+* machined: provide calls GetMachineByAddress() on the manager interface to get the machine for a local IP address, and GetAddress() on the Machine interface to get the Address for a machine. Implement via forking off child process which quickly joins the cotnainer and passes data to parent. Show this in "machinectl status", and use it to implement NSS module to provide automatic name resolution for containers.
+
+* add generator that pulls in systemd-network from containers when CAP_NET_ADMIN is set, more than the loopback device is defined, even when it is otherwise off
+
+* logind: avoid suspending on SW_LID if SW_DOCK is set
+
+* MessageQueueMessageSize= and RLimitFSIZE= (and suchlike) should use parse_iec_size().
+
+* man: move .link, .network and .netdev documentation into their own
+ man pages maybe called "systemd.link(5)", "systemd.network(5)" and
+ "systemd.netdev(5)" or so.
+
+* "busctl status" works only as root on dbus1, since we cannot read
+ /proc/$PID/exe
+
+* systemctl (and possibly related tools): support a new switch that
+ allows enumerating units in local containers recursively. "systemctl
+ list-units -R" or so should not only lists on the host, but also the
+ services in all containers in a pretty way, to give an overview of
+ the entire system. Also, maybe add "systemctl list-machines" which
+ works like "machinectl list" but includes information about the
+ health status of each registered machine. For that we should
+ probably implement something that encodes the system health status
+ in a single enum state, i.e. something like a system-wide state
+ starting → running → failed → stopping, that is based on the current
+ job queue and a check for failed services. Maybe then change
+ "systemctl status" without args to output this state along with a
+ selection of other data, such as the uptime or so.
+
+* Add a seccomp-based filter for socket() calls to limit services to
+ specific address families (for example: AF_UNIX), inspired by
+ Android's sandboxing
+
+* implement Distribute= in socket units to allow running multiple
+ service instances processing the listening socket, and open this up
+ for ReusePort=
+
+* add a timelimit to generator invocation
+
+* socket units: support creating sockets in different namespace,
+ opening it up for JoinsNamespaceOf=. This would require to fork off
+ a tiny process that joins the namespace and creates/binds the socket
+ and passes this back to PID1 via SCM_RIGHTS. This also could be used
+ to allow Chown/chgrp on sockets without requiring NSS in PID 1.
+
+* New service property: maximum CPU and wallclock runtime for a service
+