diff --git a/crates/containerd-shim-wasm/src/container/mod.rs b/crates/containerd-shim-wasm/src/container/mod.rs
index 199e043a1..51bd6d093 100644
--- a/crates/containerd-shim-wasm/src/container/mod.rs
+++ b/crates/containerd-shim-wasm/src/container/mod.rs
@@ -21,3 +21,6 @@ pub use path::PathResolve;
 
 pub use crate::sandbox::stdio::Stdio;
 use crate::sys::container::instance;
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/containerd-shim-wasm/src/container/tests.rs b/crates/containerd-shim-wasm/src/container/tests.rs
new file mode 100644
index 000000000..bbf83869b
--- /dev/null
+++ b/crates/containerd-shim-wasm/src/container/tests.rs
@@ -0,0 +1,38 @@
+use anyhow::bail;
+
+use crate::container::{Engine, RuntimeContext, Stdio};
+use crate::sys::container::instance::Instance;
+use crate::testing::WasiTest;
+
+#[derive(Clone, Default)]
+struct EngineFailingValidation;
+
+impl Engine for EngineFailingValidation {
+    fn name() -> &'static str {
+        "wasi_instance"
+    }
+    fn can_handle(&self, _ctx: &impl RuntimeContext) -> anyhow::Result<()> {
+        bail!("can't handle");
+    }
+    fn run_wasi(&self, _ctx: &impl RuntimeContext, _stdio: Stdio) -> anyhow::Result<i32> {
+        Ok(0)
+    }
+}
+
+type InstanceFailingValidation = Instance<EngineFailingValidation>;
+
+#[test]
+#[cfg(unix)] // not yet implemented on Windows
+fn test_validation_error() -> anyhow::Result<()> {
+    // A validation error should fail when creating the container
+    // as opposed to failing when starting it.
+
+    let result = WasiTest::<InstanceFailingValidation>::builder()?
+        .with_start_fn("foo")?
+        .with_wasm("/invalid_entrypoint.wasm")?
+        .build();
+
+    assert!(result.is_err());
+
+    Ok(())
+}