Consider the error building this simple library:

$ mkdir lib
$ touch WORKSPACE lib/header.h
$ echo '#include "header.h"' > lib/impl.c
$ cat BUILD
cc_library(
    name = 'mylib',
    hdrs = ["lib/header.h"],
    srcs = ["lib/impl.c"],
    strip_include_prefix = 'lib',
)
$ bazel build --spawn_strategy=standalone :mylib
ERROR: BUILD:2:1: undeclared inclusion(s) in rule '//:mylib':
this rule is missing dependency declarations for the following files included by 'lib/impl.c':
  'lib/header.h'.
Target //:mylib failed to build
Use --verbose_failures to see the command lines of failed build steps.

The problem seems to be that inclusion checking is expecting header.h to always be included as bazel-out/local-fastbuild/bin/_virtual_includes/mylib/header.h. That doesn't happen in this example because the quoted-include in impl.c ends up using the sibling header.h rather than the one in _virtual_includes. Indeed, we can fix this error by putting "lib/header.h" into the library's srcs. Interestingly, this example works in the sandbox because lib/header.h isn't placed in the sandbox, so the expected virtual header is included.

It's probably the case that libraries should be including their own exported headers with angle brackets rather than quotes. However, strip_include_prefix is mostly useful for third-party code, which can't be forced to follow any particular conventions.