//absl/status",
         "@com_google_absl//absl/status:statusor",
+        "@com_google_absl//absl/strings",
         "@com_google_absl//absl/synchronization",
         "@com_google_absl//absl/time",
     ],
@@ -539,6 +552,7 @@ cc_library(
         ":mounts",
         ":namespace",
         ":policy",
+        ":syscall",
         ":violation_cc_proto",
         "//sandboxed_api:config",
         "//sandboxed_api/sandbox2/network_proxy:filtering",
@@ -553,6 +567,7 @@ cc_library(
         "@com_google_absl//absl/status",
         "@com_google_absl//absl/status:statusor",
         "@com_google_absl//absl/strings",
+        "@com_google_absl//absl/types:optional",
         "@com_google_absl//absl/types:span",
     ],
 )
@@ -589,7 +604,6 @@ cc_library(
     visibility = ["//visibility:public"],
     deps = [
         ":util",
-        "//sandboxed_api/util:file_helpers",
         "//sandboxed_api/util:fileops",
         "//sandboxed_api/util:raw_logging",
         "//sandboxed_api/util:status",
@@ -674,12 +688,12 @@ cc_test(
     copts = sapi_platform_copts(),
     data = ["//sandboxed_api/sandbox2/testcases:minimal_dynamic"],
     deps = [
-        ":mount_tree_cc_proto",
         ":mounts",
         "//sandboxed_api:testing",
         "//sandboxed_api/util:file_base",
         "//sandboxed_api/util:status_matchers",
         "//sandboxed_api/util:temp_file",
+        "@com_google_absl//absl/status",
         "@com_google_absl//absl/strings",
         "@com_google_googletest//:gtest_main",
     ],
@@ -691,7 +705,6 @@ cc_library(
     hdrs = ["namespace.h"],
     copts = sapi_platform_copts(),
     deps = [
-        ":mount_tree_cc_proto",
         ":mounts",
         ":violation_cc_proto",
         "//sandboxed_api/util:file_base",
@@ -718,7 +731,8 @@ cc_test(
         "//sandboxed_api/util:fileops",
         "//sandboxed_api/util:status_matchers",
         "//sandboxed_api/util:temp_file",
-        "@com_google_absl//absl/log",
+        "@com_google_absl//absl/log:check",
+        "@com_google_absl//absl/status:statusor",
         "@com_google_absl//absl/strings",
         "@com_google_googletest//:gtest_main",
     ],
@@ -736,6 +750,7 @@ cc_library(
         ":forkserver",
         ":sanitizer",
         "//sandboxed_api/util:raw_logging",
+        "@com_google_absl//absl/log",
         "@com_google_absl//absl/log:check",
     ],
 )
@@ -755,8 +770,6 @@ cc_library(
         "//sandboxed_api/util:file_helpers",
         "//sandboxed_api/util:fileops",
         "//sandboxed_api/util:raw_logging",
-        "//sandboxed_api/util:status",
-        "@com_google_absl//absl/algorithm:container",
         "@com_google_absl//absl/base:core_headers",
         "@com_google_absl//absl/status",
         "@com_google_absl//absl/status:statusor",
@@ -864,6 +877,7 @@ cc_test(
         ":sandbox2",
         "//sandboxed_api:testing",
         "//sandboxed_api/util:raw_logging",
+        "@com_google_absl//absl/log",
         "@com_google_absl//absl/log:check",
         "@com_google_absl//absl/strings",
         "@com_google_googletest//:gtest_main",
@@ -898,7 +912,6 @@ cc_test(
         ":comms",
         ":sandbox2",
         "//sandboxed_api:testing",
-        "//sandboxed_api/sandbox2/util:bpf_helper",
         "@com_google_absl//absl/log",
         "@com_google_absl//absl/strings",
         "@com_google_googletest//:gtest_main",
@@ -918,8 +931,6 @@ cc_test(
     ],
     tags = ["no_qemu_user_mode"],
     deps = [
-        ":limits",
-        ":regs",
         ":sandbox2",
         "//sandboxed_api:config",
         "//sandboxed_api:testing",
@@ -950,7 +961,11 @@ cc_test(
         "//sandboxed_api:config",
         "//sandboxed_api:testing",
         "//sandboxed_api/util:status_matchers",
+        "@com_google_absl//absl/status",
+        "@com_google_absl//absl/status:statusor",
         "@com_google_absl//absl/strings",
+        "@com_google_absl//absl/synchronization",
+        "@com_google_absl//absl/time",
         "@com_google_googletest//:gtest_main",
     ],
 )
@@ -986,6 +1001,7 @@ cc_test(
         ":util",
         "//sandboxed_api/util:status_matchers",
         "@com_google_absl//absl/cleanup",
+        "@com_google_absl//absl/status:statusor",
         "@com_google_absl//absl/strings",
         "@com_google_googletest//:gtest_main",
     ],
@@ -1001,8 +1017,6 @@ cc_test(
     tags = ["no_qemu_user_mode"],
     deps = [
         ":global_forkserver",
-        ":namespace",
-        ":regs",
         ":sandbox2",
         ":stack_trace",
         "//sandboxed_api:testing",
@@ -1010,7 +1024,7 @@ cc_test(
         "//sandboxed_api/util:status_matchers",
         "@com_google_absl//absl/flags:flag",
         "@com_google_absl//absl/flags:reflection",
-        "@com_google_absl//absl/status:statusor",
+        "@com_google_absl//absl/log:check",
         "@com_google_absl//absl/strings",
         "@com_google_absl//absl/time",
         "@com_google_googletest//:gtest_main",
@@ -1057,7 +1071,6 @@ cc_test(
         ":policybuilder",
         "//sandboxed_api/sandbox2/util:bpf_helper",
         "//sandboxed_api/util:status_matchers",
-        "@com_google_absl//absl/log",
         "@com_google_absl//absl/status",
         "@com_google_absl//absl/status:statusor",
         "@com_google_absl//absl/strings",
diff --git a/sandboxed_api/sandbox2/CMakeLists.txt b/sandboxed_api/sandbox2/CMakeLists.txt
index 8314f72..6e3c08b 100644
--- a/sandboxed_api/sandbox2/CMakeLists.txt
+++ b/sandboxed_api/sandbox2/CMakeLists.txt
@@ -76,6 +76,7 @@ add_library(sandbox2::syscall ALIAS sandbox2_syscall)
 target_link_libraries(sandbox2_syscall
   PRIVATE absl::algorithm_container
           absl::span
+          absl::statusor
           absl::str_format
           absl::strings
           sandbox2::util
@@ -166,17 +167,18 @@ add_library(sandbox2_policy ${SAPI_LIB_TYPE}
   policy.h
 )
 add_library(sandbox2::policy ALIAS sandbox2_policy)
-target_link_libraries(sandbox2_policy PRIVATE
-  absl::core_headers
-  sandbox2::bpf_helper
-  sandbox2::bpfdisassembler
-  sandbox2::comms
-  sandbox2::namespace
-  sandbox2::regs
-  sandbox2::syscall
-  sandbox2::violation_proto
-  sapi::base
-  sapi::config
+target_link_libraries(sandbox2_policy
+ PRIVATE absl::strings
+         sandbox2::bpf_helper
+         sandbox2::bpfdisassembler
+         sandbox2::comms
+         sandbox2::regs
+         sandbox2::syscall
+         sapi::base
+         sapi::config
+ PUBLIC sandbox2::network_proxy_filtering
+        sandbox2::namespace
+        sandbox2::violation_proto
 )
 
 # sandboxed_api/sandbox2:notify
@@ -215,6 +217,8 @@ set_target_properties(sandbox2_forkserver_bin PROPERTIES
 add_executable(sandbox2::forkserver_bin ALIAS sandbox2_forkserver_bin)
 target_link_libraries(sandbox2_forkserver_bin PRIVATE
   absl::log_globals
+  absl::log_severity
+  absl::status
   sandbox2::client
   sandbox2::comms
   sandbox2::forkserver
@@ -286,6 +290,7 @@ add_library(sandbox2_executor ${SAPI_LIB_TYPE}
 add_library(sandbox2::executor ALIAS sandbox2_executor)
 target_link_libraries(sandbox2_executor
   PRIVATE absl::core_headers
+          absl::status
           sandbox2::forkserver_proto
           sandbox2::ipc
           sandbox2::limits
@@ -295,7 +300,7 @@ target_link_libraries(sandbox2_executor
           sapi::status_proto
   PUBLIC absl::log
          absl::span
-         absl::status
+         absl::statusor
          absl::strings
          sapi::config
          sapi::fileops
@@ -366,6 +371,7 @@ target_link_libraries(sandbox2_stack_trace
           absl::memory
           absl::status
           absl::strings
+          absl::time
           sandbox2::client
           sandbox2::limits
           sandbox2::policybuilder
@@ -378,7 +384,8 @@ target_link_libraries(sandbox2_stack_trace
           sapi::fileops
           sapi::raw_logging
           sapi::status
-  PUBLIC absl::statusor
+  PUBLIC absl::check
+         absl::statusor
          sandbox2::comms
          sandbox2::executor
          sandbox2::namespace
@@ -428,11 +435,14 @@ add_library(sandbox2_monitor_ptrace ${SAPI_LIB_TYPE}
 )
 add_library(sandbox2::monitor_ptrace ALIAS sandbox2_monitor_ptrace)
 target_link_libraries(sandbox2_monitor_ptrace
-  PRIVATE absl::cleanup
+  PRIVATE absl::core_headers
+          absl::cleanup
           absl::flat_hash_set
           absl::flags
           absl::log
           absl::status
+          absl::statusor
+          absl::str_format
           absl::strings
           absl::time
           sapi::base
@@ -443,7 +453,8 @@ target_link_libraries(sandbox2_monitor_ptrace
           sandbox2::result
           sandbox2::sanitizer
           sandbox2::util
-  PUBLIC sandbox2::executor
+  PUBLIC absl::check
+         sandbox2::executor
          sandbox2::monitor_base
          sandbox2::notify
          sandbox2::policy
@@ -461,9 +472,13 @@ add_library(sandbox2_monitor_unotify ${SAPI_LIB_TYPE}
 )
 add_library(sandbox2::monitor_unotify ALIAS sandbox2_monitor_unotify)
 target_link_libraries(sandbox2_monitor_unotify
-  PRIVATE absl::cleanup
+  PRIVATE absl::check
+          absl::cleanup
+          absl::core_headers
           absl::log
+          absl::optional
           absl::status
+          absl::strings
           absl::time
           sapi::base
           sandbox2::client
@@ -493,6 +508,7 @@ target_link_libraries(sandbox2_policybuilder
           sapi::config
           sandbox2::bpf_helper
           sandbox2::namespace
+          sandbox2::syscall
           sandbox2::violation_proto
           sapi::file_base
           sapi::status
@@ -538,7 +554,6 @@ add_library(sandbox2::sanitizer ALIAS sandbox2_sanitizer)
 target_link_libraries(sandbox2_sanitizer
   PRIVATE absl::strings
           sandbox2::util
-          sapi::file_helpers
           sapi::fileops
           sapi::strerror
           sapi::raw_logging
@@ -642,7 +657,8 @@ add_library(sandbox2_forkingclient ${SAPI_LIB_TYPE}
 )
 add_library(sandbox2::forkingclient ALIAS sandbox2_forkingclient)
 target_link_libraries(sandbox2_forkingclient
-  PRIVATE absl::memory
+  PRIVATE absl::check
+          absl::memory
           absl::log
           sandbox2::sanitizer
           sapi::base
@@ -659,15 +675,13 @@ add_library(sandbox2_util ${SAPI_LIB_TYPE}
 )
 add_library(sandbox2::util ALIAS sandbox2_util)
 target_link_libraries(sandbox2_util
-  PRIVATE absl::algorithm_container
-          absl::core_headers
+  PRIVATE absl::core_headers
           absl::str_format
           absl::strings
           sapi::config
           sapi::file_base
           sapi::file_helpers
           sapi::fileops
-          sapi::status
           sapi::base
           sapi::raw_logging
   PUBLIC absl::status
@@ -813,10 +827,10 @@ if(BUILD_TESTING AND SAPI_BUILD_TESTING)
     sandbox2::testcase_minimal_dynamic
   )
   target_link_libraries(sandbox2_mounts_test PRIVATE
+    absl::status
     absl::strings
     sapi::file_base
     sandbox2::mounts
-    sandbox2::mount_tree_proto
     sapi::temp_file
     sapi::testing
     sapi::status_matchers
@@ -838,6 +852,8 @@ if(BUILD_TESTING AND SAPI_BUILD_TESTING)
     sandbox2::testcase_namespace
   )
   target_link_libraries(sandbox2_namespace_test PRIVATE
+    absl::check
+    absl::statusor
     absl::strings
     sandbox2::allow_all_syscalls
     sandbox2::allow_unrestricted_networking
@@ -971,7 +987,6 @@ if(BUILD_TESTING AND SAPI_BUILD_TESTING)
   )
   target_link_libraries(sandbox2_notify_test PRIVATE
     absl::strings
-    sandbox2::bpf_helper
     sandbox2::comms
     sandbox2::regs
     sandbox2::sandbox2
@@ -1001,8 +1016,6 @@ if(BUILD_TESTING AND SAPI_BUILD_TESTING)
     absl::strings
     sandbox2::bpf_helper
     sapi::config
-    sandbox2::limits
-    sandbox2::regs
     sandbox2::sandbox2
     sapi::status_matchers
     sapi::testing
@@ -1027,7 +1040,11 @@ if(BUILD_TESTING AND SAPI_BUILD_TESTING)
     sandbox2::testcase_tsync
   )
   target_link_libraries(sandbox2_sandbox2_test PRIVATE
+    absl::status
+    absl::statusor
     absl::strings
+    absl::synchronization
+    absl::time
     sapi::config
     sandbox2::sandbox2
     sapi::testing
@@ -1076,6 +1093,7 @@ if(BUILD_TESTING AND SAPI_BUILD_TESTING)
   )
   target_link_libraries(sandbox2_util_test PRIVATE
     sandbox2::util
+    absl::statusor
     absl::strings
     absl::cleanup
     sapi::status_matchers
@@ -1094,12 +1112,12 @@ if(BUILD_TESTING AND SAPI_BUILD_TESTING)
     sandbox2::testcase_symbolize
   )
   target_link_libraries(sandbox2_stack_trace_test PRIVATE
+    absl::check
     absl::flags
     absl::status
     absl::strings
     absl::time
     sandbox2::global_forkserver
-    sandbox2::namespace
     sandbox2::sandbox2
     sandbox2::stack_trace
     sandbox2::util
diff --git a/sandboxed_api/sandbox2/bpfdisassembler.cc b/sandboxed_api/sandbox2/bpfdisassembler.cc
index 94d101a..36946a9 100644
--- a/sandboxed_api/sandbox2/bpfdisassembler.cc
+++ b/sandboxed_api/sandbox2/bpfdisassembler.cc
@@ -14,13 +14,17 @@
 
 #include "sandboxed_api/sandbox2/bpfdisassembler.h"
 
+#include <linux/bpf_common.h>
 // IWYU pragma: no_include <asm/int-ll64.h>
 #include <linux/filter.h>
 #include <linux/seccomp.h>
+#include <sys/sysinfo.h>
 
 #include <cstddef>
+#include <string>
 
 #include "absl/strings/str_cat.h"
+#include "absl/types/span.h"
 
 #define INSIDE_FIELD(what, field)               \
   ((offsetof(seccomp_data, field) == 0 ||       \
diff --git a/sandboxed_api/sandbox2/bpfdisassembler_test.cc b/sandboxed_api/sandbox2/bpfdisassembler_test.cc
index 3960bb4..b668a8b 100644
--- a/sandboxed_api/sandbox2/bpfdisassembler_test.cc
+++ b/sandboxed_api/sandbox2/bpfdisassembler_test.cc
@@ -1,5 +1,9 @@
 #include "sandboxed_api/sandbox2/bpfdisassembler.h"
 
+#include <linux/bpf_common.h>
+#include <linux/filter.h>
+#include <linux/seccomp.h>
+
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
 #include "sandboxed_api/sandbox2/util/bpf_helper.h"
diff --git a/sandboxed_api/sandbox2/buffer.cc b/sandboxed_api/sandbox2/buffer.cc
index 9d7a60d..5f20709 100644
--- a/sandboxed_api/sandbox2/buffer.cc
+++ b/sandboxed_api/sandbox2/buffer.cc
@@ -19,7 +19,10 @@
 #include <unistd.h>
 
 #include <cerrno>
+#include <cstddef>
+#include <cstdint>
 #include <memory>
+#include <utility>
 
 #include "absl/memory/memory.h"
 #include "absl/status/status.h"
diff --git a/sandboxed_api/sandbox2/buffer_test.cc b/sandboxed_api/sandbox2/buffer_test.cc
index 13b8887..82e4c9d 100644
--- a/sandboxed_api/sandbox2/buffer_test.cc
+++ b/sandboxed_api/sandbox2/buffer_test.cc
@@ -15,9 +15,9 @@
 #include "sandboxed_api/sandbox2/buffer.h"
 
 #include <sys/stat.h>
-#include <syscall.h>
 #include <unistd.h>
 
+#include <cstdint>
 #include <memory>
 #include <string>
 #include <utility>
diff --git a/sandboxed_api/sandbox2/client.cc b/sandboxed_api/sandbox2/client.cc
index 2693697..42953bc 100644
--- a/sandboxed_api/sandbox2/client.cc
+++ b/sandboxed_api/sandbox2/client.cc
@@ -17,6 +17,7 @@
 #include "sandboxed_api/sandbox2/client.h"
 
 #include <fcntl.h>
+#include <linux/bpf_common.h>
 #include <linux/filter.h>
 #include <linux/seccomp.h>
 #include <sys/prctl.h>
@@ -24,17 +25,21 @@
 #include <unistd.h>
 
 #include <atomic>
+#include <cerrno>
 #include <cinttypes>
 #include <cstdint>
 #include <cstdlib>
+#include <limits>
 #include <memory>
 #include <string>
 #include <thread>  // NOLINT(build/c++11)
 #include <utility>
+#include <vector>
 
 #include "absl/base/attributes.h"
 #include "absl/base/macros.h"
 #include "absl/container/flat_hash_map.h"
+#include "absl/status/status.h"
 #include "absl/strings/numbers.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_join.h"
diff --git a/sandboxed_api/sandbox2/comms.cc b/sandboxed_api/sandbox2/comms.cc
index a200fb8..fb637da 100644
--- a/sandboxed_api/sandbox2/comms.cc
+++ b/sandboxed_api/sandbox2/comms.cc
@@ -29,16 +29,20 @@
 
 #include <atomic>
 #include <cerrno>
-#include <cstddef>
+#include <cstdint>
 #include <cstdlib>
 #include <cstring>
 #include <functional>
 #include <memory>
+#include <string>
+#include <utility>
+#include <vector>
 
 #include "google/protobuf/message.h"
 #include "absl/base/dynamic_annotations.h"
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
+#include "absl/strings/numbers.h"
 #include "absl/strings/str_format.h"
 #include "absl/synchronization/mutex.h"
 #include "sandboxed_api/sandbox2/util.h"
diff --git a/sandboxed_api/sandbox2/comms.h b/sandboxed_api/sandbox2/comms.h
index ac231e2..cb31644 100644
--- a/sandboxed_api/sandbox2/comms.h
+++ b/sandboxed_api/sandbox2/comms.h
@@ -28,14 +28,18 @@
 
 #include <cstddef>
 #include <cstdint>
+#include <functional>
 #include <limits>
 #include <memory>
 #include <string>
 #include <utility>
+#include <vector>
 
 #include "absl/base/attributes.h"
+#include "absl/base/thread_annotations.h"
 #include "absl/log/die_if_null.h"
 #include "absl/status/status.h"
+#include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
 #include "absl/synchronization/mutex.h"
 #include "sandboxed_api/util/status.pb.h"
diff --git a/sandboxed_api/sandbox2/comms_test.cc b/sandboxed_api/sandbox2/comms_test.cc
index 3e52dbf..b7ddaaa 100644
--- a/sandboxed_api/sandbox2/comms_test.cc
+++ b/sandboxed_api/sandbox2/comms_test.cc
@@ -17,9 +17,9 @@
 
 #include <fcntl.h>
 #include <sys/socket.h>
-#include <sys/time.h>
+#include <sys/types.h>
+#include <unistd.h>
 
-#include <cstdint>
 #include <cstring>
 #include <ctime>
 #include <functional>
diff --git a/sandboxed_api/sandbox2/examples/crc4/BUILD.bazel b/sandboxed_api/sandbox2/examples/crc4/BUILD.bazel
index 9d26ea7..cb4913f 100644
--- a/sandboxed_api/sandbox2/examples/crc4/BUILD.bazel
+++ b/sandboxed_api/sandbox2/examples/crc4/BUILD.bazel
@@ -34,17 +34,17 @@ cc_binary(
     copts = sapi_platform_copts(),
     data = [":crc4bin"],
     deps = [
-        "//sandboxed_api:config",
         "//sandboxed_api/sandbox2",
         "//sandboxed_api/sandbox2:comms",
         "//sandboxed_api/sandbox2/util:bpf_helper",
         "//sandboxed_api/util:runfiles",
-        "@com_google_absl//absl/base:log_severity",
         "@com_google_absl//absl/flags:flag",
         "@com_google_absl//absl/flags:parse",
         "@com_google_absl//absl/log",
         "@com_google_absl//absl/log:globals",
         "@com_google_absl//absl/log:initialize",
+        "@com_google_absl//absl/strings:string_view",
+        "@com_google_absl//absl/time",
     ],
 )
 
@@ -59,6 +59,7 @@ cc_binary(
         "//sandboxed_api/sandbox2:util",
         "@com_google_absl//absl/flags:flag",
         "@com_google_absl//absl/flags:parse",
+        "@com_google_absl//absl/strings:string_view",
     ],
 )
 
diff --git a/sandboxed_api/sandbox2/examples/crc4/CMakeLists.txt b/sandboxed_api/sandbox2/examples/crc4/CMakeLists.txt
index 487869b..0d9e722 100644
--- a/sandboxed_api/sandbox2/examples/crc4/CMakeLists.txt
+++ b/sandboxed_api/sandbox2/examples/crc4/CMakeLists.txt
@@ -24,7 +24,9 @@ target_link_libraries(sandbox2_crc4sandbox PRIVATE
   absl::flags
   absl::flags_parse
   absl::log
+  absl::log_globals
   absl::log_initialize
+  absl::log_severity
   sandbox2::bpf_helper
   sandbox2::comms
   sapi::runfiles
@@ -42,6 +44,7 @@ target_link_libraries(sandbox2_crc4bin PRIVATE
   absl::core_headers
   absl::flags
   absl::flags_parse
+  absl::strings
   sandbox2::client
   sandbox2::comms
   sandbox2::util
diff --git a/sandboxed_api/sandbox2/examples/crc4/crc4bin.cc b/sandboxed_api/sandbox2/examples/crc4/crc4bin.cc
index 1c1acf7..460dbce 100644
--- a/sandboxed_api/sandbox2/examples/crc4/crc4bin.cc
+++ b/sandboxed_api/sandbox2/examples/crc4/crc4bin.cc
@@ -19,9 +19,12 @@
 
 #include <cstdint>
 #include <cstring>
+#include <functional>
+#include <vector>
 
 #include "absl/flags/flag.h"
 #include "absl/flags/parse.h"
+#include "absl/strings/string_view.h"
 #include "sandboxed_api/sandbox2/client.h"
 #include "sandboxed_api/sandbox2/comms.h"
 #include "sandboxed_api/sandbox2/util.h"
diff --git a/sandboxed_api/sandbox2/examples/crc4/crc4sandbox.cc b/sandboxed_api/sandbox2/examples/crc4/crc4sandbox.cc
index 2efb0e4..ab39168 100644
--- a/sandboxed_api/sandbox2/examples/crc4/crc4sandbox.cc
+++ b/sandboxed_api/sandbox2/examples/crc4/crc4sandbox.cc
@@ -14,11 +14,8 @@
 
 // A demo sandbox for the crc4bin binary
 
-#include <linux/filter.h>
-#include <sys/resource.h>
 #include <syscall.h>
 
-#include <cstddef>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
@@ -27,13 +24,14 @@
 #include <utility>
 #include <vector>
 
-#include "absl/base/log_severity.h"
 #include "absl/flags/flag.h"
 #include "absl/flags/parse.h"
 #include "absl/log/globals.h"
 #include "absl/log/initialize.h"
 #include "absl/log/log.h"
-#include "sandboxed_api/config.h"
+#include "absl/base/log_severity.h"
+#include "absl/strings/string_view.h"
+#include "absl/time/time.h"
 #include "sandboxed_api/sandbox2/comms.h"
 #include "sandboxed_api/sandbox2/executor.h"
 #include "sandboxed_api/sandbox2/limits.h"
diff --git a/sandboxed_api/sandbox2/examples/crc4/crc4sandbox_test.cc b/sandboxed_api/sandbox2/examples/crc4/crc4sandbox_test.cc
index 5d2f362..59dda46 100644
--- a/sandboxed_api/sandbox2/examples/crc4/crc4sandbox_test.cc
+++ b/sandboxed_api/sandbox2/examples/crc4/crc4sandbox_test.cc
@@ -17,6 +17,7 @@
 #include <unistd.h>
 
 #include <string>
+#include <vector>
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
diff --git a/sandboxed_api/sandbox2/examples/custom_fork/BUILD.bazel b/sandboxed_api/sandbox2/examples/custom_fork/BUILD.bazel
index 6f1cb2c..6703362 100644
--- a/sandboxed_api/sandbox2/examples/custom_fork/BUILD.bazel
+++ b/sandboxed_api/sandbox2/examples/custom_fork/BUILD.bazel
@@ -34,13 +34,14 @@ cc_binary(
         "//sandboxed_api:config",
         "//sandboxed_api/sandbox2",
         "//sandboxed_api/sandbox2:comms",
+        "//sandboxed_api/sandbox2:fork_client",
         "//sandboxed_api/util:runfiles",
-        "@com_google_absl//absl/flags:flag",
         "@com_google_absl//absl/flags:parse",
         "@com_google_absl//absl/log",
         "@com_google_absl//absl/log:check",
         "@com_google_absl//absl/log:globals",
         "@com_google_absl//absl/log:initialize",
+        "@com_google_absl//absl/time",
     ],
 )
 
diff --git a/sandboxed_api/sandbox2/examples/custom_fork/CMakeLists.txt b/sandboxed_api/sandbox2/examples/custom_fork/CMakeLists.txt
index 18eb2f4..37d9b42 100644
--- a/sandboxed_api/sandbox2/examples/custom_fork/CMakeLists.txt
+++ b/sandboxed_api/sandbox2/examples/custom_fork/CMakeLists.txt
@@ -27,7 +27,10 @@ target_link_libraries(sandbox2_custom_fork_sandbox PRIVATE
   absl::log
   absl::log_globals
   absl::log_initialize
+  absl::log_severity
+  absl::time
   sandbox2::comms
+  sandbox2::fork_client
   sandbox2::forkserver
   sapi::runfiles
   sandbox2::sandbox2
diff --git a/sandboxed_api/sandbox2/examples/custom_fork/custom_fork_bin.cc b/sandboxed_api/sandbox2/examples/custom_fork/custom_fork_bin.cc
index f947f1d..b575b8b 100644
--- a/sandboxed_api/sandbox2/examples/custom_fork/custom_fork_bin.cc
+++ b/sandboxed_api/sandbox2/examples/custom_fork/custom_fork_bin.cc
@@ -16,7 +16,7 @@
 // sandbox2, and which uses a built-in fork-server to spawn new sandboxees
 // (instead of doing fork/execve via the Fork-Server).
 
-#include <sys/types.h>
+#include <unistd.h>
 
 #include <cstdint>
 
diff --git a/sandboxed_api/sandbox2/examples/custom_fork/custom_fork_sandbox.cc b/sandboxed_api/sandbox2/examples/custom_fork/custom_fork_sandbox.cc
index ea8b0cb..e499809 100644
--- a/sandboxed_api/sandbox2/examples/custom_fork/custom_fork_sandbox.cc
+++ b/sandboxed_api/sandbox2/examples/custom_fork/custom_fork_sandbox.cc
@@ -17,21 +17,24 @@
 
 #include <syscall.h>
 
+#include <cstdint>
 #include <cstdlib>
 #include <memory>
 #include <string>
 #include <utility>
 #include <vector>
 
-#include "absl/flags/flag.h"
-#include "absl/flags/parse.h"
 #include "absl/log/check.h"
+#include "absl/flags/parse.h"
 #include "absl/log/globals.h"
 #include "absl/log/initialize.h"
 #include "absl/log/log.h"
+#include "absl/base/log_severity.h"
+#include "absl/time/time.h"
 #include "sandboxed_api/config.h"
 #include "sandboxed_api/sandbox2/comms.h"
 #include "sandboxed_api/sandbox2/executor.h"
+#include "sandboxed_api/sandbox2/fork_client.h"
 #include "sandboxed_api/sandbox2/limits.h"
 #include "sandboxed_api/sandbox2/policy.h"
 #include "sandboxed_api/sandbox2/policybuilder.h"
diff --git a/sandboxed_api/sandbox2/examples/network/BUILD.bazel b/sandboxed_api/sandbox2/examples/network/BUILD.bazel
index 227e207..82ccef6 100644
--- a/sandboxed_api/sandbox2/examples/network/BUILD.bazel
+++ b/sandboxed_api/sandbox2/examples/network/BUILD.bazel
@@ -40,11 +40,12 @@ cc_binary(
         "//sandboxed_api/util:fileops",
         "//sandboxed_api/util:runfiles",
         "@com_google_absl//absl/base:core_headers",
-        "@com_google_absl//absl/flags:flag",
         "@com_google_absl//absl/flags:parse",
         "@com_google_absl//absl/log",
         "@com_google_absl//absl/log:globals",
         "@com_google_absl//absl/log:initialize",
+        "@com_google_absl//absl/strings:string_view",
+        "@com_google_absl//absl/time",
     ],
 )
 
diff --git a/sandboxed_api/sandbox2/examples/network/CMakeLists.txt b/sandboxed_api/sandbox2/examples/network/CMakeLists.txt
index 8a96f07..acbef87 100644
--- a/sandboxed_api/sandbox2/examples/network/CMakeLists.txt
+++ b/sandboxed_api/sandbox2/examples/network/CMakeLists.txt
@@ -26,6 +26,9 @@ target_link_libraries(sandbox2_network_sandbox PRIVATE
   absl::log
   absl::log_globals
   absl::log_initialize
+  absl::log_severity
+  absl::strings
+  absl::time
   sandbox2::bpf_helper
   sandbox2::comms
   sapi::fileops
diff --git a/sandboxed_api/sandbox2/examples/network/network_bin.cc b/sandboxed_api/sandbox2/examples/network/network_bin.cc
index 97c1e47..0928c94 100644
--- a/sandboxed_api/sandbox2/examples/network/network_bin.cc
+++ b/sandboxed_api/sandbox2/examples/network/network_bin.cc
@@ -16,11 +16,11 @@
 // namespace. It can't connect with the server directly, but the executor can
 // establish a connection and pass the connected socket to the sandboxee.
 
-#include <sys/socket.h>
-#include <syscall.h>
+#include <unistd.h>
 
+#include <cstdint>
+#include <cstdio>
 #include <cstring>
-#include <string>
 
 #include "absl/log/log.h"
 #include "absl/strings/str_format.h"
diff --git a/sandboxed_api/sandbox2/examples/network/network_sandbox.cc b/sandboxed_api/sandbox2/examples/network/network_sandbox.cc
index 2f97924..896faef 100644
--- a/sandboxed_api/sandbox2/examples/network/network_sandbox.cc
+++ b/sandboxed_api/sandbox2/examples/network/network_sandbox.cc
@@ -15,24 +15,25 @@
 // A demo sandbox for the network binary.
 
 #include <arpa/inet.h>
-#include <linux/filter.h>
-#include <netdb.h>
 #include <netinet/in.h>
-#include <sys/resource.h>
 #include <sys/socket.h>
-#include <sys/types.h>
 #include <syscall.h>
+#include <unistd.h>
 
-#include <cstdio>
 #include <cstdlib>
+#include <memory>
 #include <string>
+#include <utility>
+#include <vector>
 
 #include "absl/base/macros.h"
-#include "absl/flags/flag.h"
 #include "absl/flags/parse.h"
 #include "absl/log/globals.h"
 #include "absl/log/initialize.h"
 #include "absl/log/log.h"
+#include "absl/base/log_severity.h"
+#include "absl/strings/string_view.h"
+#include "absl/time/time.h"
 #include "sandboxed_api/config.h"
 #include "sandboxed_api/sandbox2/comms.h"
 #include "sandboxed_api/sandbox2/executor.h"
diff --git a/sandboxed_api/sandbox2/examples/network_proxy/BUILD.bazel b/sandboxed_api/sandbox2/examples/network_proxy/BUILD.bazel
index 380968c..03e2e36 100644
--- a/sandboxed_api/sandbox2/examples/network_proxy/BUILD.bazel
+++ b/sandboxed_api/sandbox2/examples/network_proxy/BUILD.bazel
@@ -32,7 +32,6 @@ cc_binary(
         "//sandboxed_api:config",
         "//sandboxed_api/sandbox2",
         "//sandboxed_api/sandbox2:comms",
-        "//sandboxed_api/sandbox2/util:bpf_helper",
         "//sandboxed_api/util:fileops",
         "//sandboxed_api/util:runfiles",
         "@com_google_absl//absl/base:core_headers",
@@ -41,6 +40,8 @@ cc_binary(
         "@com_google_absl//absl/log",
         "@com_google_absl//absl/log:globals",
         "@com_google_absl//absl/log:initialize",
+        "@com_google_absl//absl/strings:string_view",
+        "@com_google_absl//absl/time",
     ],
 )
 
@@ -64,6 +65,7 @@ cc_binary(
         "@com_google_absl//absl/status",
         "@com_google_absl//absl/status:statusor",
         "@com_google_absl//absl/strings:str_format",
+        "@com_google_absl//absl/strings:string_view",
     ],
 )
 
diff --git a/sandboxed_api/sandbox2/examples/network_proxy/CMakeLists.txt b/sandboxed_api/sandbox2/examples/network_proxy/CMakeLists.txt
index dbe96de..73889ff 100644
--- a/sandboxed_api/sandbox2/examples/network_proxy/CMakeLists.txt
+++ b/sandboxed_api/sandbox2/examples/network_proxy/CMakeLists.txt
@@ -26,6 +26,9 @@ target_link_libraries(sandbox2_networkproxy_sandbox PRIVATE
   absl::log
   absl::log_globals
   absl::log_initialize
+  absl::log_severity
+  absl::strings
+  absl::time
   sandbox2::bpf_helper
   sandbox2::comms
   sapi::fileops
@@ -50,6 +53,7 @@ target_link_libraries(sandbox2_networkproxy_bin PRIVATE absl::status
   absl::log_initialize
   absl::statusor
   absl::str_format
+  absl::strings
   sandbox2::client
   sandbox2::comms
   sapi::fileops
diff --git a/sandboxed_api/sandbox2/examples/network_proxy/networkproxy_bin.cc b/sandboxed_api/sandbox2/examples/network_proxy/networkproxy_bin.cc
index 5852aa9..90ce982 100644
--- a/sandboxed_api/sandbox2/examples/network_proxy/networkproxy_bin.cc
+++ b/sandboxed_api/sandbox2/examples/network_proxy/networkproxy_bin.cc
@@ -5,10 +5,10 @@
 #include <arpa/inet.h>
 #include <netinet/in.h>
 #include <sys/socket.h>
-#include <sys/stat.h>
 #include <sys/types.h>
-#include <syscall.h>
+#include <unistd.h>
 
+#include <cerrno>
 #include <cstring>
 
 #include "absl/base/log_severity.h"
@@ -20,6 +20,7 @@
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/str_format.h"
+#include "absl/strings/string_view.h"
 #include "sandboxed_api/sandbox2/client.h"
 #include "sandboxed_api/sandbox2/comms.h"
 #include "sandboxed_api/sandbox2/network_proxy/client.h"
diff --git a/sandboxed_api/sandbox2/examples/network_proxy/networkproxy_sandbox.cc b/sandboxed_api/sandbox2/examples/network_proxy/networkproxy_sandbox.cc
index f65eb0d..4cd9fb5 100644
--- a/sandboxed_api/sandbox2/examples/network_proxy/networkproxy_sandbox.cc
+++ b/sandboxed_api/sandbox2/examples/network_proxy/networkproxy_sandbox.cc
@@ -1,18 +1,15 @@
 // A demo sandbox for the network binary.
 
 #include <arpa/inet.h>
-#include <linux/filter.h>
-#include <netdb.h>
 #include <netinet/in.h>
-#include <sys/resource.h>
 #include <sys/socket.h>
-#include <sys/types.h>
-#include <sys/wait.h>
 #include <syscall.h>
+#include <unistd.h>
 
-#include <cstdio>
 #include <cstdlib>
+#include <memory>
 #include <string>
+#include <utility>
 #include <vector>
 
 #include "absl/base/macros.h"
@@ -21,13 +18,15 @@
 #include "absl/log/globals.h"
 #include "absl/log/initialize.h"
 #include "absl/log/log.h"
+#include "absl/base/log_severity.h"
+#include "absl/strings/string_view.h"
+#include "absl/time/time.h"
 #include "sandboxed_api/config.h"
 #include "sandboxed_api/sandbox2/comms.h"
 #include "sandboxed_api/sandbox2/executor.h"
 #include "sandboxed_api/sandbox2/policy.h"
 #include "sandboxed_api/sandbox2/policybuilder.h"
 #include "sandboxed_api/sandbox2/sandbox2.h"
-#include "sandboxed_api/sandbox2/util/bpf_helper.h"
 #include "sandboxed_api/util/fileops.h"
 #include "sandboxed_api/util/runfiles.h"
 
diff --git a/sandboxed_api/sandbox2/examples/static/BUILD.bazel b/sandboxed_api/sandbox2/examples/static/BUILD.bazel
index 1c6f85f..917cb62 100644
--- a/sandboxed_api/sandbox2/examples/static/BUILD.bazel
+++ b/sandboxed_api/sandbox2/examples/static/BUILD.bazel
@@ -39,11 +39,12 @@ cc_binary(
         "//sandboxed_api/sandbox2",
         "//sandboxed_api/sandbox2/util:bpf_helper",
         "//sandboxed_api/util:runfiles",
-        "@com_google_absl//absl/flags:flag",
         "@com_google_absl//absl/flags:parse",
         "@com_google_absl//absl/log",
+        "@com_google_absl//absl/log:check",
         "@com_google_absl//absl/log:globals",
         "@com_google_absl//absl/log:initialize",
+        "@com_google_absl//absl/time",
     ],
 )
 
diff --git a/sandboxed_api/sandbox2/examples/static/CMakeLists.txt b/sandboxed_api/sandbox2/examples/static/CMakeLists.txt
index c4709d4..2fffbfa 100644
--- a/sandboxed_api/sandbox2/examples/static/CMakeLists.txt
+++ b/sandboxed_api/sandbox2/examples/static/CMakeLists.txt
@@ -21,10 +21,14 @@ add_dependencies(sandbox2_static_sandbox
   sandbox2::static_bin
 )
 target_link_libraries(sandbox2_static_sandbox PRIVATE
+  absl::check
   absl::flags
   absl::flags_parse
   absl::log
+  absl::log_globals
   absl::log_initialize
+  absl::log_severity
+  absl::time
   sandbox2::bpf_helper
   sapi::runfiles
   sandbox2::sandbox2
diff --git a/sandboxed_api/sandbox2/examples/static/static_bin.cc b/sandboxed_api/sandbox2/examples/static/static_bin.cc
index 7da7d1f..b4d0280 100644
--- a/sandboxed_api/sandbox2/examples/static/static_bin.cc
+++ b/sandboxed_api/sandbox2/examples/static/static_bin.cc
@@ -17,12 +17,10 @@
 //
 // It inverts all bytes coming from stdin and writes them to the stdout.
 
-#include <signal.h>
 #include <sys/prctl.h>
 #include <unistd.h>
 
 #include <cctype>
-#include <cstddef>
 #include <cstdio>
 
 int main(int argc, char* argv[]) {
diff --git a/sandboxed_api/sandbox2/examples/static/static_sandbox.cc b/sandboxed_api/sandbox2/examples/static/static_sandbox.cc
index 0f2c13d..b60458a 100644
--- a/sandboxed_api/sandbox2/examples/static/static_sandbox.cc
+++ b/sandboxed_api/sandbox2/examples/static/static_sandbox.cc
@@ -17,22 +17,23 @@
 
 #include <fcntl.h>
 #include <sys/mman.h>
-#include <sys/resource.h>
 #include <syscall.h>
 #include <unistd.h>
 
-#include <csignal>
+#include <cerrno>
 #include <cstdlib>
 #include <memory>
 #include <string>
 #include <utility>
 #include <vector>
 
-#include "absl/flags/flag.h"
+#include "absl/log/check.h"
 #include "absl/flags/parse.h"
 #include "absl/log/globals.h"
 #include "absl/log/initialize.h"
 #include "absl/log/log.h"
+#include "absl/base/log_severity.h"
+#include "absl/time/time.h"
 #include "sandboxed_api/config.h"
 #include "sandboxed_api/sandbox2/executor.h"
 #include "sandboxed_api/sandbox2/limits.h"
diff --git a/sandboxed_api/sandbox2/examples/tool/BUILD.bazel b/sandboxed_api/sandbox2/examples/tool/BUILD.bazel
index 21114dd..3f4c868 100644
--- a/sandboxed_api/sandbox2/examples/tool/BUILD.bazel
+++ b/sandboxed_api/sandbox2/examples/tool/BUILD.bazel
@@ -39,10 +39,12 @@ cc_binary(
         "//sandboxed_api/sandbox2:util",
         "//sandboxed_api/sandbox2/util:bpf_helper",
         "//sandboxed_api/util:fileops",
+        "@com_google_absl//absl/base:log_severity",
         "@com_google_absl//absl/flags:flag",
         "@com_google_absl//absl/flags:parse",
         "@com_google_absl//absl/flags:usage",
         "@com_google_absl//absl/log",
+        "@com_google_absl//absl/log:check",
         "@com_google_absl//absl/log:globals",
         "@com_google_absl//absl/log:initialize",
         "@com_google_absl//absl/strings",
diff --git a/sandboxed_api/sandbox2/examples/tool/CMakeLists.txt b/sandboxed_api/sandbox2/examples/tool/CMakeLists.txt
index bd777cd..2096ce1 100644
--- a/sandboxed_api/sandbox2/examples/tool/CMakeLists.txt
+++ b/sandboxed_api/sandbox2/examples/tool/CMakeLists.txt
@@ -19,12 +19,14 @@ add_executable(sandbox2_sandbox2tool
 set_target_properties(sandbox2_sandbox2tool PROPERTIES OUTPUT_NAME sandbox2tool)
 add_executable(sandbox2::sandbox2tool ALIAS sandbox2_sandbox2tool)
 target_link_libraries(sandbox2_sandbox2tool PRIVATE
+  absl::check
   absl::flags
   absl::flags_parse
   absl::flags_usage
   absl::log
   absl::log_globals
   absl::log_initialize
+  absl::log_severity
   absl::strings
   absl::time
   sandbox2::allow_all_syscalls
diff --git a/sandboxed_api/sandbox2/examples/tool/sandbox2tool.cc b/sandboxed_api/sandbox2/examples/tool/sandbox2tool.cc
index ae0d3af..fdac290 100644
--- a/sandboxed_api/sandbox2/examples/tool/sandbox2tool.cc
+++ b/sandboxed_api/sandbox2/examples/tool/sandbox2tool.cc
@@ -22,26 +22,30 @@
 //     --logtostderr
 //     /bin/ls
 
-#include <sys/resource.h>
 #include <sys/stat.h>
 #include <syscall.h>
 #include <unistd.h>
 
 #include <csignal>
+#include <cstdint>
+#include <cstdio>
 #include <cstdlib>
 #include <memory>
 #include <string>
 #include <utility>
 #include <vector>
 
+#include "absl/base/log_severity.h"
 #include "absl/flags/flag.h"
 #include "absl/flags/parse.h"
 #include "absl/flags/usage.h"
+#include "absl/log/check.h"
 #include "absl/log/globals.h"
 #include "absl/log/initialize.h"
 #include "absl/log/log.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_split.h"
+#include "absl/strings/string_view.h"
 #include "absl/time/time.h"
 #include "sandboxed_api/sandbox2/allow_all_syscalls.h"
 #include "sandboxed_api/sandbox2/executor.h"
diff --git a/sandboxed_api/sandbox2/examples/zlib/BUILD.bazel b/sandboxed_api/sandbox2/examples/zlib/BUILD.bazel
index 2e67f38..cfd71e1 100644
--- a/sandboxed_api/sandbox2/examples/zlib/BUILD.bazel
+++ b/sandboxed_api/sandbox2/examples/zlib/BUILD.bazel
@@ -28,14 +28,16 @@ cc_binary(
     data = [":zpipe"],
     deps = [
         "//sandboxed_api/sandbox2",
-        "//sandboxed_api/sandbox2:comms",
         "//sandboxed_api/sandbox2/util:bpf_helper",
         "//sandboxed_api/util:runfiles",
         "@com_google_absl//absl/flags:flag",
         "@com_google_absl//absl/flags:parse",
         "@com_google_absl//absl/log",
+        "@com_google_absl//absl/log:check",
         "@com_google_absl//absl/log:globals",
         "@com_google_absl//absl/log:initialize",
+        "@com_google_absl//absl/strings:string_view",
+        "@com_google_absl//absl/time",
     ],
 )
 
diff --git a/sandboxed_api/sandbox2/examples/zlib/CMakeLists.txt b/sandboxed_api/sandbox2/examples/zlib/CMakeLists.txt
index c590c8c..ae38c60 100644
--- a/sandboxed_api/sandbox2/examples/zlib/CMakeLists.txt
+++ b/sandboxed_api/sandbox2/examples/zlib/CMakeLists.txt
@@ -21,11 +21,15 @@ add_dependencies(sandbox2_zpipe_sandbox
   sandbox2::zpipe
 )
 target_link_libraries(sandbox2_zpipe_sandbox PRIVATE
+  absl::check
   absl::flags
   absl::flags_parse
   absl::log
   absl::log_globals
   absl::log_initialize
+  absl::log_severity
+  absl::strings
+  absl::time
   sandbox2::bpf_helper
   sandbox2::comms
   sapi::runfiles
diff --git a/sandboxed_api/sandbox2/examples/zlib/zpipe_sandbox.cc b/sandboxed_api/sandbox2/examples/zlib/zpipe_sandbox.cc
index 820b6bd..69c1987 100644
--- a/sandboxed_api/sandbox2/examples/zlib/zpipe_sandbox.cc
+++ b/sandboxed_api/sandbox2/examples/zlib/zpipe_sandbox.cc
@@ -13,13 +13,10 @@
 // limitations under the License.
 
 #include <fcntl.h>
-#include <linux/filter.h>
-#include <sys/resource.h>
 #include <syscall.h>
+#include <unistd.h>
 
-#include <cstddef>
-#include <cstdint>
-#include <cstdio>
+#include <cerrno>
 #include <cstdlib>
 #include <memory>
 #include <string>
@@ -30,8 +27,11 @@
 #include "absl/flags/parse.h"
 #include "absl/log/globals.h"
 #include "absl/log/initialize.h"
+#include "absl/log/check.h"
 #include "absl/log/log.h"
-#include "sandboxed_api/sandbox2/comms.h"
+#include "absl/base/log_severity.h"
+#include "absl/strings/string_view.h"
+#include "absl/time/time.h"
 #include "sandboxed_api/sandbox2/executor.h"
 #include "sandboxed_api/sandbox2/limits.h"
 #include "sandboxed_api/sandbox2/policy.h"
diff --git a/sandboxed_api/sandbox2/executor.cc b/sandboxed_api/sandbox2/executor.cc
index 97d8d8a..00bf884 100644
--- a/sandboxed_api/sandbox2/executor.cc
+++ b/sandboxed_api/sandbox2/executor.cc
@@ -17,16 +17,19 @@
 #include "sandboxed_api/sandbox2/executor.h"
 
 #include <fcntl.h>
-#include <libgen.h>
 #include <sys/socket.h>
 #include <unistd.h>
 
-#include <climits>
-#include <cstddef>
+#include <algorithm>
+#include <cerrno>
+#include <cstdint>
 #include <memory>
-#include <string_view>
+#include <string>
+#include <vector>
 
+#include "absl/log/log.h"
 #include "absl/status/status.h"
+#include "absl/status/statusor.h"
 #include "absl/strings/match.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
diff --git a/sandboxed_api/sandbox2/executor.h b/sandboxed_api/sandbox2/executor.h
index 6bb95a8..5c2fb84 100644
--- a/sandboxed_api/sandbox2/executor.h
+++ b/sandboxed_api/sandbox2/executor.h
@@ -15,7 +15,6 @@
 #ifndef SANDBOXED_API_SANDBOX2_EXECUTOR_H_
 #define SANDBOXED_API_SANDBOX2_EXECUTOR_H_
 
-#include <stdlib.h>
 #include <unistd.h>
 
 #include <memory>
@@ -26,6 +25,7 @@
 #include "absl/base/macros.h"
 #include "absl/log/check.h"
 #include "absl/log/log.h"
+#include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
 #include "absl/types/span.h"
 #include "sandboxed_api/sandbox2/fork_client.h"
diff --git a/sandboxed_api/sandbox2/fork_client.cc b/sandboxed_api/sandbox2/fork_client.cc
index d40c8f8..285344e 100644
--- a/sandboxed_api/sandbox2/fork_client.cc
+++ b/sandboxed_api/sandbox2/fork_client.cc
@@ -14,10 +14,14 @@
 
 #include "sandboxed_api/sandbox2/fork_client.h"
 
+#include <sys/types.h>
+
 #include "absl/log/check.h"
 #include "absl/log/log.h"
+#include "absl/synchronization/mutex.h"
 #include "sandboxed_api/sandbox2/comms.h"
 #include "sandboxed_api/sandbox2/forkserver.pb.h"
+#include "sandboxed_api/util/fileops.h"
 
 namespace sandbox2 {
 
diff --git a/sandboxed_api/sandbox2/forkingclient.cc b/sandboxed_api/sandbox2/forkingclient.cc
index 4affc66..a43f576 100644
--- a/sandboxed_api/sandbox2/forkingclient.cc
+++ b/sandboxed_api/sandbox2/forkingclient.cc
@@ -14,13 +14,13 @@
 
 #include "sandboxed_api/sandbox2/forkingclient.h"
 
-#include <sys/types.h>
 #include <unistd.h>
 
 #include <cstdlib>
 #include <memory>
 
 #include "absl/log/check.h"
+#include "absl/log/log.h"
 #include "sandboxed_api/sandbox2/forkserver.h"
 #include "sandboxed_api/sandbox2/sanitizer.h"
 #include "sandboxed_api/util/raw_logging.h"
diff --git a/sandboxed_api/sandbox2/forkserver.cc b/sandboxed_api/sandbox2/forkserver.cc
index fc96f95..f5f8be9 100644
--- a/sandboxed_api/sandbox2/forkserver.cc
+++ b/sandboxed_api/sandbox2/forkserver.cc
@@ -16,15 +16,15 @@
 
 #include "sandboxed_api/sandbox2/forkserver.h"
 
-#include <asm/types.h>
 #include <fcntl.h>
+#include <linux/filter.h>
+#include <linux/seccomp.h>
 #include <sched.h>
 #include <sys/eventfd.h>
 #include <sys/prctl.h>
 #include <sys/resource.h>
 #include <sys/socket.h>
-#include <sys/types.h>
-#include <sys/un.h>
+#include <sys/uio.h>
 #include <sys/wait.h>
 #include <syscall.h>
 #include <unistd.h>
@@ -32,12 +32,13 @@
 #include <cerrno>
 #include <csignal>
 #include <cstdint>
-#include <cstdio>
 #include <cstdlib>
 #include <cstring>
 #include <fstream>
-#include <memory>
+#include <initializer_list>
 #include <string>
+#include <utility>
+#include <vector>
 
 #include "absl/container/flat_hash_map.h"
 #include "absl/container/flat_hash_set.h"
@@ -47,6 +48,7 @@
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_join.h"
 #include "absl/strings/str_split.h"
+#include "absl/strings/string_view.h"
 #include "libcap/include/sys/capability.h"
 #include "sandboxed_api/sandbox2/client.h"
 #include "sandboxed_api/sandbox2/comms.h"
diff --git a/sandboxed_api/sandbox2/forkserver_bin.cc b/sandboxed_api/sandbox2/forkserver_bin.cc
index edb9bb3..c431954 100644
--- a/sandboxed_api/sandbox2/forkserver_bin.cc
+++ b/sandboxed_api/sandbox2/forkserver_bin.cc
@@ -13,13 +13,13 @@
 // limitations under the License.
 
 #include <sys/prctl.h>
-#include <sys/socket.h>
-#include <unistd.h>
 
 #include <csignal>
 #include <cstdlib>
 
+#include "absl/base/log_severity.h"
 #include "absl/log/globals.h"
+#include "absl/status/status.h"
 #include "sandboxed_api/sandbox2/client.h"
 #include "sandboxed_api/sandbox2/comms.h"
 #include "sandboxed_api/sandbox2/forkserver.h"
diff --git a/sandboxed_api/sandbox2/forkserver_test.cc b/sandboxed_api/sandbox2/forkserver_test.cc
index 9598c3f..1adf207 100644
--- a/sandboxed_api/sandbox2/forkserver_test.cc
+++ b/sandboxed_api/sandbox2/forkserver_test.cc
@@ -16,13 +16,14 @@
 
 #include <fcntl.h>
 #include <sys/socket.h>
-#include <syscall.h>
+#include <sys/wait.h>
 #include <unistd.h>
 
-#include <utility>
+#include <string>
 
 #include "gtest/gtest.h"
 #include "absl/log/check.h"
+#include "absl/log/log.h"
 #include "absl/strings/str_cat.h"
 #include "sandboxed_api/sandbox2/forkserver.pb.h"
 #include "sandboxed_api/sandbox2/global_forkclient.h"
diff --git a/sandboxed_api/sandbox2/global_forkclient.cc b/sandboxed_api/sandbox2/global_forkclient.cc
index b200f59..0ec5132 100644
--- a/sandboxed_api/sandbox2/global_forkclient.cc
+++ b/sandboxed_api/sandbox2/global_forkclient.cc
@@ -19,20 +19,17 @@
 #include <fcntl.h>
 #include <sched.h>
 #include <sys/mman.h>
-#include <sys/prctl.h>
 #include <sys/socket.h>
-#include <sys/types.h>
 #include <sys/wait.h>
-#include <syscall.h>
 #include <unistd.h>
 
-#include <climits>
-#include <csignal>
+#include <cerrno>
 #include <cstdlib>
 #include <memory>
 #include <string>
 #include <vector>
 
+#include "absl/base/const_init.h"
 #include "absl/cleanup/cleanup.h"
 #include "absl/flags/flag.h"
 #include "absl/log/log.h"
diff --git a/sandboxed_api/sandbox2/global_forkclient.h b/sandboxed_api/sandbox2/global_forkclient.h
index 2604744..4517c27 100644
--- a/sandboxed_api/sandbox2/global_forkclient.h
+++ b/sandboxed_api/sandbox2/global_forkclient.h
@@ -21,6 +21,7 @@
 #include <sys/types.h>
 
 #include <bitset>
+#include <cstddef>
 #include <string>
 
 #include "absl/base/thread_annotations.h"
diff --git a/sandboxed_api/sandbox2/ipc.cc b/sandboxed_api/sandbox2/ipc.cc
index 2b73901..14f1ef8 100644
--- a/sandboxed_api/sandbox2/ipc.cc
+++ b/sandboxed_api/sandbox2/ipc.cc
@@ -22,6 +22,7 @@
 #include <memory>
 #include <string>
 #include <tuple>
+#include <vector>
 #include <thread>
 
 #include "absl/log/log.h"
diff --git a/sandboxed_api/sandbox2/ipc.h b/sandboxed_api/sandbox2/ipc.h
index be2461b..f086968 100644
--- a/sandboxed_api/sandbox2/ipc.h
+++ b/sandboxed_api/sandbox2/ipc.h
@@ -23,6 +23,7 @@
 #include <tuple>
 #include <vector>
 
+#include "absl/base/attributes.h"
 #include "absl/strings/string_view.h"
 #include "sandboxed_api/sandbox2/comms.h"
 
diff --git a/sandboxed_api/sandbox2/ipc_test.cc b/sandboxed_api/sandbox2/ipc_test.cc
index 79ac797..6b14503 100644
--- a/sandboxed_api/sandbox2/ipc_test.cc
+++ b/sandboxed_api/sandbox2/ipc_test.cc
@@ -15,9 +15,10 @@
 #include "sandboxed_api/sandbox2/ipc.h"
 
 #include <memory>
+#include <string>
 #include <utility>
+#include <vector>
 
-#include "gmock/gmock.h"
 #include "gtest/gtest.h"
 #include "sandboxed_api/sandbox2/comms.h"
 #include "sandboxed_api/sandbox2/executor.h"
diff --git a/sandboxed_api/sandbox2/limits_test.cc b/sandboxed_api/sandbox2/limits_test.cc
index 84f64ab..bcca89d 100644
--- a/sandboxed_api/sandbox2/limits_test.cc
+++ b/sandboxed_api/sandbox2/limits_test.cc
@@ -20,7 +20,6 @@
 #include <utility>
 #include <vector>
 
-#include "gmock/gmock.h"
 #include "gtest/gtest.h"
 #include "sandboxed_api/config.h"
 #include "sandboxed_api/sandbox2/executor.h"
diff --git a/sandboxed_api/sandbox2/logsink.cc b/sandboxed_api/sandbox2/logsink.cc
index a59299e..abbb840 100644
--- a/sandboxed_api/sandbox2/logsink.cc
+++ b/sandboxed_api/sandbox2/logsink.cc
@@ -17,8 +17,11 @@
 #include <unistd.h>
 
 #include <csignal>
+#include <cstdio>
 #include <string>
 
+#include "absl/base/log_severity.h"
+#include "absl/log/log_entry.h"
 #include "absl/log/log_sink_registry.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_format.h"
diff --git a/sandboxed_api/sandbox2/monitor_base.cc b/sandboxed_api/sandbox2/monitor_base.cc
index 81c3890..4ab5faa 100644
--- a/sandboxed_api/sandbox2/monitor_base.cc
+++ b/sandboxed_api/sandbox2/monitor_base.cc
@@ -16,11 +16,16 @@
 
 #include "sandboxed_api/sandbox2/monitor_base.h"
 
+#include <pthread.h>
 #include <sched.h>
+#include <signal.h>
+#include <sys/resource.h>
 #include <syscall.h>
 
 #include <cerrno>
+#include <cstdint>
 #include <cstdio>
+#include <iomanip>
 #include <memory>
 #include <optional>
 #include <string>
@@ -30,10 +35,14 @@
 #include "absl/cleanup/cleanup.h"
 #include "absl/flags/declare.h"
 #include "absl/flags/flag.h"
+#include "absl/log/check.h"
 #include "absl/log/log.h"
 #include "absl/status/status.h"
+#include "absl/status/statusor.h"
 #include "absl/strings/match.h"
 #include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
+#include "absl/synchronization/notification.h"
 #include "absl/time/time.h"
 #include "sandboxed_api/sandbox2/client.h"
 #include "sandboxed_api/sandbox2/comms.h"
diff --git a/sandboxed_api/sandbox2/monitor_base.h b/sandboxed_api/sandbox2/monitor_base.h
index c6940d4..c5296dd 100644
--- a/sandboxed_api/sandbox2/monitor_base.h
+++ b/sandboxed_api/sandbox2/monitor_base.h
@@ -19,6 +19,7 @@
 #define SANDBOXED_API_SANDBOX2_MONITOR_BASE_H_
 
 #include <sys/resource.h>
+#include <sys/types.h>
 
 #include <cstdint>
 #include <cstdio>
@@ -29,6 +30,7 @@
 
 #include "absl/status/statusor.h"
 #include "absl/synchronization/notification.h"
+#include "absl/time/time.h"
 #include "sandboxed_api/sandbox2/comms.h"
 #include "sandboxed_api/sandbox2/executor.h"
 #include "sandboxed_api/sandbox2/fork_client.h"
diff --git a/sandboxed_api/sandbox2/monitor_ptrace.cc b/sandboxed_api/sandbox2/monitor_ptrace.cc
index 36e0cfe..55612c7 100644
--- a/sandboxed_api/sandbox2/monitor_ptrace.cc
+++ b/sandboxed_api/sandbox2/monitor_ptrace.cc
@@ -17,27 +17,39 @@
 #include "sandboxed_api/sandbox2/monitor_ptrace.h"
 
 #include <sys/ptrace.h>
+#include <sys/resource.h>
 #include <sys/wait.h>
 #include <syscall.h>
 #include <unistd.h>
 
+#include <algorithm>
 #include <atomic>
 #include <cerrno>
-#include <csignal>
+#include <cstdint>
+#include <ctime>
 #include <deque>
 #include <fstream>
 #include <memory>
-#include <sstream>
 #include <string>
 #include <utility>
+#include <vector>
 
+#include "absl/base/optimization.h"
 #include "absl/cleanup/cleanup.h"
+#include "absl/container/flat_hash_map.h"
 #include "absl/container/flat_hash_set.h"
 #include "absl/flags/declare.h"
 #include "absl/flags/flag.h"
+#include "absl/log/check.h"
 #include "absl/log/log.h"
 #include "absl/status/status.h"
+#include "absl/status/statusor.h"
 #include "absl/strings/str_cat.h"
+#include "absl/strings/str_format.h"
+#include "absl/strings/string_view.h"
+#include "absl/synchronization/mutex.h"
+#include "absl/synchronization/notification.h"
+#include "absl/time/clock.h"
 #include "absl/time/time.h"
 #include "sandboxed_api/config.h"
 #include "sandboxed_api/sandbox2/client.h"
diff --git a/sandboxed_api/sandbox2/monitor_ptrace.h b/sandboxed_api/sandbox2/monitor_ptrace.h
index b11a6e3..02994b2 100644
--- a/sandboxed_api/sandbox2/monitor_ptrace.h
+++ b/sandboxed_api/sandbox2/monitor_ptrace.h
@@ -19,14 +19,16 @@
 #define SANDBOXED_API_SANDBOX2_MONITOR_PTRACE_H_
 
 #include <atomic>
-#include <csignal>
 #include <cstdint>
 #include <memory>
 #include <thread>
 
 #include "absl/container/flat_hash_map.h"
+#include "absl/log/log.h"
 #include "absl/synchronization/mutex.h"
 #include "absl/synchronization/notification.h"
+#include "absl/time/clock.h"
+#include "absl/time/time.h"
 #include "sandboxed_api/sandbox2/executor.h"
 #include "sandboxed_api/sandbox2/monitor_base.h"
 #include "sandboxed_api/sandbox2/notify.h"
diff --git a/sandboxed_api/sandbox2/monitor_unotify.cc b/sandboxed_api/sandbox2/monitor_unotify.cc
index 1f85ab0..2724288 100644
--- a/sandboxed_api/sandbox2/monitor_unotify.cc
+++ b/sandboxed_api/sandbox2/monitor_unotify.cc
@@ -1,20 +1,38 @@
 #include "sandboxed_api/sandbox2/monitor_unotify.h"
 
 #include <linux/audit.h>
-#include <linux/filter.h>
-#include <linux/ioctl.h>
 #include <linux/seccomp.h>
 #include <poll.h>
 #include <sys/eventfd.h>
 #include <sys/ioctl.h>
 #include <sys/ptrace.h>
+#include <sys/resource.h>
+#include <sys/sysinfo.h>
 #include <sys/wait.h>
 #include <syscall.h>
 #include <unistd.h>
 
+#include <algorithm>
+#include <atomic>
+#include <cerrno>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <memory>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "absl/base/macros.h"
 #include "absl/cleanup/cleanup.h"
+#include "absl/log/check.h"
 #include "absl/log/log.h"
 #include "absl/status/status.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/str_cat.h"
+#include "absl/synchronization/mutex.h"
+#include "absl/synchronization/notification.h"
+#include "absl/time/clock.h"
 #include "absl/time/time.h"
 #include "sandboxed_api/sandbox2/client.h"
 #include "sandboxed_api/sandbox2/forkserver.pb.h"
diff --git a/sandboxed_api/sandbox2/monitor_unotify.h b/sandboxed_api/sandbox2/monitor_unotify.h
index 81f3d5f..510d308 100644
--- a/sandboxed_api/sandbox2/monitor_unotify.h
+++ b/sandboxed_api/sandbox2/monitor_unotify.h
@@ -2,15 +2,22 @@
 #define SANDBOXED_API_SANDBOX2_MONITOR_UNOTIFY_H_
 
 #include <linux/seccomp.h>
+#include <sys/sysinfo.h>
+#include <sys/types.h>
 
 #include <atomic>
+#include <cstdlib>
 #include <memory>
 #include <thread>
 #include <string>
 #include <vector>
 
+#include "absl/log/log.h"
 #include "absl/status/statusor.h"
 #include "absl/synchronization/mutex.h"
+#include "absl/synchronization/notification.h"
+#include "absl/time/clock.h"
+#include "absl/time/time.h"
 #include "sandboxed_api/sandbox2/executor.h"
 #include "sandboxed_api/sandbox2/monitor_base.h"
 #include "sandboxed_api/sandbox2/notify.h"
diff --git a/sandboxed_api/sandbox2/mounts.cc b/sandboxed_api/sandbox2/mounts.cc
index 0dddbf3..aa44a43 100644
--- a/sandboxed_api/sandbox2/mounts.cc
+++ b/sandboxed_api/sandbox2/mounts.cc
@@ -21,15 +21,18 @@
 #include <sys/types.h>
 #include <unistd.h>
 
-#include <climits>
-#include <memory>
+#include <cerrno>
+#include <cstddef>
+#include <cstdint>
 #include <string>
+#include <tuple>
 #include <utility>
 #include <vector>
 
 #include "absl/container/flat_hash_set.h"
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
+#include "absl/strings/match.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_join.h"
 #include "absl/strings/str_split.h"
diff --git a/sandboxed_api/sandbox2/mounts.h b/sandboxed_api/sandbox2/mounts.h
index dff764f..0a23f55 100644
--- a/sandboxed_api/sandbox2/mounts.h
+++ b/sandboxed_api/sandbox2/mounts.h
@@ -15,7 +15,9 @@
 #ifndef SANDBOXED_API_SANDBOX2_MOUNTTREE_H_
 #define SANDBOXED_API_SANDBOX2_MOUNTTREE_H_
 
+#include <cstddef>
 #include <string>
+#include <utility>
 #include <vector>
 
 #include "absl/status/status.h"
diff --git a/sandboxed_api/sandbox2/mounts_test.cc b/sandboxed_api/sandbox2/mounts_test.cc
index 5b41319..21490a2 100644
--- a/sandboxed_api/sandbox2/mounts_test.cc
+++ b/sandboxed_api/sandbox2/mounts_test.cc
@@ -16,10 +16,13 @@
 
 #include <unistd.h>
 
-#include <utility>
+#include <cstddef>
+#include <string>
+#include <vector>
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
+#include "absl/status/status.h"
 #include "absl/strings/match.h"
 #include "absl/strings/str_cat.h"
 #include "sandboxed_api/testing.h"
diff --git a/sandboxed_api/sandbox2/namespace.cc b/sandboxed_api/sandbox2/namespace.cc
index d8c6847..1de2c98 100644
--- a/sandboxed_api/sandbox2/namespace.cc
+++ b/sandboxed_api/sandbox2/namespace.cc
@@ -27,9 +27,12 @@
 #include <syscall.h>
 #include <unistd.h>
 
+#include <cstdint>
 #include <cstring>
 #include <memory>
+#include <string>
 #include <utility>
+#include <vector>
 
 #include "absl/strings/str_cat.h"
 #include "sandboxed_api/sandbox2/violation.pb.h"
diff --git a/sandboxed_api/sandbox2/namespace.h b/sandboxed_api/sandbox2/namespace.h
index 140cf41..fc6fbd0 100644
--- a/sandboxed_api/sandbox2/namespace.h
+++ b/sandboxed_api/sandbox2/namespace.h
@@ -18,6 +18,7 @@
 #ifndef SANDBOXED_API_SANDBOX2_NAMESPACE_H_
 #define SANDBOXED_API_SANDBOX2_NAMESPACE_H_
 
+#include <sched.h>
 #include <sys/types.h>
 
 #include <cstdint>
diff --git a/sandboxed_api/sandbox2/namespace_test.cc b/sandboxed_api/sandbox2/namespace_test.cc
index d652032..6dc98b3 100644
--- a/sandboxed_api/sandbox2/namespace_test.cc
+++ b/sandboxed_api/sandbox2/namespace_test.cc
@@ -14,11 +14,9 @@
 
 #include "sandboxed_api/sandbox2/namespace.h"
 
-#include <fcntl.h>
-#include <sys/socket.h>
-#include <syscall.h>
 #include <unistd.h>
 
+#include <cstdint>
 #include <initializer_list>
 #include <memory>
 #include <string>
@@ -27,8 +25,10 @@
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
-#include "absl/log/log.h"
+#include "absl/log/check.h"
+#include "absl/status/statusor.h"
 #include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
 #include "sandboxed_api/config.h"
 #include "sandboxed_api/sandbox2/allow_all_syscalls.h"
 #include "sandboxed_api/sandbox2/executor.h"
diff --git a/sandboxed_api/sandbox2/network_proxy/BUILD.bazel b/sandboxed_api/sandbox2/network_proxy/BUILD.bazel
index c0b9db8..296910e 100644
--- a/sandboxed_api/sandbox2/network_proxy/BUILD.bazel
+++ b/sandboxed_api/sandbox2/network_proxy/BUILD.bazel
@@ -30,6 +30,7 @@ cc_library(
         "//sandboxed_api/sandbox2:comms",
         "//sandboxed_api/util:fileops",
         "@com_google_absl//absl/log",
+        "@com_google_absl//absl/status",
         "@com_google_absl//absl/status:statusor",
     ],
 )
diff --git a/sandboxed_api/sandbox2/network_proxy/CMakeLists.txt b/sandboxed_api/sandbox2/network_proxy/CMakeLists.txt
index 75bfba3..f74dd03 100644
--- a/sandboxed_api/sandbox2/network_proxy/CMakeLists.txt
+++ b/sandboxed_api/sandbox2/network_proxy/CMakeLists.txt
@@ -18,11 +18,12 @@ add_library(sandbox2_network_proxy_server ${SAPI_LIB_TYPE}
   server.h
 )
 add_library(sandbox2::network_proxy_server ALIAS sandbox2_network_proxy_server)
-target_link_libraries(sandbox2_network_proxy_server PRIVATE
-  sandbox2::comms
-  sapi::fileops
-  sandbox2::network_proxy_filtering
-  sapi::base
+target_link_libraries(sandbox2_network_proxy_server
+ PRIVATE absl::status
+         sapi::fileops
+         sapi::base
+ PUBLIC sandbox2::comms
+        sandbox2::network_proxy_filtering
 )
 
 # sandboxed_api/sandbox2/network_proxy:filtering
diff --git a/sandboxed_api/sandbox2/network_proxy/client.cc b/sandboxed_api/sandbox2/network_proxy/client.cc
index 46fe6c2..d4320c8 100644
--- a/sandboxed_api/sandbox2/network_proxy/client.cc
+++ b/sandboxed_api/sandbox2/network_proxy/client.cc
@@ -14,17 +14,16 @@
 
 #include "sandboxed_api/sandbox2/network_proxy/client.h"
 
-#include <linux/net.h>
-#include <linux/seccomp.h>
-#include <stdio.h>
+#include <sys/socket.h>
 #include <syscall.h>
+#include <unistd.h>
 
 #include <cerrno>
-#include <iostream>
-#include <memory>
+#include <cstdint>
 
 #include "absl/log/log.h"
 #include "absl/status/status.h"
+#include "absl/synchronization/mutex.h"
 #include "sandboxed_api/sandbox2/util/syscall_trap.h"
 #include "sandboxed_api/util/status_macros.h"
 
diff --git a/sandboxed_api/sandbox2/network_proxy/client.h b/sandboxed_api/sandbox2/network_proxy/client.h
index 70fa79d..78d30eb 100644
--- a/sandboxed_api/sandbox2/network_proxy/client.h
+++ b/sandboxed_api/sandbox2/network_proxy/client.h
@@ -16,6 +16,9 @@
 #define SANDBOXED_API_SANDBOX2_NETWORK_PROXY_CLIENT_H_
 
 #include <netinet/in.h>
+#include <sys/socket.h>
+
+#include <cstdint>
 
 #include "absl/status/status.h"
 #include "absl/synchronization/mutex.h"
diff --git a/sandboxed_api/sandbox2/network_proxy/filtering.cc b/sandboxed_api/sandbox2/network_proxy/filtering.cc
index f67e73c..a1fcbc1 100644
--- a/sandboxed_api/sandbox2/network_proxy/filtering.cc
+++ b/sandboxed_api/sandbox2/network_proxy/filtering.cc
@@ -15,6 +15,15 @@
 #include "sandboxed_api/sandbox2/network_proxy/filtering.h"
 
 #include <arpa/inet.h>
+#include <netinet/in.h>
+#include <sys/socket.h>
+
+#include <algorithm>
+#include <cerrno>
+#include <cstdint>
+#include <cstring>
+#include <string>
+#include <vector>
 
 #include "absl/log/log.h"
 #include "absl/status/status.h"
diff --git a/sandboxed_api/sandbox2/network_proxy/filtering.h b/sandboxed_api/sandbox2/network_proxy/filtering.h
index 392ba74..b0c2c5e 100644
--- a/sandboxed_api/sandbox2/network_proxy/filtering.h
+++ b/sandboxed_api/sandbox2/network_proxy/filtering.h
@@ -17,8 +17,12 @@
 
 #include <netinet/in.h>
 
+#include <cstdint>
 #include <memory>
+#include <string>
+#include <vector>
 
+#include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "sandboxed_api/sandbox2/comms.h"
 
diff --git a/sandboxed_api/sandbox2/network_proxy/filtering_test.cc b/sandboxed_api/sandbox2/network_proxy/filtering_test.cc
index bc185c9..f61a3ff 100644
--- a/sandboxed_api/sandbox2/network_proxy/filtering_test.cc
+++ b/sandboxed_api/sandbox2/network_proxy/filtering_test.cc
@@ -15,8 +15,12 @@
 #include "sandboxed_api/sandbox2/network_proxy/filtering.h"
 
 #include <arpa/inet.h>
-#include <linux/unistd.h>
-#include <string.h>
+#include <netinet/in.h>
+#include <sys/socket.h>
+
+#include <cstdint>
+#include <cstring>
+#include <string>
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
diff --git a/sandboxed_api/sandbox2/network_proxy/server.cc b/sandboxed_api/sandbox2/network_proxy/server.cc
index 93b630f..108c105 100644
--- a/sandboxed_api/sandbox2/network_proxy/server.cc
+++ b/sandboxed_api/sandbox2/network_proxy/server.cc
@@ -14,19 +14,21 @@
 
 #include "sandboxed_api/sandbox2/network_proxy/server.h"
 
-#include <arpa/inet.h>
 #include <netinet/in.h>
+#include <pthread.h>
 #include <signal.h>
 #include <sys/socket.h>
-#include <sys/stat.h>
 #include <sys/types.h>
-#include <syscall.h>
 
+#include <atomic>
 #include <cerrno>
-#include <cstring>
 #include <memory>
+#include <string>
+#include <utility>
+#include <vector>
 
 #include "absl/log/log.h"
+#include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "sandboxed_api/util/fileops.h"
 
diff --git a/sandboxed_api/sandbox2/network_proxy/server.h b/sandboxed_api/sandbox2/network_proxy/server.h
index 2ac373b..0969542 100644
--- a/sandboxed_api/sandbox2/network_proxy/server.h
+++ b/sandboxed_api/sandbox2/network_proxy/server.h
@@ -15,7 +15,11 @@
 #ifndef SANDBOXED_API_SANDBOX2_NETWORK_PROXY_SERVER_H_
 #define SANDBOXED_API_SANDBOX2_NETWORK_PROXY_SERVER_H_
 
+#include <pthread.h>
+
+#include <atomic>
 #include <memory>
+#include <string>
 
 #include "sandboxed_api/sandbox2/comms.h"
 #include "sandboxed_api/sandbox2/network_proxy/filtering.h"
diff --git a/sandboxed_api/sandbox2/notify_test.cc b/sandboxed_api/sandbox2/notify_test.cc
index 246dd0e..ad77dc8 100644
--- a/sandboxed_api/sandbox2/notify_test.cc
+++ b/sandboxed_api/sandbox2/notify_test.cc
@@ -14,6 +14,7 @@
 
 #include "sandboxed_api/sandbox2/notify.h"
 
+#include <sys/types.h>
 #include <syscall.h>
 
 #include <memory>
@@ -32,7 +33,6 @@
 #include "sandboxed_api/sandbox2/policybuilder.h"
 #include "sandboxed_api/sandbox2/sandbox2.h"
 #include "sandboxed_api/sandbox2/syscall.h"
-#include "sandboxed_api/sandbox2/util/bpf_helper.h"
 #include "sandboxed_api/testing.h"
 
 namespace sandbox2 {
diff --git a/sandboxed_api/sandbox2/policy.cc b/sandboxed_api/sandbox2/policy.cc
index 20fc559..a09ee06 100644
--- a/sandboxed_api/sandbox2/policy.cc
+++ b/sandboxed_api/sandbox2/policy.cc
@@ -18,14 +18,20 @@
 
 #include <fcntl.h>
 #include <linux/audit.h>
-#include <linux/ipc.h>
+#include <linux/bpf_common.h>
+#include <linux/filter.h>
+#include <linux/seccomp.h>
 #include <sched.h>
 #include <syscall.h>
 
+#include <cstdint>
+#include <optional>
 #include <string>
+#include <vector>
 
 #include "absl/flags/flag.h"
 #include "absl/log/log.h"
+#include "absl/strings/string_view.h"
 #include "sandboxed_api/config.h"
 #include "sandboxed_api/sandbox2/bpfdisassembler.h"
 #include "sandboxed_api/sandbox2/comms.h"
diff --git a/sandboxed_api/sandbox2/policy.h b/sandboxed_api/sandbox2/policy.h
index 7d931a6..e16e7ae 100644
--- a/sandboxed_api/sandbox2/policy.h
+++ b/sandboxed_api/sandbox2/policy.h
@@ -19,17 +19,21 @@
 #define SANDBOXED_API_SANDBOX2_POLICY_H_
 
 #include <asm/types.h>
-#include <linux/filter.h>
+#include <linux/filter.h>   // IWYU pragma: export
+#include <linux/seccomp.h>  // IWYU pragma: export
 
+#include <cstdint>
 #include <optional>
 #include <vector>
 
 #include "sandboxed_api/sandbox2/namespace.h"
 #include "sandboxed_api/sandbox2/network_proxy/filtering.h"
-#include "sandboxed_api/sandbox2/syscall.h"
 #include "sandboxed_api/sandbox2/violation.pb.h"
 
-#define SANDBOX2_TRACE TRACE(::sandbox2::Syscall::GetHostArch())
+#define SANDBOX2_TRACE         \
+  BPF_STMT(BPF_RET + BPF_K,    \
+           SECCOMP_RET_TRACE | \
+               (::sandbox2::Syscall::GetHostArch() & SECCOMP_RET_DATA))
 
 namespace sandbox2 {
 
@@ -40,8 +44,8 @@ inline constexpr uintptr_t kExecveMagic = 0x921c2c34;
 }  // namespace internal
 
 class Comms;
-class PolicyBuilder;
 class MonitorBase;
+class PolicyBuilder;
 
 class Policy final {
  public:
diff --git a/sandboxed_api/sandbox2/policy_test.cc b/sandboxed_api/sandbox2/policy_test.cc
index 81c131f..6e281af 100644
--- a/sandboxed_api/sandbox2/policy_test.cc
+++ b/sandboxed_api/sandbox2/policy_test.cc
@@ -14,22 +14,20 @@
 
 #include "sandboxed_api/sandbox2/policy.h"
 
-#include <sys/resource.h>
 #include <syscall.h>
-#include <unistd.h>
 
 #include <cerrno>
 #include <cstdlib>
 #include <memory>
 #include <string>
 #include <utility>
+#include <vector>
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
 #include "absl/strings/string_view.h"
 #include "sandboxed_api/config.h"
 #include "sandboxed_api/sandbox2/executor.h"
-#include "sandboxed_api/sandbox2/limits.h"
 #include "sandboxed_api/sandbox2/policybuilder.h"
 #include "sandboxed_api/sandbox2/result.h"
 #include "sandboxed_api/sandbox2/sandbox2.h"
diff --git a/sandboxed_api/sandbox2/policybuilder.cc b/sandboxed_api/sandbox2/policybuilder.cc
index 93d465c..c96bb05 100644
--- a/sandboxed_api/sandbox2/policybuilder.cc
+++ b/sandboxed_api/sandbox2/policybuilder.cc
@@ -14,43 +14,54 @@
 
 #include "sandboxed_api/sandbox2/policybuilder.h"
 
-#include <asm/ioctls.h>  // For TCGETS
-#include <fcntl.h>       // For the fcntl flags
+#include <fcntl.h>  // For the fcntl flags
+#include <linux/bpf_common.h>
 #include <linux/filter.h>
 #include <linux/futex.h>
-#include <linux/net.h>     // For SYS_CONNECT
 #include <linux/random.h>  // For GRND_NONBLOCK
-#include <sys/mman.h>      // For mmap arguments
+#include <linux/seccomp.h>
+#include <stddef.h>
+#include <sys/ioctl.h>
+#include <sys/mman.h>  // For mmap arguments
 #include <sys/prctl.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/statvfs.h>
-#include <sys/types.h>
 #include <syscall.h>
 #include <unistd.h>
 
 #include <array>
+#include <cerrno>
 #include <csignal>
 #include <cstdint>
 #include <deque>
+#include <functional>
+#include <iterator>
+#include <limits>
 #include <memory>
+#include <optional>
+#include <string>
 #include <utility>
+#include <vector>
 
+#include "absl/container/flat_hash_set.h"
 #include "absl/log/log.h"
 #include "absl/memory/memory.h"
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/match.h"
+#include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
+#include "absl/types/span.h"
 #include "sandboxed_api/config.h"
 #include "sandboxed_api/sandbox2/allow_all_syscalls.h"
 #include "sandboxed_api/sandbox2/allow_unrestricted_networking.h"
 #include "sandboxed_api/sandbox2/namespace.h"
 #include "sandboxed_api/sandbox2/policy.h"
+#include "sandboxed_api/sandbox2/syscall.h"
 #include "sandboxed_api/sandbox2/util/bpf_helper.h"
 #include "sandboxed_api/sandbox2/violation.pb.h"
 #include "sandboxed_api/util/path.h"
-#include "sandboxed_api/util/status_macros.h"
 
 #if defined(SAPI_X86_64)
 #include <asm/prctl.h>
diff --git a/sandboxed_api/sandbox2/policybuilder.h b/sandboxed_api/sandbox2/policybuilder.h
index 1ca868f..6637c23 100644
--- a/sandboxed_api/sandbox2/policybuilder.h
+++ b/sandboxed_api/sandbox2/policybuilder.h
@@ -18,19 +18,21 @@
 #include <linux/filter.h>
 
 #include <cstddef>
+#include <cstdint>
 #include <functional>
-#include <initializer_list>
 #include <memory>
-#include <set>
 #include <string>
-#include <tuple>
+#include <utility>
 #include <vector>
 
+#include "absl/base/attributes.h"
 #include "absl/base/macros.h"
 #include "absl/container/flat_hash_set.h"
 #include "absl/log/check.h"
+#include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
+#include "absl/types/optional.h"
 #include "absl/types/span.h"
 #include "sandboxed_api/sandbox2/mounts.h"
 #include "sandboxed_api/sandbox2/network_proxy/filtering.h"
diff --git a/sandboxed_api/sandbox2/policybuilder_test.cc b/sandboxed_api/sandbox2/policybuilder_test.cc
index d20339b..06b398f 100644
--- a/sandboxed_api/sandbox2/policybuilder_test.cc
+++ b/sandboxed_api/sandbox2/policybuilder_test.cc
@@ -20,13 +20,13 @@
 #include <cerrno>
 #include <memory>
 #include <string>
-#include <utility>
+#include <vector>
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
-#include "absl/log/log.h"
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
 #include "sandboxed_api/sandbox2/util/bpf_helper.h"
 #include "sandboxed_api/util/status_matchers.h"
 
diff --git a/sandboxed_api/sandbox2/regs.cc b/sandboxed_api/sandbox2/regs.cc
index 4d1eee5..9224730 100644
--- a/sandboxed_api/sandbox2/regs.cc
+++ b/sandboxed_api/sandbox2/regs.cc
@@ -17,13 +17,13 @@
 #include "sandboxed_api/sandbox2/regs.h"
 
 #include <elf.h>  // IWYU pragma: keep // used for NT_PRSTATUS inside an ifdef
-#include <linux/audit.h>
 #include <sys/ptrace.h>
 #include <sys/uio.h>  // IWYU pragma: keep // used for iovec
 
 #include <cerrno>
+#include <cstdint>
 
-#include "absl/base/macros.h"
+#include "absl/base/optimization.h"
 #include "absl/status/status.h"
 #include "absl/strings/str_cat.h"
 #include "sandboxed_api/config.h"
diff --git a/sandboxed_api/sandbox2/regs_test.cc b/sandboxed_api/sandbox2/regs_test.cc
index 45caa2a..87e6dd6 100644
--- a/sandboxed_api/sandbox2/regs_test.cc
+++ b/sandboxed_api/sandbox2/regs_test.cc
@@ -1,16 +1,19 @@
 #include "sandboxed_api/sandbox2/regs.h"
 
-#include <linux/audit.h>
 #include <linux/filter.h>
 #include <linux/seccomp.h>
 #include <sys/prctl.h>
 #include <sys/ptrace.h>
 #include <sys/socket.h>
 #include <sys/types.h>
+#include <sys/wait.h>
+#include <syscall.h>
 #include <unistd.h>
 
 #include <cerrno>
+#include <cstdint>
 #include <cstdlib>
+#include <vector>
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
diff --git a/sandboxed_api/sandbox2/result.cc b/sandboxed_api/sandbox2/result.cc
index cc13fa0..b11f1d4 100644
--- a/sandboxed_api/sandbox2/result.cc
+++ b/sandboxed_api/sandbox2/result.cc
@@ -16,6 +16,15 @@
 
 #include "sandboxed_api/sandbox2/result.h"
 
+#include <sys/resource.h>
+
+#include <cstdlib>
+#include <memory>
+#include <optional>
+#include <string>
+#include <vector>
+
+#include "absl/status/status.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_join.h"
 #include "sandboxed_api/config.h"
diff --git a/sandboxed_api/sandbox2/result.h b/sandboxed_api/sandbox2/result.h
index a6c974b..459dc63 100644
--- a/sandboxed_api/sandbox2/result.h
+++ b/sandboxed_api/sandbox2/result.h
@@ -23,8 +23,10 @@
 
 #include <cstdint>
 #include <memory>
+#include <optional>
 #include <string>
 #include <utility>
+#include <vector>
 
 #include "absl/status/status.h"
 #include "sandboxed_api/config.h"
diff --git a/sandboxed_api/sandbox2/sandbox2.cc b/sandboxed_api/sandbox2/sandbox2.cc
index 7c20771..95071ab 100644
--- a/sandboxed_api/sandbox2/sandbox2.cc
+++ b/sandboxed_api/sandbox2/sandbox2.cc
@@ -17,6 +17,7 @@
 #include "sandboxed_api/sandbox2/sandbox2.h"
 
 #include <memory>
+#include <utility>
 
 #include "absl/base/call_once.h"
 #include "absl/log/check.h"
diff --git a/sandboxed_api/sandbox2/sandbox2.h b/sandboxed_api/sandbox2/sandbox2.h
index 3ee9e62..2467990 100644
--- a/sandboxed_api/sandbox2/sandbox2.h
+++ b/sandboxed_api/sandbox2/sandbox2.h
@@ -22,9 +22,12 @@
 #include <memory>
 #include <utility>
 
+#include "absl/base/attributes.h"
 #include "absl/base/macros.h"
 #include "absl/log/check.h"
+#include "absl/status/status.h"
 #include "absl/status/statusor.h"
+#include "absl/time/time.h"
 #include "sandboxed_api/sandbox2/comms.h"
 #include "sandboxed_api/sandbox2/executor.h"
 #include "sandboxed_api/sandbox2/ipc.h"
diff --git a/sandboxed_api/sandbox2/sandbox2_test.cc b/sandboxed_api/sandbox2/sandbox2_test.cc
index 3e3b9cc..8060d06 100644
--- a/sandboxed_api/sandbox2/sandbox2_test.cc
+++ b/sandboxed_api/sandbox2/sandbox2_test.cc
@@ -16,16 +16,23 @@
 
 #include <fcntl.h>
 #include <syscall.h>
+#include <unistd.h>
 
 #include <csignal>
 #include <memory>
 #include <string>
 #include <thread>  // NOLINT(build/c++11)
+#include <utility>
 #include <vector>
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
+#include "absl/status/status.h"
 #include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
+#include "absl/synchronization/notification.h"
+#include "absl/time/clock.h"
+#include "absl/time/time.h"
 #include "sandboxed_api/config.h"
 #include "sandboxed_api/sandbox2/executor.h"
 #include "sandboxed_api/sandbox2/policy.h"
diff --git a/sandboxed_api/sandbox2/sanitizer.cc b/sandboxed_api/sandbox2/sanitizer.cc
index 68cca60..d5a393e 100644
--- a/sandboxed_api/sandbox2/sanitizer.cc
+++ b/sandboxed_api/sandbox2/sanitizer.cc
@@ -16,16 +16,6 @@
 
 #include "sandboxed_api/sandbox2/sanitizer.h"
 
-#include "absl/status/status.h"
-
-#if defined(ABSL_HAVE_ADDRESS_SANITIZER) ||   \
-    defined(ABSL_HAVE_HWADDRESS_SANITIZER) || \
-    defined(ABSL_HAVE_LEAK_SANITIZER) ||      \
-    defined(ABSL_HAVE_MEMORY_SANITIZER) || defined(ABSL_HAVE_THREAD_SANITIZER)
-#include <sanitizer/common_interface_defs.h>
-#endif
-
-#include <dirent.h>
 #include <fcntl.h>
 #include <sys/prctl.h>
 #include <syscall.h>
@@ -33,23 +23,26 @@
 
 #include <cerrno>
 #include <csignal>
-#include <cstring>
-#include <fstream>
-#include <sstream>
 #include <string>
-#include <utility>
 #include <vector>
 
 #include "absl/container/flat_hash_set.h"
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
 #include "absl/strings/numbers.h"
 #include "absl/strings/str_cat.h"
-#include "absl/strings/str_split.h"
 #include "sandboxed_api/sandbox2/util.h"
-#include "sandboxed_api/util/file_helpers.h"
 #include "sandboxed_api/util/fileops.h"
 #include "sandboxed_api/util/raw_logging.h"
 #include "sandboxed_api/util/status_macros.h"
 
+#if defined(ABSL_HAVE_ADDRESS_SANITIZER) ||   \
+    defined(ABSL_HAVE_HWADDRESS_SANITIZER) || \
+    defined(ABSL_HAVE_LEAK_SANITIZER) ||      \
+    defined(ABSL_HAVE_MEMORY_SANITIZER) || defined(ABSL_HAVE_THREAD_SANITIZER)
+#include <sanitizer/common_interface_defs.h>
+#endif
+
 namespace sandbox2::sanitizer {
 namespace {
 
diff --git a/sandboxed_api/sandbox2/sanitizer_test.cc b/sandboxed_api/sandbox2/sanitizer_test.cc
index a1c2b29..a60e546 100644
--- a/sandboxed_api/sandbox2/sanitizer_test.cc
+++ b/sandboxed_api/sandbox2/sanitizer_test.cc
@@ -21,6 +21,7 @@
 
 #include <cstdlib>
 #include <memory>
+#include <string>
 #include <utility>
 #include <vector>
 
diff --git a/sandboxed_api/sandbox2/stack_trace.cc b/sandboxed_api/sandbox2/stack_trace.cc
index 42f471c..3062854 100644
--- a/sandboxed_api/sandbox2/stack_trace.cc
+++ b/sandboxed_api/sandbox2/stack_trace.cc
@@ -17,10 +17,11 @@
 #include "sandboxed_api/sandbox2/stack_trace.h"
 
 #include <fcntl.h>
-#include <sys/resource.h>
 #include <sys/stat.h>
 #include <syscall.h>
+#include <unistd.h>
 
+#include <cstdlib>
 #include <memory>
 #include <string>
 #include <utility>
@@ -28,11 +29,15 @@
 
 #include "absl/cleanup/cleanup.h"
 #include "absl/flags/flag.h"
+#include "absl/log/check.h"
 #include "absl/log/log.h"
 #include "absl/memory/memory.h"
 #include "absl/status/status.h"
+#include "absl/status/statusor.h"
 #include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
 #include "absl/strings/strip.h"
+#include "absl/time/time.h"
 #include "sandboxed_api/config.h"
 #include "sandboxed_api/sandbox2/comms.h"
 #include "sandboxed_api/sandbox2/executor.h"
diff --git a/sandboxed_api/sandbox2/stack_trace.h b/sandboxed_api/sandbox2/stack_trace.h
index f3932bb..42a40df 100644
--- a/sandboxed_api/sandbox2/stack_trace.h
+++ b/sandboxed_api/sandbox2/stack_trace.h
@@ -19,10 +19,13 @@
 #ifndef SANDBOXED_API_SANDBOX2_STACK_TRACE_H_
 #define SANDBOXED_API_SANDBOX2_STACK_TRACE_H_
 
+#include <cstddef>
 #include <memory>
 #include <string>
+#include <utility>
 #include <vector>
 
+#include "absl/log/check.h"
 #include "absl/status/statusor.h"
 #include "sandboxed_api/sandbox2/comms.h"
 #include "sandboxed_api/sandbox2/executor.h"
diff --git a/sandboxed_api/sandbox2/stack_trace_test.cc b/sandboxed_api/sandbox2/stack_trace_test.cc
index fb7539e..b395cbb 100644
--- a/sandboxed_api/sandbox2/stack_trace_test.cc
+++ b/sandboxed_api/sandbox2/stack_trace_test.cc
@@ -14,19 +14,21 @@
 
 #include "sandboxed_api/sandbox2/stack_trace.h"
 
-#include <dirent.h>
+#include <sys/types.h>
 
 #include <cstdio>
 #include <functional>
 #include <memory>
 #include <string>
 #include <utility>
+#include <vector>
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
 #include "absl/flags/declare.h"
 #include "absl/flags/flag.h"
 #include "absl/flags/reflection.h"
+#include "absl/log/check.h"
 #include "absl/strings/str_cat.h"
 #include "absl/time/time.h"
 #include "sandboxed_api/sandbox2/executor.h"
diff --git a/sandboxed_api/sandbox2/syscall.cc b/sandboxed_api/sandbox2/syscall.cc
index 581322a..57ca819 100644
--- a/sandboxed_api/sandbox2/syscall.cc
+++ b/sandboxed_api/sandbox2/syscall.cc
@@ -15,15 +15,14 @@
 #include "sandboxed_api/sandbox2/syscall.h"
 
 #include <linux/audit.h>
-#include <linux/elf-em.h>
 
-#include <climits>
-#include <csignal>
-#include <cstring>
+#include <cstdint>
 #include <string>
+#include <vector>
 
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
+#include "absl/strings/string_view.h"
 #include "sandboxed_api/config.h"
 #include "sandboxed_api/sandbox2/syscall_defs.h"
 
diff --git a/sandboxed_api/sandbox2/syscall_defs.cc b/sandboxed_api/sandbox2/syscall_defs.cc
index e7f2e2d..c6d6058 100644
--- a/sandboxed_api/sandbox2/syscall_defs.cc
+++ b/sandboxed_api/sandbox2/syscall_defs.cc
@@ -1,13 +1,18 @@
 #include "sandboxed_api/sandbox2/syscall_defs.h"
 
+#include <sys/types.h>
+
+#include <array>
 #include <cstdint>
-#include <type_traits>
+#include <string>
+#include <vector>
 
 #include "absl/algorithm/container.h"
-#include "absl/log/log.h"
+#include "absl/status/statusor.h"
 #include "absl/strings/escaping.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_format.h"
+#include "absl/strings/string_view.h"
 #include "sandboxed_api/config.h"
 #include "sandboxed_api/sandbox2/util.h"
 
diff --git a/sandboxed_api/sandbox2/syscall_test.cc b/sandboxed_api/sandbox2/syscall_test.cc
index c588871..b152dc5 100644
--- a/sandboxed_api/sandbox2/syscall_test.cc
+++ b/sandboxed_api/sandbox2/syscall_test.cc
@@ -14,7 +14,10 @@
 
 #include "sandboxed_api/sandbox2/syscall.h"
 
-#include <linux/unistd.h>
+#include <syscall.h>
+
+#include <array>
+#include <vector>
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
diff --git a/sandboxed_api/sandbox2/testcases/BUILD.bazel b/sandboxed_api/sandbox2/testcases/BUILD.bazel
index 94777af..b576709 100644
--- a/sandboxed_api/sandbox2/testcases/BUILD.bazel
+++ b/sandboxed_api/sandbox2/testcases/BUILD.bazel
@@ -149,6 +149,7 @@ cc_binary(
         "//sandboxed_api/sandbox2:sanitizer",
         "@com_google_absl//absl/container:flat_hash_set",
         "@com_google_absl//absl/log:check",
+        "@com_google_absl//absl/status",
         "@com_google_absl//absl/strings",
     ],
 )
@@ -231,5 +232,6 @@ cc_binary(
         "//sandboxed_api/util:fileops",
         "@com_google_absl//absl/container:flat_hash_set",
         "@com_google_absl//absl/log:check",
+        "@com_google_absl//absl/strings",
     ],
 )
diff --git a/sandboxed_api/sandbox2/testcases/CMakeLists.txt b/sandboxed_api/sandbox2/testcases/CMakeLists.txt
index 481e66d..496e678 100644
--- a/sandboxed_api/sandbox2/testcases/CMakeLists.txt
+++ b/sandboxed_api/sandbox2/testcases/CMakeLists.txt
@@ -178,6 +178,7 @@ set_target_properties(sandbox2_testcase_close_fds PROPERTIES
 target_link_libraries(sandbox2_testcase_close_fds PRIVATE
   sapi::base
   absl::check
+  absl::status
   absl::strings
   absl::flat_hash_set
   sandbox2::sanitizer
@@ -284,6 +285,7 @@ target_link_libraries(sandbox2_testcase_namespace PRIVATE
   -static
   absl::check
   absl::flat_hash_set
+  absl::strings
   sandbox2::comms
   sapi::base
   sapi::file_base
diff --git a/sandboxed_api/sandbox2/testcases/buffer.cc b/sandboxed_api/sandbox2/testcases/buffer.cc
index 733be92..94a070b 100644
--- a/sandboxed_api/sandbox2/testcases/buffer.cc
+++ b/sandboxed_api/sandbox2/testcases/buffer.cc
@@ -16,6 +16,7 @@
 
 #include "sandboxed_api/sandbox2/buffer.h"
 
+#include <cstdint>
 #include <utility>
 
 int main(int argc, char* argv[]) {
diff --git a/sandboxed_api/sandbox2/testcases/close_fds.cc b/sandboxed_api/sandbox2/testcases/close_fds.cc
index 156a8aa..397d6f1 100644
--- a/sandboxed_api/sandbox2/testcases/close_fds.cc
+++ b/sandboxed_api/sandbox2/testcases/close_fds.cc
@@ -1,11 +1,11 @@
 #include <fcntl.h>
 #include <linux/fs.h>
-#include <unistd.h>
 
 #include <cerrno>
 
 #include "absl/container/flat_hash_set.h"
 #include "absl/log/check.h"
+#include "absl/status/status.h"
 #include "absl/strings/numbers.h"
 #include "sandboxed_api/sandbox2/sanitizer.h"
 
diff --git a/sandboxed_api/sandbox2/testcases/limits.cc b/sandboxed_api/sandbox2/testcases/limits.cc
index 31f4b66..63db2a1 100644
--- a/sandboxed_api/sandbox2/testcases/limits.cc
+++ b/sandboxed_api/sandbox2/testcases/limits.cc
@@ -18,6 +18,7 @@
 // expansion, for instance with a large stack allocation with alloca(3),
 // and we have no alternate stack, then we are killed with SIGSEGV.
 
+#include <alloca.h>
 #include <sys/mman.h>
 
 #include <cerrno>
diff --git a/sandboxed_api/sandbox2/testcases/namespace.cc b/sandboxed_api/sandbox2/testcases/namespace.cc
index 725addd..9036fd5 100644
--- a/sandboxed_api/sandbox2/testcases/namespace.cc
+++ b/sandboxed_api/sandbox2/testcases/namespace.cc
@@ -31,7 +31,6 @@
 #include <fcntl.h>
 #include <ifaddrs.h>
 #include <sys/stat.h>
-#include <sys/types.h>
 #include <unistd.h>
 
 #include <cstdlib>
@@ -40,6 +39,7 @@
 
 #include "absl/container/flat_hash_set.h"
 #include "absl/log/check.h"
+#include "absl/strings/str_cat.h"
 #include "sandboxed_api/sandbox2/comms.h"
 #include "sandboxed_api/util/fileops.h"
 #include "sandboxed_api/util/path.h"
diff --git a/sandboxed_api/sandbox2/testcases/starve.cc b/sandboxed_api/sandbox2/testcases/starve.cc
index bcd705c..6903c0a 100644
--- a/sandboxed_api/sandbox2/testcases/starve.cc
+++ b/sandboxed_api/sandbox2/testcases/starve.cc
@@ -13,10 +13,10 @@
 // limitations under the License.
 
 #include <sched.h>
-#include <signal.h>
 #include <unistd.h>
 
-#include <cinttypes>
+#include <csignal>
+#include <cstdint>
 
 constexpr int kProcesses = 512;
 constexpr int kThreads = 1;
diff --git a/sandboxed_api/sandbox2/testcases/symbolize.cc b/sandboxed_api/sandbox2/testcases/symbolize.cc
index 0b20c69..5022947 100644
--- a/sandboxed_api/sandbox2/testcases/symbolize.cc
+++ b/sandboxed_api/sandbox2/testcases/symbolize.cc
@@ -15,7 +15,7 @@
 // A binary that exits via different modes: crashes, causes violation, exits
 // normally or times out, to test the stack tracing symbolizer.
 
-#include <sys/syscall.h>
+#include <syscall.h>
 #include <unistd.h>
 
 #include <cstdlib>
diff --git a/sandboxed_api/sandbox2/testcases/tsync.cc b/sandboxed_api/sandbox2/testcases/tsync.cc
index 8c7ee2c..e062a41 100644
--- a/sandboxed_api/sandbox2/testcases/tsync.cc
+++ b/sandboxed_api/sandbox2/testcases/tsync.cc
@@ -19,6 +19,7 @@
 #include <unistd.h>
 
 #include <cstdio>
+#include <cstdlib>
 
 #include "sandboxed_api/sandbox2/client.h"
 #include "sandboxed_api/sandbox2/comms.h"
diff --git a/sandboxed_api/sandbox2/unwind/ptrace_hook.cc b/sandboxed_api/sandbox2/unwind/ptrace_hook.cc
index 9b79a59..c73086f 100644
--- a/sandboxed_api/sandbox2/unwind/ptrace_hook.cc
+++ b/sandboxed_api/sandbox2/unwind/ptrace_hook.cc
@@ -26,6 +26,7 @@
 #include <cstring>
 #include <vector>
 
+#include "absl/strings/string_view.h"
 #include "sandboxed_api/sandbox2/util/syscall_trap.h"
 
 // Android doesn't use an enum for __ptrace_request, use int instead.
diff --git a/sandboxed_api/sandbox2/unwind/unwind.cc b/sandboxed_api/sandbox2/unwind/unwind.cc
index 4b927b9..19e572c 100644
--- a/sandboxed_api/sandbox2/unwind/unwind.cc
+++ b/sandboxed_api/sandbox2/unwind/unwind.cc
@@ -16,15 +16,15 @@
 
 #include <cxxabi.h>
 #include <sys/ptrace.h>
+#include <sys/types.h>
 
 #include <cerrno>
-#include <cstddef>
 #include <cstdint>
-#include <cstdio>
 #include <cstdlib>
 #include <map>
 #include <memory>
 #include <string>
+#include <utility>
 #include <vector>
 
 #include "absl/cleanup/cleanup.h"
@@ -32,6 +32,7 @@
 #include "absl/status/statusor.h"
 #include "absl/strings/match.h"
 #include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
 #include "libunwind-ptrace.h"
 #include "sandboxed_api/config.h"
 #include "sandboxed_api/sandbox2/comms.h"
diff --git a/sandboxed_api/sandbox2/unwind/unwind.h b/sandboxed_api/sandbox2/unwind/unwind.h
index 2a14445..d37b46a 100644
--- a/sandboxed_api/sandbox2/unwind/unwind.h
+++ b/sandboxed_api/sandbox2/unwind/unwind.h
@@ -18,6 +18,7 @@
 #include <sys/types.h>
 
 #include <cstdint>
+#include <map>
 #include <string>
 #include <vector>
 
diff --git a/sandboxed_api/sandbox2/util.cc b/sandboxed_api/sandbox2/util.cc
index a4ac3de..0e475cd 100644
--- a/sandboxed_api/sandbox2/util.cc
+++ b/sandboxed_api/sandbox2/util.cc
@@ -14,19 +14,20 @@
 
 #include "sandboxed_api/sandbox2/util.h"
 
-#include <asm/unistd.h>  // __NR_memdfd_create
 #include <sched.h>
 #include <spawn.h>
 #include <sys/ptrace.h>
 #include <sys/resource.h>
 #include <sys/uio.h>
 #include <sys/wait.h>
+#include <syscall.h>
 #include <unistd.h>
 
 #include <cerrno>
 #include <csetjmp>
 #include <cstddef>
 #include <cstdint>
+#include <cstdlib>
 #include <cstring>
 #include <string>
 #include <utility>
diff --git a/sandboxed_api/sandbox2/util/BUILD.bazel b/sandboxed_api/sandbox2/util/BUILD.bazel
index 800c939..86cc785 100644
--- a/sandboxed_api/sandbox2/util/BUILD.bazel
+++ b/sandboxed_api/sandbox2/util/BUILD.bazel
@@ -48,7 +48,6 @@ cc_library(
         "//sandboxed_api/sandbox2:util",
         "//sandboxed_api/util:raw_logging",
         "//sandboxed_api/util:status",
-        "//sandboxed_api/util:strerror",
         "@com_google_absl//absl/base:endian",
         "@com_google_absl//absl/status",
         "@com_google_absl//absl/status:statusor",
@@ -72,7 +71,7 @@ cc_test(
         "//sandboxed_api/util:file_helpers",
         "//sandboxed_api/util:status_matchers",
         "@com_google_absl//absl/algorithm:container",
-        "@com_google_absl//absl/strings",
+        "@com_google_absl//absl/status:statusor",
         "@com_google_googletest//:gtest_main",
     ],
 )
@@ -107,6 +106,7 @@ cc_test(
     deps = [
         ":maps_parser",
         "//sandboxed_api/util:status_matchers",
+        "@com_google_absl//absl/status:statusor",
         "@com_google_googletest//:gtest_main",
     ],
 )
diff --git a/sandboxed_api/sandbox2/util/CMakeLists.txt b/sandboxed_api/sandbox2/util/CMakeLists.txt
index fc7821d..c7297bb 100644
--- a/sandboxed_api/sandbox2/util/CMakeLists.txt
+++ b/sandboxed_api/sandbox2/util/CMakeLists.txt
@@ -31,7 +31,6 @@ add_library(sandbox2::minielf ALIAS sandbox2_util_minielf)
 target_link_libraries(sandbox2_util_minielf PRIVATE
   absl::status
   absl::strings
-  sapi::strerror
   sandbox2::util
   sapi::base
   sapi::raw_logging
@@ -76,7 +75,7 @@ if(BUILD_TESTING AND SAPI_BUILD_TESTING)
                  testdata/chrome_grte_header COPYONLY)
   target_link_libraries(sandbox2_minielf_test
     PRIVATE absl::algorithm_container
-            absl::strings
+            absl::statusor
             sapi::file_helpers
             sandbox2::maps_parser
             sandbox2::minielf
@@ -98,6 +97,7 @@ if(BUILD_TESTING AND SAPI_BUILD_TESTING)
     OUTPUT_NAME maps_parser_test
   )
   target_link_libraries(sandbox2_maps_parser_test PRIVATE
+    absl::statusor
     sandbox2::maps_parser
     sapi::status_matchers
     sapi::test_main
diff --git a/sandboxed_api/sandbox2/util/maps_parser.cc b/sandboxed_api/sandbox2/util/maps_parser.cc
index ddea528..9ddaf58 100644
--- a/sandboxed_api/sandbox2/util/maps_parser.cc
+++ b/sandboxed_api/sandbox2/util/maps_parser.cc
@@ -14,6 +14,11 @@
 
 #include "sandboxed_api/sandbox2/util/maps_parser.h"
 
+#include <cstdio>
+#include <cstring>
+#include <string>
+#include <vector>
+
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/str_split.h"
diff --git a/sandboxed_api/sandbox2/util/maps_parser_test.cc b/sandboxed_api/sandbox2/util/maps_parser_test.cc
index b758581..b0585d7 100644
--- a/sandboxed_api/sandbox2/util/maps_parser_test.cc
+++ b/sandboxed_api/sandbox2/util/maps_parser_test.cc
@@ -14,8 +14,11 @@
 
 #include "sandboxed_api/sandbox2/util/maps_parser.h"
 
+#include <vector>
+
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
+#include "absl/status/statusor.h"
 #include "sandboxed_api/util/status_matchers.h"
 
 namespace sandbox2 {
diff --git a/sandboxed_api/sandbox2/util/minielf.cc b/sandboxed_api/sandbox2/util/minielf.cc
index bb5f49d..a5bf27e 100644
--- a/sandboxed_api/sandbox2/util/minielf.cc
+++ b/sandboxed_api/sandbox2/util/minielf.cc
@@ -16,15 +16,23 @@
 
 #include <elf.h>
 
+#include <algorithm>
+#include <cerrno>
 #include <cstddef>
-#include <memory>
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include <string>
 #include <type_traits>
+#include <utility>
+#include <vector>
 
 #include "absl/base/internal/endian.h"
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/match.h"
 #include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
 #include "sandboxed_api/config.h"
 #include "sandboxed_api/sandbox2/util.h"
 #include "sandboxed_api/util/raw_logging.h"
diff --git a/sandboxed_api/sandbox2/util/minielf_test.cc b/sandboxed_api/sandbox2/util/minielf_test.cc
index cccd97f..10ddaa4 100644
--- a/sandboxed_api/sandbox2/util/minielf_test.cc
+++ b/sandboxed_api/sandbox2/util/minielf_test.cc
@@ -21,6 +21,7 @@
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
 #include "absl/algorithm/container.h"
+#include "absl/status/statusor.h"
 #include "sandboxed_api/sandbox2/util/maps_parser.h"
 #include "sandboxed_api/testing.h"
 #include "sandboxed_api/util/file_helpers.h"
diff --git a/sandboxed_api/sandbox2/util/syscall_trap.cc b/sandboxed_api/sandbox2/util/syscall_trap.cc
index 50a9eaf..44ed8e4 100644
--- a/sandboxed_api/sandbox2/util/syscall_trap.cc
+++ b/sandboxed_api/sandbox2/util/syscall_trap.cc
@@ -16,6 +16,11 @@
 
 #include <ucontext.h>
 
+#include <array>
+#include <cerrno>
+#include <csignal>
+#include <cstdint>
+
 #include "absl/log/check.h"
 #include "sandboxed_api/config.h"
 
diff --git a/sandboxed_api/sandbox2/util_test.cc b/sandboxed_api/sandbox2/util_test.cc
index 2a371e8..52e58ea 100644
--- a/sandboxed_api/sandbox2/util_test.cc
+++ b/sandboxed_api/sandbox2/util_test.cc
@@ -14,15 +14,22 @@
 
 #include "sandboxed_api/sandbox2/util.h"
 
+#include <sched.h>
 #include <sys/mman.h>
+#include <sys/wait.h>
 #include <unistd.h>
 
-#include <cstddef>
+#include <cstdint>
 #include <cstdlib>
+#include <cstring>
+#include <string>
+#include <vector>
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
 #include "absl/cleanup/cleanup.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
 #include "sandboxed_api/util/status_matchers.h"
 
diff --git a/sandboxed_api/sapi_test.cc b/sandboxed_api/sapi_test.cc
index ef6936b..4d4ee3c 100644
--- a/sandboxed_api/sapi_test.cc
+++ b/sandboxed_api/sapi_test.cc
@@ -15,12 +15,16 @@
 #include <fcntl.h>
 
 #include <memory>
+#include <string>
 #include <thread>  // NOLINT(build/c++11)
 
 #include "benchmark/benchmark.h"
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
 #include "absl/status/status.h"
+#include "absl/status/statusor.h"
+#include "absl/time/clock.h"
+#include "absl/time/time.h"
 #include "sandboxed_api/examples/stringop/stringop-sapi.sapi.h"
 #include "sandboxed_api/examples/stringop/stringop_params.pb.h"
 #include "sandboxed_api/examples/sum/sum-sapi.sapi.h"
diff --git a/sandboxed_api/testing.cc b/sandboxed_api/testing.cc
index 933417b..9f463dc 100644
--- a/sandboxed_api/testing.cc
+++ b/sandboxed_api/testing.cc
@@ -15,6 +15,7 @@
 #include "sandboxed_api/testing.h"
 
 #include <cstdlib>
+#include <string>
 
 #include "absl/strings/string_view.h"
 #include "sandboxed_api/config.h"
diff --git a/sandboxed_api/tools/clang_generator/BUILD.bazel b/sandboxed_api/tools/clang_generator/BUILD.bazel
index de967aa..210a4f9 100644
--- a/sandboxed_api/tools/clang_generator/BUILD.bazel
+++ b/sandboxed_api/tools/clang_generator/BUILD.bazel
@@ -33,7 +33,6 @@ cc_library(
     copts = sapi_platform_copts(),
     deps = [
         "//sandboxed_api/util:status",
-        "@com_google_absl//absl/algorithm:container",
         "@com_google_absl//absl/container:flat_hash_set",
         "@com_google_absl//absl/container:node_hash_set",
         "@com_google_absl//absl/random",
@@ -63,7 +62,6 @@ cc_test(
     copts = sapi_platform_copts(),
     deps = [
         ":generator",
-        "//sandboxed_api:testing",
         "//sandboxed_api/util:status_matchers",
         "@com_google_absl//absl/container:flat_hash_map",
         "@com_google_absl//absl/memory",
@@ -95,11 +93,10 @@ cc_binary(
         "//sandboxed_api/util:fileops",
         "//sandboxed_api/util:status",
         "@com_google_absl//absl/status",
+        "@com_google_absl//absl/status:statusor",
         "@com_google_absl//absl/strings",
         "@com_google_absl//absl/strings:str_format",
-        "@llvm-project//clang:ast",
         "@llvm-project//clang:driver",
-        "@llvm-project//clang:frontend",
         "@llvm-project//clang:tooling",
         "@llvm-project//llvm:Support",
     ],
diff --git a/sandboxed_api/tools/clang_generator/CMakeLists.txt b/sandboxed_api/tools/clang_generator/CMakeLists.txt
index ec0c128..8a373ef 100644
--- a/sandboxed_api/tools/clang_generator/CMakeLists.txt
+++ b/sandboxed_api/tools/clang_generator/CMakeLists.txt
@@ -102,7 +102,6 @@ else()
 endif()
 target_link_libraries(sapi_generator PUBLIC
   sapi::base
-  absl::algorithm_container
   absl::btree
   absl::flat_hash_set
   absl::node_hash_set
@@ -122,6 +121,7 @@ add_executable(sapi_generator_tool
   generator_tool.cc
 )
 target_link_libraries(sapi_generator_tool PRIVATE
+  absl::statusor
   sapi::base
   sapi::file_base
   sapi::file_helpers
diff --git a/sandboxed_api/tools/clang_generator/compilation_database.cc b/sandboxed_api/tools/clang_generator/compilation_database.cc
index 1ffd312..879796b 100644
--- a/sandboxed_api/tools/clang_generator/compilation_database.cc
+++ b/sandboxed_api/tools/clang_generator/compilation_database.cc
@@ -16,8 +16,11 @@
 
 #include <algorithm>
 #include <memory>
+#include <string>
+#include <utility>
+#include <vector>
 
-#include "absl/strings/match.h"
+#include "absl/strings/string_view.h"
 #include "absl/strings/strip.h"
 #include "clang/Driver/Types.h"
 #include "clang/Tooling/CompilationDatabase.h"
diff --git a/sandboxed_api/tools/clang_generator/diagnostics.cc b/sandboxed_api/tools/clang_generator/diagnostics.cc
index 7d05aa5..d64cb26 100644
--- a/sandboxed_api/tools/clang_generator/diagnostics.cc
+++ b/sandboxed_api/tools/clang_generator/diagnostics.cc
@@ -14,8 +14,13 @@
 
 #include "sandboxed_api/tools/clang_generator/diagnostics.h"
 
+#include <cstdint>
+#include <utility>
+
 #include "absl/status/status.h"
 #include "absl/strings/cord.h"
+#include "absl/strings/string_view.h"
+#include "absl/types/optional.h"
 #include "clang/Basic/Diagnostic.h"
 
 namespace sapi {
diff --git a/sandboxed_api/tools/clang_generator/emitter.cc b/sandboxed_api/tools/clang_generator/emitter.cc
index 9232a1a..ab14b0d 100644
--- a/sandboxed_api/tools/clang_generator/emitter.cc
+++ b/sandboxed_api/tools/clang_generator/emitter.cc
@@ -14,7 +14,16 @@
 
 #include "sandboxed_api/tools/clang_generator/emitter.h"
 
+#include <algorithm>
+#include <cstdint>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "absl/container/flat_hash_set.h"
+#include "absl/container/node_hash_set.h"
 #include "absl/random/random.h"
+#include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/ascii.h"
 #include "absl/strings/match.h"
diff --git a/sandboxed_api/tools/clang_generator/emitter.h b/sandboxed_api/tools/clang_generator/emitter.h
index 62556d5..f0f5996 100644
--- a/sandboxed_api/tools/clang_generator/emitter.h
+++ b/sandboxed_api/tools/clang_generator/emitter.h
@@ -16,6 +16,7 @@
 #define SANDBOXED_API_TOOLS_CLANG_GENERATOR_EMITTER_H_
 
 #include <string>
+#include <utility>
 #include <vector>
 
 #include "absl/container/flat_hash_set.h"
diff --git a/sandboxed_api/tools/clang_generator/emitter_test.cc b/sandboxed_api/tools/clang_generator/emitter_test.cc
index cdfb8ba..b69ad37 100644
--- a/sandboxed_api/tools/clang_generator/emitter_test.cc
+++ b/sandboxed_api/tools/clang_generator/emitter_test.cc
@@ -16,10 +16,13 @@
 
 #include <initializer_list>
 #include <memory>
+#include <string>
+#include <vector>
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
 #include "absl/status/statusor.h"
+#include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
 #include "sandboxed_api/tools/clang_generator/frontend_action_test_util.h"
 #include "sandboxed_api/tools/clang_generator/generator.h"
diff --git a/sandboxed_api/tools/clang_generator/frontend_action_test_util.cc b/sandboxed_api/tools/clang_generator/frontend_action_test_util.cc
index c7e3465..b29b71c 100644
--- a/sandboxed_api/tools/clang_generator/frontend_action_test_util.cc
+++ b/sandboxed_api/tools/clang_generator/frontend_action_test_util.cc
@@ -16,11 +16,17 @@
 
 #include <algorithm>
 #include <iterator>
+#include <memory>
+#include <string>
+#include <utility>
 #include <vector>
 
+#include "absl/container/flat_hash_map.h"
 #include "absl/status/status.h"
 #include "absl/strings/ascii.h"
+#include "absl/strings/str_cat.h"
 #include "absl/strings/str_replace.h"
+#include "absl/strings/string_view.h"
 #include "clang/Basic/FileManager.h"
 #include "clang/Basic/FileSystemOptions.h"
 #include "clang/Frontend/FrontendAction.h"
diff --git a/sandboxed_api/tools/clang_generator/frontend_action_test_util.h b/sandboxed_api/tools/clang_generator/frontend_action_test_util.h
index 577951d..502d66a 100644
--- a/sandboxed_api/tools/clang_generator/frontend_action_test_util.h
+++ b/sandboxed_api/tools/clang_generator/frontend_action_test_util.h
@@ -17,6 +17,7 @@
 
 #include <memory>
 #include <string>
+#include <utility>
 #include <vector>
 
 #include "gmock/gmock.h"
diff --git a/sandboxed_api/tools/clang_generator/generator.cc b/sandboxed_api/tools/clang_generator/generator.cc
index f758db4..ebfc162 100644
--- a/sandboxed_api/tools/clang_generator/generator.cc
+++ b/sandboxed_api/tools/clang_generator/generator.cc
@@ -14,13 +14,17 @@
 
 #include "sandboxed_api/tools/clang_generator/generator.h"
 
-#include <fstream>
-#include <iostream>
+#include <memory>
+#include <optional>
+#include <string>
+#include <utility>
+#include <vector>
 
-#include "absl/algorithm/container.h"
+#include "absl/container/flat_hash_set.h"
 #include "absl/status/status.h"
 #include "absl/strings/match.h"
-#include "absl/strings/str_format.h"
+#include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
 #include "absl/strings/strip.h"
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/Decl.h"
diff --git a/sandboxed_api/tools/clang_generator/generator.h b/sandboxed_api/tools/clang_generator/generator.h
index 5cd118e..ce6b5fb 100644
--- a/sandboxed_api/tools/clang_generator/generator.h
+++ b/sandboxed_api/tools/clang_generator/generator.h
@@ -17,6 +17,8 @@
 
 #include <memory>
 #include <string>
+#include <utility>
+#include <vector>
 
 #include "absl/container/flat_hash_set.h"
 #include "absl/strings/string_view.h"
diff --git a/sandboxed_api/tools/clang_generator/generator_tool.cc b/sandboxed_api/tools/clang_generator/generator_tool.cc
index c74b00f..9fc0d41 100644
--- a/sandboxed_api/tools/clang_generator/generator_tool.cc
+++ b/sandboxed_api/tools/clang_generator/generator_tool.cc
@@ -12,12 +12,14 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+#include <cstdio>
 #include <cstdlib>
 #include <memory>
 #include <string>
 #include <vector>
 
 #include "absl/status/status.h"
+#include "absl/status/statusor.h"
 #include "absl/strings/match.h"
 #include "absl/strings/str_format.h"
 #include "clang/Tooling/CommonOptionsParser.h"
diff --git a/sandboxed_api/tools/clang_generator/types.cc b/sandboxed_api/tools/clang_generator/types.cc
index 08750b4..b4c90c9 100644
--- a/sandboxed_api/tools/clang_generator/types.cc
+++ b/sandboxed_api/tools/clang_generator/types.cc
@@ -14,9 +14,11 @@
 
 #include "sandboxed_api/tools/clang_generator/types.h"
 
+#include <string>
+#include <vector>
+
 #include "absl/container/flat_hash_set.h"
 #include "absl/strings/str_cat.h"
-#include "absl/strings/str_format.h"
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/Decl.h"
 #include "clang/AST/QualTypeNames.h"
diff --git a/sandboxed_api/tools/filewrapper/BUILD.bazel b/sandboxed_api/tools/filewrapper/BUILD.bazel
index 278ca16..42356ca 100644
--- a/sandboxed_api/tools/filewrapper/BUILD.bazel
+++ b/sandboxed_api/tools/filewrapper/BUILD.bazel
@@ -48,7 +48,6 @@ cc_test(
         "//sandboxed_api:testing",
         "//sandboxed_api/util:file_helpers",
         "//sandboxed_api/util:status_matchers",
-        "@com_google_absl//absl/strings",
         "@com_google_googletest//:gtest_main",
     ],
 )
diff --git a/sandboxed_api/tools/filewrapper/CMakeLists.txt b/sandboxed_api/tools/filewrapper/CMakeLists.txt
index a8723e5..e5cc67b 100644
--- a/sandboxed_api/tools/filewrapper/CMakeLists.txt
+++ b/sandboxed_api/tools/filewrapper/CMakeLists.txt
@@ -41,7 +41,6 @@ if(BUILD_TESTING AND SAPI_BUILD_TESTING)
   configure_file(testdata/filewrapper_embedded.bin
                  testdata/filewrapper_embedded.bin COPYONLY)
   target_link_libraries(sapi_filewrapper_test PRIVATE
-    absl::strings
     filewrapper_embedded
     sapi::file_helpers
     sapi::fileops
diff --git a/sandboxed_api/tools/filewrapper/filewrapper.cc b/sandboxed_api/tools/filewrapper/filewrapper.cc
index b2fdd9a..3e5783e 100644
--- a/sandboxed_api/tools/filewrapper/filewrapper.cc
+++ b/sandboxed_api/tools/filewrapper/filewrapper.cc
@@ -15,9 +15,9 @@
 // Simple utility to wrap a binary file in a C++ source file.
 
 #include <algorithm>
-#include <cstdint>
 #include <cstdio>
 #include <cstdlib>
+#include <cstring>
 #include <string>
 #include <utility>
 #include <vector>
@@ -158,7 +158,6 @@ constexpr const char kCcFileHeaderFmt[] =
     R"(// Automatically generated by sapi_cc_embed_data() build rule
 
 #include "%s.h"
-
 #include "absl/base/macros.h"
 #include "absl/strings/string_view.h"
 
diff --git a/sandboxed_api/tools/filewrapper/filewrapper_test.cc b/sandboxed_api/tools/filewrapper/filewrapper_test.cc
index b6dbcd8..89ee00e 100644
--- a/sandboxed_api/tools/filewrapper/filewrapper_test.cc
+++ b/sandboxed_api/tools/filewrapper/filewrapper_test.cc
@@ -12,11 +12,10 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#include <cstdint>
+#include <string>
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
-#include "absl/strings/string_view.h"
 #include "sandboxed_api/testing.h"
 #include "sandboxed_api/tools/filewrapper/filewrapper_embedded.h"
 #include "sandboxed_api/util/file_helpers.h"
diff --git a/sandboxed_api/tools/generator2/BUILD.bazel b/sandboxed_api/tools/generator2/BUILD.bazel
index 1251d64..31f0055 100644
--- a/sandboxed_api/tools/generator2/BUILD.bazel
+++ b/sandboxed_api/tools/generator2/BUILD.bazel
@@ -43,6 +43,8 @@ py_binary(
     deps = [
         ":code",
         "@com_google_absl_py//absl:app",
+        "@com_google_absl_py//absl/flags",
+        "@com_google_absl_py//absl/logging",
     ],
 )
 
@@ -79,6 +81,7 @@ cc_binary(
     ],
     copts = sapi_platform_copts(),
     deps = [
+        ":tests_sapi_generator",
         "//sandboxed_api:sapi",
         "//sandboxed_api:vars",
         "//sandboxed_api/util:status",
diff --git a/sandboxed_api/transaction.cc b/sandboxed_api/transaction.cc
index 77df0f5..1073f2f 100644
--- a/sandboxed_api/transaction.cc
+++ b/sandboxed_api/transaction.cc
@@ -14,6 +14,12 @@
 
 #include "sandboxed_api/transaction.h"
 
+#include <functional>
+#include <memory>
+
+#include "absl/log/log.h"
+#include "absl/status/status.h"
+#include "absl/time/time.h"
 #include "sandboxed_api/util/status_macros.h"
 
 namespace sapi {
diff --git a/sandboxed_api/transaction.h b/sandboxed_api/transaction.h
index bff3751..2270ff5 100644
--- a/sandboxed_api/transaction.h
+++ b/sandboxed_api/transaction.h
@@ -15,8 +15,13 @@
 #ifndef SANDBOXED_API_TRANSACTION_H_
 #define SANDBOXED_API_TRANSACTION_H_
 
+#include <ctime>
+#include <functional>
 #include <memory>
+#include <utility>
 
+#include "absl/base/attributes.h"
+#include "absl/log/check.h"
 #include "absl/log/log.h"
 #include "absl/status/status.h"
 #include "absl/strings/str_cat.h"
diff --git a/sandboxed_api/util/BUILD.bazel b/sandboxed_api/util/BUILD.bazel
index 6ee8f8c..9dac419 100644
--- a/sandboxed_api/util/BUILD.bazel
+++ b/sandboxed_api/util/BUILD.bazel
@@ -64,8 +64,7 @@ cc_test(
     copts = sapi_platform_copts(),
     deps = [
         ":file_helpers",
-        "//sandboxed_api/util:status_matchers",
-        "@com_google_absl//absl/strings",
+        ":status_matchers",
         "@com_google_googletest//:gtest_main",
     ],
 )
@@ -90,8 +89,8 @@ cc_test(
     deps = [
         ":file_helpers",
         ":fileops",
+        ":status_matchers",
         "//sandboxed_api:testing",
-        "//sandboxed_api/util:status_matchers",
         "@com_google_absl//absl/strings",
         "@com_google_googletest//:gtest_main",
     ],
@@ -149,6 +148,7 @@ cc_library(
         "@com_google_absl//absl/base:core_headers",
         "@com_google_absl//absl/status",
         "@com_google_absl//absl/strings",
+        "@com_google_absl//absl/strings:cord",
     ],
 )
 
@@ -164,6 +164,7 @@ cc_library(
         ":status",
         "@com_google_absl//absl/status",
         "@com_google_absl//absl/status:statusor",
+        "@com_google_absl//absl/strings:string_view",
         "@com_google_absl//absl/types:optional",
         "@com_google_googletest//:gtest",
     ],
@@ -176,8 +177,8 @@ cc_test(
     copts = sapi_platform_copts(),
     deps = [
         ":status",
-        ":status_matchers",
         "@com_google_absl//absl/status",
+        "@com_google_absl//absl/strings:string_view",
         "@com_google_googletest//:gtest_main",
     ],
 )
@@ -227,7 +228,6 @@ cc_library(
     hdrs = ["temp_file.h"],
     copts = sapi_platform_copts(),
     deps = [
-        ":fileops",
         ":status",
         "@com_google_absl//absl/status",
         "@com_google_absl//absl/status:statusor",
@@ -242,9 +242,11 @@ cc_test(
     deps = [
         ":file_base",
         ":fileops",
+        ":status_matchers",
         ":temp_file",
         "//sandboxed_api:testing",
-        "//sandboxed_api/util:status_matchers",
+        "@com_google_absl//absl/status",
+        "@com_google_absl//absl/status:statusor",
         "@com_google_googletest//:gtest_main",
     ],
 )
diff --git a/sandboxed_api/util/CMakeLists.txt b/sandboxed_api/util/CMakeLists.txt
index df8172d..ae91c16 100644
--- a/sandboxed_api/util/CMakeLists.txt
+++ b/sandboxed_api/util/CMakeLists.txt
@@ -98,7 +98,8 @@ add_library(sapi_util_status ${SAPI_LIB_TYPE}
 )
 add_library(sapi::status ALIAS sapi_util_status)
 target_link_libraries(sapi_util_status
-  PRIVATE absl::core_headers
+  PRIVATE absl::cord
+          absl::core_headers
           absl::status
           absl::strings
           sapi::base
@@ -126,7 +127,6 @@ add_library(sapi_util_temp_file ${SAPI_LIB_TYPE}
 add_library(sapi::temp_file ALIAS sapi_util_temp_file)
 target_link_libraries(sapi_util_temp_file
   PRIVATE absl::strings
-          sapi::fileops
           sapi::status
           sapi::strerror
           sapi::base
@@ -157,7 +157,6 @@ if(BUILD_TESTING AND SAPI_BUILD_TESTING)
     OUTPUT_NAME file_helpers_test
   )
   target_link_libraries(sapi_file_helpers_test PRIVATE
-    absl::strings
     sapi::file_helpers
     sapi::status_matchers
     sapi::test_main
@@ -190,11 +189,12 @@ if(BUILD_TESTING AND SAPI_BUILD_TESTING)
   )
   add_library(sapi::status_matchers ALIAS sapi_util_status_matchers)
   target_link_libraries(sapi_util_status_matchers
-    PRIVATE absl::optional
-            gmock
-            gtest
-            sapi::base
-    PUBLIC absl::status
+    PUBLIC absl::optional
+           absl::status
+           absl::strings
+           gmock
+           gtest
+           sapi::base
            sapi::status
   )
 
@@ -205,7 +205,7 @@ if(BUILD_TESTING AND SAPI_BUILD_TESTING)
   set_target_properties(sapi_status_test PROPERTIES OUTPUT_NAME status_test)
   target_link_libraries(sapi_status_test PRIVATE
     absl::status
-    absl::type_traits
+    absl::statusor
     sapi::status
     sapi::status_matchers
     sapi::test_main
diff --git a/sandboxed_api/util/file_helpers.cc b/sandboxed_api/util/file_helpers.cc
index 1bf3432..df1af4d 100644
--- a/sandboxed_api/util/file_helpers.cc
+++ b/sandboxed_api/util/file_helpers.cc
@@ -16,9 +16,11 @@
 
 #include <fstream>
 #include <sstream>
+#include <string>
 
 #include "absl/status/status.h"
 #include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
 
 namespace sapi::file {
 
diff --git a/sandboxed_api/util/fileops.cc b/sandboxed_api/util/fileops.cc
index e5eb271..cc5f525 100644
--- a/sandboxed_api/util/fileops.cc
+++ b/sandboxed_api/util/fileops.cc
@@ -19,10 +19,16 @@
 #include <sys/stat.h>  // stat64
 #include <unistd.h>
 
+#include <cerrno>
+#include <cstdlib>
 #include <fstream>
 #include <memory>
+#include <string>
+#include <utility>
+#include <vector>
 
 #include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
 #include "absl/strings/strip.h"
 #include "sandboxed_api/util/strerror.h"
 
diff --git a/sandboxed_api/util/fileops.h b/sandboxed_api/util/fileops.h
index b2fb28f..f1c0a88 100644
--- a/sandboxed_api/util/fileops.h
+++ b/sandboxed_api/util/fileops.h
@@ -15,6 +15,7 @@
 #ifndef SANDBOXED_API_UTIL_FILEOPS_H_
 #define SANDBOXED_API_UTIL_FILEOPS_H_
 
+#include <cstddef>
 #include <string>
 #include <utility>
 #include <vector>
diff --git a/sandboxed_api/util/fileops_test.cc b/sandboxed_api/util/fileops_test.cc
index fd9f89a..6d9cc94 100644
--- a/sandboxed_api/util/fileops_test.cc
+++ b/sandboxed_api/util/fileops_test.cc
@@ -14,24 +14,18 @@
 
 #include "sandboxed_api/util/fileops.h"
 
-#include <dirent.h>
-#include <fcntl.h>
-#include <sys/socket.h>
 #include <sys/stat.h>
-#include <sys/types.h>
-#include <sys/un.h>
 #include <unistd.h>
 
-#include <cstdio>
-#include <memory>
+#include <algorithm>
+#include <cerrno>
+#include <climits>
 #include <string>
-#include <utility>
 #include <vector>
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
 #include "absl/strings/str_cat.h"
-#include "absl/strings/string_view.h"
 #include "sandboxed_api/testing.h"
 #include "sandboxed_api/util/file_helpers.h"
 #include "sandboxed_api/util/status_matchers.h"
diff --git a/sandboxed_api/util/path.cc b/sandboxed_api/util/path.cc
index 912c4ae..f753c64 100644
--- a/sandboxed_api/util/path.cc
+++ b/sandboxed_api/util/path.cc
@@ -15,11 +15,15 @@
 #include "sandboxed_api/util/path.h"
 
 #include <deque>
+#include <initializer_list>
+#include <string>
+#include <utility>
 
 #include "absl/strings/match.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_join.h"
 #include "absl/strings/str_split.h"
+#include "absl/strings/string_view.h"
 #include "absl/strings/strip.h"
 
 namespace sapi::file {
diff --git a/sandboxed_api/util/path_test.cc b/sandboxed_api/util/path_test.cc
index fd4b785..b33dce0 100644
--- a/sandboxed_api/util/path_test.cc
+++ b/sandboxed_api/util/path_test.cc
@@ -14,8 +14,11 @@
 
 #include "sandboxed_api/util/path.h"
 
+#include <string>
+
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
+#include "absl/strings/string_view.h"
 
 namespace sandbox2 {
 namespace {
diff --git a/sandboxed_api/util/raw_logging.cc b/sandboxed_api/util/raw_logging.cc
index dd10a07..ce0ab77 100644
--- a/sandboxed_api/util/raw_logging.cc
+++ b/sandboxed_api/util/raw_logging.cc
@@ -14,22 +14,18 @@
 
 #include "sandboxed_api/util/raw_logging.h"
 
-#include <sys/syscall.h>
+#include <syscall.h>
 #include <unistd.h>
 
 #include <cstdarg>
-#include <cstddef>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
 #include <limits>
 
 #include "absl/base/attributes.h"
-#include "absl/base/config.h"
 #include "absl/base/log_severity.h"
 #include "absl/strings/numbers.h"
-#include "absl/strings/str_cat.h"
-#include "absl/strings/str_format.h"
 
 #ifdef __ANDROID__
 #include "android/log.h"
diff --git a/sandboxed_api/util/raw_logging.h b/sandboxed_api/util/raw_logging.h
index f4bd280..27d864e 100644
--- a/sandboxed_api/util/raw_logging.h
+++ b/sandboxed_api/util/raw_logging.h
@@ -17,6 +17,8 @@
 #ifndef SANDBOXED_API_UTIL_RAW_LOGGING_H_
 #define SANDBOXED_API_UTIL_RAW_LOGGING_H_
 
+#include <cerrno>
+#include <cstddef>
 #include <string>
 #include <utility>
 
diff --git a/sandboxed_api/util/status.cc b/sandboxed_api/util/status.cc
index df93823..c9459f6 100644
--- a/sandboxed_api/util/status.cc
+++ b/sandboxed_api/util/status.cc
@@ -14,7 +14,12 @@
 
 #include "sandboxed_api/util/status.h"
 
+#include <string>
+#include <utility>
+
 #include "absl/status/status.h"
+#include "absl/strings/cord.h"
+#include "absl/strings/string_view.h"
 
 namespace sapi {
 
diff --git a/sandboxed_api/util/status_macros.h b/sandboxed_api/util/status_macros.h
index 4fd0da0..e6f1d9e 100644
--- a/sandboxed_api/util/status_macros.h
+++ b/sandboxed_api/util/status_macros.h
@@ -18,6 +18,8 @@
 #ifndef THIRD_PARTY_SAPI_UTIL_STATUS_MACROS_H_
 #define THIRD_PARTY_SAPI_UTIL_STATUS_MACROS_H_
 
+#include <utility>
+
 #include "absl/base/optimization.h"
 #include "absl/status/status.h"
 
diff --git a/sandboxed_api/util/status_macros_test.cc b/sandboxed_api/util/status_macros_test.cc
index daa253e..2a56492 100644
--- a/sandboxed_api/util/status_macros_test.cc
+++ b/sandboxed_api/util/status_macros_test.cc
@@ -22,6 +22,7 @@
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
 #include "sandboxed_api/util/status.h"
 #include "sandboxed_api/util/status_matchers.h"
 
diff --git a/sandboxed_api/util/status_matchers.h b/sandboxed_api/util/status_matchers.h
index 1b6c7b6..ba9415e 100644
--- a/sandboxed_api/util/status_matchers.h
+++ b/sandboxed_api/util/status_matchers.h
@@ -15,11 +15,16 @@
 #ifndef SANDBOXED_API_UTIL_STATUS_MATCHERS_H_
 #define SANDBOXED_API_UTIL_STATUS_MATCHERS_H_
 
+#include <ostream>
+#include <string>
 #include <type_traits>
+#include <utility>
 
 #include "gmock/gmock.h"
+#include "gtest/gtest.h"
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
 #include "sandboxed_api/util/status_macros.h"
 
diff --git a/sandboxed_api/util/status_test.cc b/sandboxed_api/util/status_test.cc
index 1d633f8..830c680 100644
--- a/sandboxed_api/util/status_test.cc
+++ b/sandboxed_api/util/status_test.cc
@@ -12,13 +12,15 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#include "absl/status/status.h"
+#include "sandboxed_api/util/status.h"
 
+#include <cstdint>
 #include <string>
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
-#include "sandboxed_api/util/status.h"
+#include "absl/status/status.h"
+#include "absl/strings/string_view.h"
 
 using ::testing::Eq;
 using ::testing::StrEq;
diff --git a/sandboxed_api/util/strerror.cc b/sandboxed_api/util/strerror.cc
index 3ae46c6..d8e2686 100644
--- a/sandboxed_api/util/strerror.cc
+++ b/sandboxed_api/util/strerror.cc
@@ -18,6 +18,7 @@
 
 #include <cerrno>
 #include <cstddef>
+#include <string>
 
 #include "absl/base/attributes.h"
 #include "absl/strings/str_format.h"
diff --git a/sandboxed_api/util/strerror.h b/sandboxed_api/util/strerror.h
index 01388a6..66c5936 100644
--- a/sandboxed_api/util/strerror.h
+++ b/sandboxed_api/util/strerror.h
@@ -15,6 +15,7 @@
 #ifndef SANDBOXED_API_UTIL_STRERROR_H_
 #define SANDBOXED_API_UTIL_STRERROR_H_
 
+#include <cstddef>
 #include <string>
 
 namespace sapi {
diff --git a/sandboxed_api/util/strerror_test.cc b/sandboxed_api/util/strerror_test.cc
index ed81aae..36b16a3 100644
--- a/sandboxed_api/util/strerror_test.cc
+++ b/sandboxed_api/util/strerror_test.cc
@@ -16,6 +16,7 @@
 
 #include <atomic>
 #include <cerrno>
+#include <cstring>
 #include <string>
 #include <thread>  // NOLINT(build/c++11)
 #include <vector>
diff --git a/sandboxed_api/util/temp_file.cc b/sandboxed_api/util/temp_file.cc
index 529f4dc..3915fbe 100644
--- a/sandboxed_api/util/temp_file.cc
+++ b/sandboxed_api/util/temp_file.cc
@@ -14,18 +14,16 @@
 
 #include "sandboxed_api/util/temp_file.h"
 
-#include <fcntl.h>
-#include <sys/stat.h>
-#include <sys/types.h>
 #include <unistd.h>
 
-#include <cstdlib>
-#include <vector>
+#include <cerrno>
+#include <string>
+#include <utility>
 
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/str_cat.h"
-#include "sandboxed_api/util/fileops.h"
+#include "absl/strings/string_view.h"
 #include "sandboxed_api/util/status_macros.h"
 
 namespace sapi {
diff --git a/sandboxed_api/util/temp_file.h b/sandboxed_api/util/temp_file.h
index b9c5a41..e9ddffc 100644
--- a/sandboxed_api/util/temp_file.h
+++ b/sandboxed_api/util/temp_file.h
@@ -16,8 +16,10 @@
 #define SANDBOXED_API_UTIL_TEMP_FILE_H_
 
 #include <string>
+#include <utility>
 
 #include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
 
 namespace sapi {
 
diff --git a/sandboxed_api/util/temp_file_test.cc b/sandboxed_api/util/temp_file_test.cc
index 426e9bb..e5ba416 100644
--- a/sandboxed_api/util/temp_file_test.cc
+++ b/sandboxed_api/util/temp_file_test.cc
@@ -17,8 +17,13 @@
 #include <fcntl.h>
 #include <unistd.h>
 
+#include <string>
+#include <utility>
+
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
 #include "sandboxed_api/testing.h"
 #include "sandboxed_api/util/fileops.h"
 #include "sandboxed_api/util/path.h"
diff --git a/sandboxed_api/var_abstract.cc b/sandboxed_api/var_abstract.cc
index 82308b4..2027d66 100644
--- a/sandboxed_api/var_abstract.cc
+++ b/sandboxed_api/var_abstract.cc
@@ -16,11 +16,14 @@
 
 #include "sandboxed_api/var_abstract.h"
 
+#include <sys/types.h>
 #include <sys/uio.h>
 
 #include <memory>
+#include <string>
 
 #include "absl/log/log.h"
+#include "absl/status/status.h"
 #include "absl/strings/str_cat.h"
 #include "sandboxed_api/rpcchannel.h"
 #include "sandboxed_api/util/raw_logging.h"
diff --git a/sandboxed_api/var_abstract.h b/sandboxed_api/var_abstract.h
index 526d01f..599ee7c 100644
--- a/sandboxed_api/var_abstract.h
+++ b/sandboxed_api/var_abstract.h
@@ -15,6 +15,7 @@
 #ifndef SANDBOXED_API_VAR_ABSTRACT_H_
 #define SANDBOXED_API_VAR_ABSTRACT_H_
 
+#include <ctime>
 #include <memory>
 #include <string>
 #include <type_traits>
@@ -29,8 +30,8 @@ class Comms;
 }  // namespace sandbox2
 
 namespace sapi {
-class Sandbox;
 class RPCChannel;
+class Sandbox;
 }  // namespace sapi
 
 namespace sapi::v {
diff --git a/sandboxed_api/var_array.h b/sandboxed_api/var_array.h
index 71657e2..f84f01a 100644
--- a/sandboxed_api/var_array.h
+++ b/sandboxed_api/var_array.h
@@ -16,8 +16,11 @@
 #define SANDBOXED_API_VAR_ARRAY_H_
 
 #include <algorithm>
+#include <cstdlib>
 #include <cstring>
 #include <memory>
+#include <string>
+#include <type_traits>
 
 #include "absl/base/macros.h"
 #include "absl/log/check.h"
diff --git a/sandboxed_api/var_int.cc b/sandboxed_api/var_int.cc
index d2859d5..a718da3 100644
--- a/sandboxed_api/var_int.cc
+++ b/sandboxed_api/var_int.cc
@@ -14,7 +14,10 @@
 
 #include "sandboxed_api/var_int.h"
 
+#include <unistd.h>
+
 #include "absl/log/log.h"
+#include "absl/status/status.h"
 #include "sandboxed_api/rpcchannel.h"
 #include "sandboxed_api/util/status_macros.h"
 
diff --git a/sandboxed_api/var_int.h b/sandboxed_api/var_int.h
index 3fe3315..ea6370f 100644
--- a/sandboxed_api/var_int.h
+++ b/sandboxed_api/var_int.h
@@ -15,12 +15,20 @@
 #ifndef SANDBOXED_API_VAR_INT_H_
 #define SANDBOXED_API_VAR_INT_H_
 
+#include <sys/types.h>
+
+#include <cstdint>
 #include <memory>
 
+#include "absl/status/status.h"
 #include "sandboxed_api/sandbox2/comms.h"
 #include "sandboxed_api/var_ptr.h"
 #include "sandboxed_api/var_reg.h"
 
+namespace sapi {
+class RPCChannel;
+}  // namespace sapi
+
 namespace sapi::v {
 
 // Intermediate class for register sized variables so we don't have to implement
diff --git a/sandboxed_api/var_lenval.cc b/sandboxed_api/var_lenval.cc
index ab99700..b75d51f 100644
--- a/sandboxed_api/var_lenval.cc
+++ b/sandboxed_api/var_lenval.cc
@@ -14,9 +14,11 @@
 
 #include "sandboxed_api/var_lenval.h"
 
-#include <sys/uio.h>
+#include <sys/types.h>
 
-#include "absl/log/log.h"
+#include <cstddef>
+
+#include "absl/status/status.h"
 #include "sandboxed_api/rpcchannel.h"
 #include "sandboxed_api/util/status_macros.h"
 
diff --git a/sandboxed_api/var_lenval.h b/sandboxed_api/var_lenval.h
index 3326534..53d1a8f 100644
--- a/sandboxed_api/var_lenval.h
+++ b/sandboxed_api/var_lenval.h
@@ -15,11 +15,16 @@
 #ifndef SANDBOXED_API_VAR_LENVAL_H_
 #define SANDBOXED_API_VAR_LENVAL_H_
 
+#include <sys/types.h>
 #include <sys/uio.h>
 
+#include <cstring>
 #include <memory>
+#include <string>
+#include <vector>
 
 #include "absl/base/macros.h"
+#include "absl/status/status.h"
 #include "sandboxed_api/lenval_core.h"
 #include "sandboxed_api/var_abstract.h"
 #include "sandboxed_api/var_array.h"
diff --git a/sandboxed_api/var_proto.h b/sandboxed_api/var_proto.h
index e141c32..2f1d8aa 100644
--- a/sandboxed_api/var_proto.h
+++ b/sandboxed_api/var_proto.h
@@ -19,10 +19,17 @@
 
 #include <cinttypes>
 #include <cstdint>
+#include <ctime>
 #include <memory>
+#include <string>
+#include <type_traits>
+#include <utility>
 #include <vector>
 
+#include "absl/base/attributes.h"
 #include "absl/base/macros.h"
+#include "absl/log/log.h"
+#include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/utility/utility.h"
 #include "sandboxed_api/proto_helper.h"
diff --git a/sandboxed_api/var_ptr.h b/sandboxed_api/var_ptr.h
index 1fa2928..ad2568c 100644
--- a/sandboxed_api/var_ptr.h
+++ b/sandboxed_api/var_ptr.h
@@ -15,7 +15,10 @@
 #ifndef SANDBOXED_API_VAR_PTR_H_
 #define SANDBOXED_API_VAR_PTR_H_
 
+#include <algorithm>
+#include <cstring>
 #include <memory>
+#include <string>
 
 #include "absl/base/macros.h"
 #include "absl/strings/str_format.h"
diff --git a/sandboxed_api/var_reg.h b/sandboxed_api/var_reg.h
index 63bd53c..eff6ee8 100644
--- a/sandboxed_api/var_reg.h
+++ b/sandboxed_api/var_reg.h
@@ -15,6 +15,8 @@
 #ifndef SANDBOXED_API_VAR_REG_H_
 #define SANDBOXED_API_VAR_REG_H_
 
+#include <algorithm>
+#include <cstring>
 #include <iostream>
 #include <string>
 #include <type_traits>
diff --git a/sandboxed_api/var_struct.h b/sandboxed_api/var_struct.h
index 931af8e..ec55006 100644
--- a/sandboxed_api/var_struct.h
+++ b/sandboxed_api/var_struct.h
@@ -15,7 +15,10 @@
 #ifndef SANDBOXED_API_VAR_STRUCT_H_
 #define SANDBOXED_API_VAR_STRUCT_H_
 
+#include <cstddef>
 #include <memory>
+#include <string>
+#include <utility>
 
 #include "absl/base/macros.h"
 #include "absl/strings/str_cat.h"
diff --git a/sandboxed_api/var_void.h b/sandboxed_api/var_void.h
index fe9c371..5c65b18 100644
--- a/sandboxed_api/var_void.h
+++ b/sandboxed_api/var_void.h
@@ -15,7 +15,9 @@
 #ifndef SANDBOXED_API_VAR_VOID_H_
 #define SANDBOXED_API_VAR_VOID_H_
 
+#include <cstddef>
 #include <memory>
+#include <string>
 
 #include "sandboxed_api/var_ptr.h"
 #include "sandboxed_api/var_reg.h"