Add clang-format to sanity
diff --git a/include/grpc++/impl/call.h b/include/grpc++/impl/call.h
index fca5603..4602c9c 100644
--- a/include/grpc++/impl/call.h
+++ b/include/grpc++/impl/call.h
@@ -248,8 +248,7 @@
       if (*status) {
         got_message = true;
         *status = SerializationTraits<R>::Deserialize(recv_buf_, message_,
-                                                      max_message_size)
-                      .ok();
+                                                      max_message_size).ok();
       } else {
         got_message = false;
         grpc_byte_buffer_destroy(recv_buf_);
diff --git a/include/grpc++/security/auth_metadata_processor.h b/include/grpc++/security/auth_metadata_processor.h
index 9b9c06e..25011f3 100644
--- a/include/grpc++/security/auth_metadata_processor.h
+++ b/include/grpc++/security/auth_metadata_processor.h
@@ -71,4 +71,3 @@
 }  // namespace grpc
 
 #endif  // GRPCXX_AUTH_METADATA_PROCESSOR_H_
-
diff --git a/include/grpc++/server.h b/include/grpc++/server.h
index 210fe02..1a62df5 100644
--- a/include/grpc++/server.h
+++ b/include/grpc++/server.h
@@ -215,11 +215,10 @@
     bool FinalizeResult(void** tag, bool* status) GRPC_OVERRIDE {
       bool serialization_status =
           *status && payload_ &&
-          SerializationTraits<Message>::Deserialize(payload_, request_,
-                                                    server_->max_message_size_)
-              .ok();
+          SerializationTraits<Message>::Deserialize(
+              payload_, request_, server_->max_message_size_).ok();
       bool ret = RegisteredAsyncRequest::FinalizeResult(tag, status);
-      *status = serialization_status && *status;
+      *status = serialization_status&&* status;
       return ret;
     }
 
diff --git a/include/grpc/census.h b/include/grpc/census.h
index 2f36665..d0bc904 100644
--- a/include/grpc/census.h
+++ b/include/grpc/census.h
@@ -424,8 +424,8 @@
     construction via census_define_view(). */
 typedef struct {
   const census_aggregation_ops *ops;
-  const void
-      *create_arg; /* Argument to be used for aggregation initialization. */
+  const void *
+      create_arg; /* Argument to be used for aggregation initialization. */
 } census_aggregation;
 
 /** A census view type. Opaque. */
diff --git a/include/grpc/compression.h b/include/grpc/compression.h
index 82e326f..30163be 100644
--- a/include/grpc/compression.h
+++ b/include/grpc/compression.h
@@ -95,7 +95,7 @@
 
 /** Mark \a algorithm as enabled in \a opts. */
 void grpc_compression_options_enable_algorithm(
-     grpc_compression_options *opts, grpc_compression_algorithm algorithm);
+    grpc_compression_options *opts, grpc_compression_algorithm algorithm);
 
 /** Mark \a algorithm as disabled in \a opts. */
 void grpc_compression_options_disable_algorithm(
diff --git a/include/grpc/grpc.h b/include/grpc/grpc.h
index 47f3df6..0c854a5 100644
--- a/include/grpc/grpc.h
+++ b/include/grpc/grpc.h
@@ -595,8 +595,8 @@
 void grpc_call_destroy(grpc_call *call);
 
 /** Request notification of a new call.
-    Once a call is received, a notification tagged with \a tag_new is added to 
-    \a cq_for_notification. \a call, \a details and \a request_metadata are 
+    Once a call is received, a notification tagged with \a tag_new is added to
+    \a cq_for_notification. \a call, \a details and \a request_metadata are
     updated with the appropriate call information. \a cq_bound_to_call is bound
     to \a call, and batch operation notifications for that call will be posted
     to \a cq_bound_to_call.
diff --git a/include/grpc/grpc_security.h b/include/grpc/grpc_security.h
index 44ced4f..7a442e2 100644
--- a/include/grpc/grpc_security.h
+++ b/include/grpc/grpc_security.h
@@ -123,8 +123,8 @@
 
 /* Creates an Oauth2 Access Token credentials with an access token that was
    aquired by an out of band mechanism. */
-grpc_credentials *grpc_access_token_credentials_create(
-    const char *access_token, void *reserved);
+grpc_credentials *grpc_access_token_credentials_create(const char *access_token,
+                                                       void *reserved);
 
 /* Creates an IAM credentials object for connecting to Google. */
 grpc_credentials *grpc_google_iam_credentials_create(
diff --git a/src/core/channel/channel_args.h b/src/core/channel/channel_args.h
index 1a6be91..480cc9a 100644
--- a/src/core/channel/channel_args.h
+++ b/src/core/channel/channel_args.h
@@ -75,9 +75,7 @@
  * modified to point to the returned instance (which may be different from the
  * input value of \a a). */
 grpc_channel_args *grpc_channel_args_compression_algorithm_set_state(
-    grpc_channel_args **a,
-    grpc_compression_algorithm algorithm,
-    int enabled);
+    grpc_channel_args **a, grpc_compression_algorithm algorithm, int enabled);
 
 /** Returns the bitset representing the support state (true for enabled, false
  * for disabled) for compression algorithms.
diff --git a/src/core/client_config/lb_policies/round_robin.h b/src/core/client_config/lb_policies/round_robin.h
index 2c81b9e..cf1f69c 100644
--- a/src/core/client_config/lb_policies/round_robin.h
+++ b/src/core/client_config/lb_policies/round_robin.h
@@ -43,5 +43,4 @@
 /** Returns a load balancing factory for the round robin policy */
 grpc_lb_policy_factory *grpc_round_robin_lb_factory_create();
 
-
 #endif
diff --git a/src/core/client_config/subchannel.h b/src/core/client_config/subchannel.h
index 2e36c69..a269599 100644
--- a/src/core/client_config/subchannel.h
+++ b/src/core/client_config/subchannel.h
@@ -62,14 +62,14 @@
 #define GRPC_SUBCHANNEL_REF_EXTRA_ARGS
 #endif
 
-void grpc_subchannel_ref(
-    grpc_subchannel *channel GRPC_SUBCHANNEL_REF_EXTRA_ARGS);
-void grpc_subchannel_unref(
-    grpc_subchannel *channel GRPC_SUBCHANNEL_REF_EXTRA_ARGS);
-void grpc_subchannel_call_ref(
-    grpc_subchannel_call *call GRPC_SUBCHANNEL_REF_EXTRA_ARGS);
-void grpc_subchannel_call_unref(
-    grpc_subchannel_call *call GRPC_SUBCHANNEL_REF_EXTRA_ARGS);
+void grpc_subchannel_ref(grpc_subchannel *channel
+                             GRPC_SUBCHANNEL_REF_EXTRA_ARGS);
+void grpc_subchannel_unref(grpc_subchannel *channel
+                               GRPC_SUBCHANNEL_REF_EXTRA_ARGS);
+void grpc_subchannel_call_ref(grpc_subchannel_call *call
+                                  GRPC_SUBCHANNEL_REF_EXTRA_ARGS);
+void grpc_subchannel_call_unref(grpc_subchannel_call *call
+                                    GRPC_SUBCHANNEL_REF_EXTRA_ARGS);
 
 /** construct a call (possibly asynchronously) */
 void grpc_subchannel_create_call(grpc_subchannel *subchannel,
diff --git a/src/core/security/credentials.h b/src/core/security/credentials.h
index 38ce0f8..6c6be56 100644
--- a/src/core/security/credentials.h
+++ b/src/core/security/credentials.h
@@ -216,7 +216,6 @@
       grpc_server_credentials *c, grpc_security_connector **sc);
 } grpc_server_credentials_vtable;
 
-
 /* TODO(jboeuf): Add a refcount. */
 struct grpc_server_credentials {
   const grpc_server_credentials_vtable *vtable;
diff --git a/src/core/security/handshake.h b/src/core/security/handshake.h
index d7e4a30..7a7749c 100644
--- a/src/core/security/handshake.h
+++ b/src/core/security/handshake.h
@@ -37,7 +37,6 @@
 #include "src/core/iomgr/endpoint.h"
 #include "src/core/security/security_connector.h"
 
-
 /* Calls the callback upon completion. Takes owership of handshaker. */
 void grpc_do_security_handshake(tsi_handshaker *handshaker,
                                 grpc_security_connector *connector,
diff --git a/src/core/security/security_connector.h b/src/core/security/security_connector.h
index 5fc1db3..5eea77a 100644
--- a/src/core/security/security_connector.h
+++ b/src/core/security/security_connector.h
@@ -63,11 +63,11 @@
 typedef void (*grpc_security_check_cb)(void *user_data,
                                        grpc_security_status status);
 
-
 /* Ownership of the secure_endpoint is transfered. */
-typedef void (*grpc_security_handshake_done_cb)(
-    void *user_data, grpc_security_status status,
-    grpc_endpoint *wrapped_endpoint, grpc_endpoint *secure_endpoint);
+typedef void (*grpc_security_handshake_done_cb)(void *user_data,
+                                                grpc_security_status status,
+                                                grpc_endpoint *wrapped_endpoint,
+                                                grpc_endpoint *secure_endpoint);
 
 typedef struct {
   void (*destroy)(grpc_security_connector *sc);
diff --git a/src/core/support/time_precise.h b/src/core/support/time_precise.h
index 574ebb8..cd201fa 100644
--- a/src/core/support/time_precise.h
+++ b/src/core/support/time_precise.h
@@ -83,7 +83,7 @@
   clk->tv_nsec = counter % cycles_per_second;
 }
 
-#else /* GRPC_TIMERS_RDTSC */
+#else  /* GRPC_TIMERS_RDTSC */
 static void gpr_precise_clock_now(gpr_timespec *clk) {
   *clk = gpr_now(GPR_CLOCK_REALTIME);
   clk->clock_type = GPR_CLOCK_PRECISE;
diff --git a/src/cpp/server/secure_server_credentials.h b/src/cpp/server/secure_server_credentials.h
index 4f003c6..5460f4a 100644
--- a/src/cpp/server/secure_server_credentials.h
+++ b/src/cpp/server/secure_server_credentials.h
@@ -46,7 +46,7 @@
 
 class AuthMetadataProcessorAyncWrapper GRPC_FINAL {
  public:
-  static void Destroy(void *wrapper);
+  static void Destroy(void* wrapper);
 
   static void Process(void* wrapper, grpc_auth_context* context,
                       const grpc_metadata* md, size_t num_md,
diff --git a/test/cpp/interop/client_helper.h b/test/cpp/interop/client_helper.h
index 92d5078..0221df9 100644
--- a/test/cpp/interop/client_helper.h
+++ b/test/cpp/interop/client_helper.h
@@ -53,7 +53,7 @@
 class InteropClientContextInspector {
  public:
   InteropClientContextInspector(const ::grpc::ClientContext& context)
-    : context_(context) {}
+      : context_(context) {}
 
   // Inspector methods, able to peek inside ClientContext, follow.
   grpc_compression_algorithm GetCallCompressionAlgorithm() const {
diff --git a/tools/distrib/clang_format_code.sh b/tools/distrib/clang_format_code.sh
new file mode 100755
index 0000000..55f4c52
--- /dev/null
+++ b/tools/distrib/clang_format_code.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+set -ex
+
+# change to root directory
+cd $(dirname $0)/../..
+
+# build clang-format docker image
+docker build -t grpc_clang_format tools/dockerfile/grpc_clang_format
+
+# run clang-format against the checked out codebase
+docker run -e TEST=$TEST --rm=true -v `pwd`:/local-code -t grpc_clang_format /clang_format_all_the_things.sh
+
diff --git a/tools/dockerfile/grpc_clang_format/Dockerfile b/tools/dockerfile/grpc_clang_format/Dockerfile
new file mode 100644
index 0000000..a0fff2f
--- /dev/null
+++ b/tools/dockerfile/grpc_clang_format/Dockerfile
@@ -0,0 +1,6 @@
+FROM ubuntu:vivid
+RUN apt-get update
+RUN apt-get -y install clang-format-3.6
+ADD clang_format_all_the_things.sh /
+CMD ["echo 'Run with tools/distrib/clang_format_code.sh'"]
+
diff --git a/tools/dockerfile/grpc_clang_format/clang_format_all_the_things.sh b/tools/dockerfile/grpc_clang_format/clang_format_all_the_things.sh
new file mode 100755
index 0000000..5aa2658
--- /dev/null
+++ b/tools/dockerfile/grpc_clang_format/clang_format_all_the_things.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+# directories to run against
+DIRS="src/core src/cpp test/core test/cpp include"
+
+# file matching patterns to check
+GLOB="*.h *.cpp"
+
+# clang format command
+CLANG_FORMAT=clang-format-3.6
+
+files=
+for dir in $DIRS
+do
+  for glob in $GLOB
+  do
+    files="$files `find /local-code/$dir -name $glob`"
+  done
+done
+
+if [ "x$TEST" = "x" ]
+then
+  echo $files | xargs $CLANG_FORMAT -i
+else
+  for file in $files
+  do
+    $CLANG_FORMAT $file | diff $file -
+  done
+fi
+
diff --git a/tools/run_tests/run_sanity.sh b/tools/run_tests/run_sanity.sh
index 4b367dc..1e8fe5c 100755
--- a/tools/run_tests/run_sanity.sh
+++ b/tools/run_tests/run_sanity.sh
@@ -58,3 +58,5 @@
 fi
 
 ./tools/buildgen/generate_projects.sh
+./tools/distrib/clang_format_code.sh
+