>> $ export GUIX_DAEMON_SOCKET=ssh://charlie@sandbox.guix.gnu.org:22
>> $ guix build foo
>
> …requires an SSH access by ’charlie’ to sandbox.guix.gnu.org,  And they
> think this access is risky.

We could provide SSH access but no shell access. We could use some
restricted shell in the spirit of git-shell. All we need is port
forwarding through SSH, not shell access.