Well this would get us a path to being able to run the daemon in the container as non-root. But that would require dealing with su which requires both setuid and pam, and certainly setuid is painful under nix.