timesyncd: run timesyncd as unpriviliged user "systemd-timesync" (but still with CAP_SYS_TIME)
timesyncd: enable watchdog support
timesyncd: make use of floating event sources for signal handling
update TODO
network: always take possession of host side of nspawn veth tunnels and do IPv4LL on them
machined: add logic to query IP addresses of containers
update TODO