TODO:
make the Makefile part newns-support-specific
make the main Makefile put tests-container in unsupported tests when newns is not supported.

Index: glibc-2.36/nss/tst-nss-test3.c
===================================================================
--- glibc-2.36.orig/nss/tst-nss-test3.c
+++ glibc-2.36/nss/tst-nss-test3.c
@@ -16,6 +16,7 @@
    License along with the GNU C Library; if not, see
    <https://www.gnu.org/licenses/>.  */
 
+#include <sched.h>
 #include <nss.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -107,11 +108,15 @@ do_test (void)
   int i;
   struct group *g = NULL;
 
+#ifndef CLONE_NEWNS
+  __nss_configure_lookup ("group", "test1");
+#else
 /* Previously we used __nss_configure_lookup to isolate the test
    from the host environment and to get it to lookup from our new
    test1 NSS service module, but now this test is run in a different
    root filesystem via the test-container support and we directly
    configure the use of the test1 NSS service.  */
+#endif
 
   setgrent ();
 
Index: glibc-2.36/nss/Makefile
===================================================================
--- glibc-2.36.orig/nss/Makefile
+++ glibc-2.36/nss/Makefile
@@ -72,7 +72,7 @@ tests := \
   tst-getaddrinfo5 \
   # xtests
 
-tests-container := \
+tests := \
   tst-initgroups1 \
   tst-initgroups2 \
   tst-nss-compat1 \