Description

Starting with v2.3.0-rc.0, the rootless mode no longer works, as /run/containerd/containerd.sock is no longer created in the daemon's mount namespace (which is created with the daemon's user namespace, by RootlessKit):

$ nerdctl info
FATA[0000] cannot access containerd socket "/run/containerd/containerd.sock": no such file or directory

$ containerd-rootless-setuptool.sh nsenter -- ls /run/containerd
containerd.sock.ttrpc      io.containerd.mount-manager.v1.bolt  io.containerd.sandbox.controller.v1.shim
io.containerd.grpc.v1.cri  io.containerd.runtime.v2.task

This is a regression in c15ec2485 ("Add server plugins for grpc and ttrpc") from:

• Add plugins for server listeners #12562

Thanks to @haytok for bisecting:

• Dockerfile: bump containerd to v2.3.1 nerdctl#4887 (comment)

Steps to reproduce the issue

1. containerd-rootless.sh
2. nerdctl info

Describe the results you received and expected

Received: "/run/containerd/containerd.sock": no such file or directory
Expected: nerdctl should work, and "/run/containerd/containerd.sock" should be visible via containerd-rootless-setuptool.sh nsenter -- ls /run/containerd

What version of containerd are you using?

containerd github.com/containerd/containerd/v2 v2.3.0 2976f38

Any other relevant information

• Ubuntu 26.04
• nerdctl v2.3.0
• RootlessKit v3.0.0

Show configuration if it is related to CRI plugin.

No response