Why are there two root and nobody accounts according to "getent passwd"?

The output further down was retrieved by employing machinectl on a Ubuntu 20.04 host: * machinectl pull-tar https://cloud-images.ubuntu.com/focal/current/focal-server-cloudimg-amd64-root.tar.xz focal * machinectl start focal * systemd-run --machine focal --pty /bin/bash You should be able to reproduce this as long as the cloud image for "focal" is available. Here's the output:

root@ubuntu:/# getent passwd|grep -P '^(nobody|root):'
root:x:0:0:root:/root:/bin/bash
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
root:x:0:0:root:/root:/bin/sh
nobody:x:65534:65534:nobody:/:/usr/sbin/nologin
root@ubuntu:/# cat /etc/passwd|grep -P '^(nobody|root):'
root:x:0:0:root:/root:/bin/bash
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin

Curiously getent shadow doesn't show the same discrepancy:

root@ubuntu:/# getent shadow|grep -P '^(nobody|root):'
root:*:18697:0:99999:7:::
nobody:*:18697:0:99999:7:::
root@ubuntu:/# cat /etc/shadow|grep -P '^(nobody|root):'
root:*:18697:0:99999:7:::
nobody:*:18697:0:99999:7:::

Can someone please shed any light on what's happening here? Why is getent passwd producing two entries for root and nobody each?! Additionally, why does the shell for root differ for these entries?