A note on my debugging tricks, for posterity…

Initially, I tried to reproduce the issue (in a VM) with a Guile or Bash
process that would be invoked from shepherd before ‘user-processes’ and
that would try to read from stdin:

--8<---------------cut here---------------start------------->8---
(simple-service 'input
                shepherd-root-service-type
                (list (shepherd-service
                       (provision '(input))
                       (start #~(lambda ()
                                  (pk 'tty-before?
                                      (current-input-port)
                                      (isatty?
                                       (current-input-port)))

                                  (with-output-to-file
                                      "/dev/tty1"
                                    (lambda ()
                                     (system*
                                      #$(file-append
                                         coreutils "/bin/ls") "-l" "/proc/self/fd")
                                     (with-input-from-file
                                         "/dev/tty1"
                                       (lambda ()
                                         (pk 'tty?
                                             (isatty?
                                              (current-input-port)))
                                         (system*
                                          #$(file-append
                                             coreutils "/bin/ls") "-l"
                                          "/proc/self/fd")
                                         (system* "/bin/sh"
                                                  "-c"
                                                  "echo read; read x; echo got $x; read y"))))))))))
(simple-service 'wait-for-input user-processes-service-type
                '(input))
--8<---------------cut here---------------end--------------->8---

For some reason, that did not reproduce the issue; ‘isatty?’ would
return true.

So I though I’d arrange to run ‘cryptsetup open --type luks’.  To do
that, I copied the header of a real LUKS partition:

  sudo dd if=/dev/sda2 of=/tmp/luks.img bs=1024 count=1025

and then came up with an OS config that would try to open than fake LUKS
device: