Can't setuid-program to a custom user

[Edouard Klein]

Dear Guix,

I am trying to install a program that requires its own user, and to
create a suid binary that will launch as this user, no matter who
launches it.

See lines 119 on of this file:
https://gitlab.com/edouardklein/guix/-/blob/6ae4c66bde1927aaae041311888c35105595a83e/beaver/packages/plan9.scm#L119

The creation of the account is successful, e.g. when I run a container
like so:
$(guix system container -e "(begin (use-modules (beaver system) (beaver
packages plan9)) (sucf minimal-container))")

I can check /etc/passwd and the user "suc" is in there.
I can launch guile, and type  (getpw "suc") and get in response:
"$1 = #("suc" "x" 1000 30001 "" "/home/suc"
"/gnu/store/d99ykvj3axzzidygsmdmzxah4lvxd6hw-bash-5.1.8/bin/bash")"

I can check that the directory /var/lib/suc exists and is owned by the
user:
ls -l /var/lib/
total 4
-rw------- 1 root root 512 Apr 11 14:46 random-seed
drwxr-xr-x 2 suc  suc   40 Apr 11 14:46 suc/

However, when I try to setuid the suc binary to user suc:
#+begin_src scheme
(setuid-programs
      (cons (setuid-program (program (file-append suc "/bin/suc"))
                            (user "suc"))
#+end_src

Then when I launch my container I get:
"ERROR: In procedure getpw:
In procedure getpw: entry not found"

Which is very astonishing given that the user exists !

Does the setuid binaries service try to do its stuff before the accounts
are created ?

Does anybody have the slightest idea of why the user is not found ?

BTW, it works if I setuid to root by removing the `(user "suc")`.

Thanks in advance,

Edouard.