What is the problem you're trying to solve

Currently, /var/run/containerd/containerd.sock is created with root/root ownership and 660 permissions.

It some environments, it is desirable to allow other users except root to talk to containerd.

dockerd has the following option to achieve this:

-G, --group string                            Group for the unix socket (default "docker")

buildkitd has a similar option:

--group value                               group name(s), comma-separated, which will have RW access to the named pipe listening addresses

Describe the solution you'd like

Add similar option to containerd.

Additional context

Implementation should support specifying group both on Linux and Windows. Possibly the easiest way is to Ctrl+C/Ctrl+V code from BuildKit.

P.S. I do understand that such option allows those users to gain root access. The point is that members of the group are trusted and already have sudo access, so it just makes their lives more convenient.

This issue is somewhat related to #6087, but I believe it is not a duplicate because my approach is more straightforward and doesn't rely on third-party tools to pre-create socket file (is it possible at all on Windows?)