Disable the default KEYRING:persistent:%{uid} name.

Addressing
Invalid UID in persistent keyring name while getting default ccache
Move the whole /var/lib/sss/pubconf do volume, to include /var/lib/sss/pubconf/kdcinfo.EXAMPLE.TEST.
Moving the RUNNING_DIR to /run, to avoid polluting /etc.
Bring back start of sshd.service.

It was lost by mistake in f041de9089223c65ee8f6f39c286dafe00833545.
Wait for named to get to talk to dirsrv.
Store /etc/rndc.key on the volume.
Fix support for Unit.Wants, add Unit.Requires.
Some pid files (like /var/run/messagebus.pid) do not seem to be covered by tmpfiles.d.