systemd-nspawn requires a working ‘getent initgroups’ when run with the ‘-u’ switch. Replicating what fedora gives:
mv /usr/bin/getent /usr/bin/getent.orig
contents of /usr/bin/getent
#!/usr/bin/python3
import sys
import os
if sys.argv[1] != 'initgroups':
os.execv('/usr/bin/getent.orig', sys.argv)
with open('/etc/group') as fd:
lines = fd.readlines()
user = sys.argv[2]
boo = [x.split(':') for x in lines]
l = [x[2] for x in lines if user in x[3].split(',')]
if len(l) == 0:
print(user)
else:
print('{:22}{}'.format(user, ' '.join(l)))