The try's toolchain container has no bubblewrap; the checker runs the isolation tag on the build nodes, and merge-check.sh still vets it.