Support multiple container runtime in one node

[hitsub2]

Motivation
The bottlerocket OS has two containerd runtime with different sock file, one for k8s, one for host-containers(management), currently only the k8s containerd is monitored, but we need falco to monitor another containerd.

And also in some scenarios, like Docker in Docker, the CI pod would host another docker daemon for build purpose.

Feature
Support multiple container runtime in one node.

Alternatives
None.

Additional context

Bottlerocket uses host containers(exclude from the k8s containerd, called host-containerd) to run ssh server (admin-container) and aws ssm. And these host containers should be monitored because of all the privileges that host containers have can access the k8s pods.

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[leogr]

/remove-lifecycle stale

[leogr]

Tentatively for
/milestone 0.40.0

[leogr]

/assign

[leogr]

Update

short-term solution (tentatively for 0.40) 👇
My PR falcosecurity/libs#2141 is now ready for review and, once merged, will bring support to multiple CRI engines simultaneously. We also discovered that specific containerd support is specifically required to address the Bottlerocket use case. A fix is in the making falcosecurity/libs#2195

long-term solution 👉 #3403

[leogr]

Note: we still miss falcosecurity/libs#2195 for full compatibility.
We should have everything addressed for Falco 0.40