# What is wrong with a uid:gid chosen as the on-disk owner of a user-namespaced
# agent's data. Empty when it is fine.
{ lib }:
{
  owner,
  # Every uid and gid the host defines, from `users.users` and `users.groups`.
  uids,
  gids,
}:
lib.optional (
  owner < 30000
) "${toString owner} is in the range NixOS gives normal users and system users (below 30000)"
++
  lib.optional (owner >= 61184)
    "${toString owner} is in the range systemd allocates dynamic users from (61184 and above), or is `nobody`"
++ lib.optional (builtins.elem owner uids) "${toString owner} is the uid of a user the host defines"
++ lib.optional (builtins.elem owner gids) "${toString owner} is the gid of a group the host defines"