In reply to @baloo_:matrix.org
That's not a terrible idea. No clue how to lookup the peer from the daemon but I can look into that

In reply to @baloo_:matrix.org
could be a challenge response with the daemon too

Don’t know if pid is the way, maybe uid, they should be translated when they cross the namespace.

Depends on the story of the Liz sandbox and whether there is uid reuse.

I figured it out: it's actually not related to pasta, but just the sandbox. It's preventing glibc's getaddrinfo from connecting to the nscd service, so it falls back to using its internal nss system, which parses /etc/resolv.conf manually and just ignores ndots, assuming a high value I guess. It's only an issue since curl 8.20.0 landed in nixpkgs, specifically since they added a 50 ms delay to Happy Eyeballs, which I guess now gives a chance to the searched "github.com.frogeye.fr" to be resolved.

So not a Lix issue, probably not a curl issue (it just makes more connections try to use IPv6 where they wouldn't before, which is a good thing), maybe a glibc issue (why nss ignores ndots while in the same codebase nscd uses it is beyond me), and there's also something about NixOS's networking.domain documentation lying about not configuring itself for DNS resolution purposes. I don't really know where to report/document this so I'll just put it here. For me I just disabled the search option entierely with networking.resolvconf.extraConfig = ''nosearch_keys='static' '';