The canary runs in front of the app, not inside it

You want ten percent of visitors to see the new checkout, without a feature-flag SDK in the bundle and without the app knowing it's in an experiment.

You register a proxy hook on the container's http service matching GET /checkout*. The hook is a script in your own exec. It hashes the client IP, forwards nine in ten requests to the running app at the pinned upstream, and sends the tenth to the container running the new branch. Both responses go back through the same hostname. The same hook adds the Content-Security-Policy header your static build never set.

When the numbers come in, you delete the hook. No redeploy, no flag cleanup PR, no SDK to rip out.

The experiment lives in the proxy layer, and your app never learns it was part of one.