Corda is full of SLF4J Logger objects, and so SLF4J needs to be able to initialise itself from with the DJVM sandbox. However, its attempts are failing with RuleViolationError.
The RuleViolationError is misleading. What is actually happening is that there are no StaticLoggerBinder classes on the classpath, but the DJVM’s SandboxClassLoadingException is being mangled as it tries to escape out of the sandbox. SLF4J is actually expecting to catch a NoClassDefFoundError linker exception when the JVM fails to satisfy the StaticLoggerBinder reference, but the DJVM is less forgiving and so aborts.
Fix this issue as follows:
Rethrow SandboxClassLoadingException instances before the DJVM mangles them.
Add org.slf4j:slf4j-nop to the list of sandbox inputs.
Stub out System.setSecurityManager() always to throw AccessControlException.