Testing a Sandbox on Real VMs in CI

A sandbox that doesn’t get tested against the thing it’s defending against isn’t a sandbox. It’s a wish. Canister relies on Linux kernel features – user namespaces, seccomp BPF, mount isolation – and on Mandatory Access Control systems like SELinux and AppArmor. These are not things you can meaningfully test in a container. Containers share the host kernel. They don’t run their own SELinux policy…