## /lib/passwd

In order to ship an OS that contains both system users and users dynamically created on client machines, you will need to choose a solution for `/etc/passwd`. The core problem is that if you add a user to the system for a daemon, the OSTree upgrade process for `/etc` will simply notice that because `/etc/passwd` differs from the previous default, it will keep the modified config file, and your new OS user will not be visible.

The solution chosen for the gnome-ostree operating system is to create `/lib/passwd`, and to include a NSS module nss-altfiles which instructs glibc to read from it. Then, the build system places all system users there, freeing up `/etc/passwd` to be purely a database of local users.