diff --git a/.ci/Vagrantfile.fedora32 b/.ci/Vagrantfile.fedora33
similarity index 94%
rename from .ci/Vagrantfile.fedora32
rename to .ci/Vagrantfile.fedora33
index 68325f3a..169122e5 100644
--- a/.ci/Vagrantfile.fedora32
+++ b/.ci/Vagrantfile.fedora33
@@ -3,7 +3,7 @@
 
 Vagrant.configure("2") do |config|
 # Fedora box is used for testing cgroup v2 support
-  config.vm.box = "fedora/32-cloud-base"
+  config.vm.box = "fedora/33-cloud-base"
   config.vm.provider :virtualbox do |v|
     v.memory = 2048
     v.cpus = 2
diff --git a/.ci/install-vagrant.sh b/.ci/install-vagrant.sh
deleted file mode 100755
index f4aa05ae..00000000
--- a/.ci/install-vagrant.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/bin/bash
-set -eux -o pipefail
-VAGRANT_VERSION="2.2.10"
-
-# Based on code from https://github.com/opencontainers/runc
-DEB="vagrant_${VAGRANT_VERSION}_$(uname -m).deb"
-wget "https://releases.hashicorp.com/vagrant/${VAGRANT_VERSION}/$DEB"
-apt-get update
-apt-get install -q -y \
-	bridge-utils \
-	dnsmasq-base \
-	ebtables \
-	libvirt-bin \
-	libvirt-dev \
-	qemu-kvm \
-	qemu-utils \
-	ruby-dev \
-	./"$DEB"
-rm -f "$DEB"
-vagrant plugin install vagrant-libvirt
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 3c8196f0..2dc6daa9 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -4,20 +4,39 @@ jobs:
   test:
     strategy:
       matrix:
-        go-version: [1.14.x, 1.15.x]
-        platform: [ubuntu-latest, windows-latest]
+        go-version: [1.14.x, 1.15.x, 1.16.x]
+        platform: [ubuntu-20.04, windows-latest]
     runs-on: ${{ matrix.platform }}
     steps:
     - name: Install Go
-      uses: actions/setup-go@v1
+      uses: actions/setup-go@v2
       with:
         go-version: ${{ matrix.go-version }}
     - name: Checkout code
       uses: actions/checkout@v2
-    - name: Test
-      run: make test
     - name: Lint
       run: make lint
     - name: Cross build
       if: ${{ runner.os == 'Linux' }}
       run: make cross
+    - name: Test
+      run: make test
+
+  # some features, like openat2, require a newer kernel
+  fedora:
+    # nested virtualization is only available on macOS hosts
+    runs-on: macos-10.15
+    steps:
+      - uses: actions/checkout@v2
+      - name: prepare vagrant
+        run: |
+          ln -sf .ci/Vagrantfile.fedora33 Vagrantfile
+          # Retry if it fails (download.fedoraproject.org returns 404 sometimes)
+          vagrant up || vagrant up
+          vagrant ssh-config >> ~/.ssh/config
+
+      - name: system info
+        run: ssh default 'sh -exc "uname -a && df -T"'
+
+      - name: tests
+        run: ssh default 'cd /vagrant && make test'
diff --git a/.travis.yml b/.travis.yml
deleted file mode 100644
index bcf2819a..00000000
--- a/.travis.yml
+++ /dev/null
@@ -1,15 +0,0 @@
-dist: bionic
-os: linux
-language: minimal
-cache:
-  directories:
-  - /home/travis/.vagrant.d/boxes
-jobs:
-  include:
-    - name: "Fedora 32"
-      before_install:
-        - sudo .ci/install-vagrant.sh
-        - ln -sf .ci/Vagrantfile.fedora32 Vagrantfile
-        - sudo vagrant up && sudo mkdir -p /root/.ssh && sudo sh -c "vagrant ssh-config >> /root/.ssh/config"
-      script:
-        - sudo ssh default -t 'cd /vagrant && sudo make'
diff --git a/Makefile b/Makefile
index 50c4089d..3342a7b4 100644
--- a/Makefile
+++ b/Makefile
@@ -3,14 +3,16 @@ PACKAGES ?= mountinfo mount symlink
 BINDIR ?= _build/bin
 CROSS ?= linux/arm linux/arm64 linux/ppc64le linux/s390x \
 	freebsd/amd64 openbsd/amd64 darwin/amd64 darwin/arm64 windows/amd64
+SUDO ?= sudo -n
 
 .PHONY: all
 all: lint test cross
 
 .PHONY: test
+test: RUN_VIA_SUDO = $(shell $(SUDO) true && echo -exec \"$(SUDO)\")
 test:
 	for p in $(PACKAGES); do \
-		(cd $$p && go test -v .); \
+		(cd $$p && go test $(RUN_VIA_SUDO) -v .); \
 	done
 
 .PHONY: lint
diff --git a/mount/mounter_linux_test.go b/mount/mounter_linux_test.go
index 92f6a44c..323bc2eb 100644
--- a/mount/mounter_linux_test.go
+++ b/mount/mounter_linux_test.go
@@ -199,7 +199,9 @@ func validateMount(t *testing.T, mnt string, opts, optional, vfs string) {
 			if mi.VFSOptions != "" {
 				for _, opt := range strings.Split(mi.VFSOptions, ",") {
 					opt = clean(opt)
-					if !has(wantedVFS, opt) && opt != "seclabel" { // can be added by selinux
+					if !has(wantedVFS, opt) &&
+						opt != "seclabel" && // can be added by selinux
+						opt != "inode64" && opt != "inode32" { // can be added by kernel 5.9+
 						t.Errorf("unexpected vfs option %q, expected %q", opt, vfs)
 					}
 					delete(wantedVFS, opt)
diff --git a/mountinfo/mounted_linux_test.go b/mountinfo/mounted_linux_test.go
index 96b39b5b..d9f9a16c 100644
--- a/mountinfo/mounted_linux_test.go
+++ b/mountinfo/mounted_linux_test.go
@@ -174,10 +174,20 @@ func cleanupMounts(t *testing.T, dir string, mounts []string) {
 	}
 }
 
-func TestMountedBy(t *testing.T) {
+func requireOpenat2(t *testing.T) {
+	t.Helper()
 	if os.Getuid() != 0 {
 		t.Skip("requires root")
 	}
+	fd, err := unix.Openat2(unix.AT_FDCWD, ".", &unix.OpenHow{Flags: unix.O_RDONLY})
+	if err != nil {
+		t.Skipf("openat2: %v (old kernel? need Linux 5.6+)", err)
+	}
+	unix.Close(fd)
+}
+
+func TestMountedBy(t *testing.T) {
+	requireOpenat2(t)
 
 	dir, mounts, err := prepareMounts(t)
 	defer cleanupMounts(t, dir, mounts)
@@ -224,11 +234,7 @@ func TestMountedBy(t *testing.T) {
 }
 
 func TestMountedByOpenat2VsMountinfo(t *testing.T) {
-	fd, err := unix.Openat2(unix.AT_FDCWD, ".", &unix.OpenHow{Flags: unix.O_RDONLY})
-	if err != nil {
-		t.Skipf("openat2: %v (old kernel? need Linux 5.6+)", err)
-	}
-	unix.Close(fd)
+	requireOpenat2(t)
 
 	mounts, err := GetMounts(nil)
 	if err != nil {