The bank's test appliance ships as a VM, and it boots inside your container

The bank's integration kit arrives as a virtual machine image: the simulator you certify against before they let you near the real rails. It runs nowhere in your stack. Your services live in containers on a rented VM, and a VM inside a VM is either unavailable there or unusably slow.

On Hoody the container sits on rented bare metal, so /dev/kvm is a real device. Stop the container, PUT /api/v1/containers/{id}/kvm with kvm: true, start it, install QEMU, boot the image. Your payment service talks to the appliance over loopback, inside the same container.

The device is granted per container, and copying a container strips it: a clone can't boot the appliance unless someone grants it again. The certification box has it. The forty staging clones don't.