Fix permission error creating socket directory for non-root instances

[dmcgowan]

Allows containerd to pass through the socket directory to listen in, preventing a permission error with the default /var/run/containerd directory for non-root instances.

[Copilot]

Pull request overview

Updates shim socket creation to support a caller-provided socket directory (intended to avoid permission errors for non-root instances) and bumps the containerd fork/dependency versions accordingly.

Changes:

• Switch shim socket address generation from shim.SocketAddress to shim.CreateSocketAddress with an explicit socket directory/root.
• Add support for opts.SocketDir (with a default fallback) when creating shim sockets (including debug socket).
• Update go.mod replace to a newer github.com/dmcgowan/containerd/v2 pseudo-version and refresh transitive dependencies in go.sum.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
internal/shim/manager/manager.go	Use a socket directory (from StartOpts) and new address-creation helper to avoid permission issues.
go.mod	Update containerd fork replace target and indirect dependency versions.
go.sum	Sync sums for updated module graph after dependency changes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The fallback when opts.SocketDir is empty hardcodes defaults.DefaultStateDir/"s". That can (a) reintroduce the original permission issue for non-root/rootless setups when SocketDir isn’t populated, and (b) ignore a non-default configured state dir. Consider deriving the socket directory from opts.Address (preserving the previous SocketAddress behavior) or returning a clear error instructing the caller to provide SocketDir instead of silently falling back to a potentially unwritable path.

Suggested change

	socketDir = filepath.Join(defaults.DefaultStateDir, "s")
	return params, fmt.Errorf("shim socket directory must be specified in options (SocketDir)")

[Copilot]

The newShimSocket parameters root and path are ambiguous in this context (with path actually being the containerd address). Renaming them to something like socketDir and containerdAddress (and updating call sites) would reduce the chance of future misuse, especially now that the function takes both values.

Suggested change

	func newShimSocket(ctx context.Context, root, path, id string, debug bool) (*shimSocket, error) {
	address, err := shim.CreateSocketAddress(ctx, root, path, id, debug)
	func newShimSocket(ctx context.Context, socketDir, containerdAddress, id string, debug bool) (*shimSocket, error) {
	address, err := shim.CreateSocketAddress(ctx, socketDir, containerdAddress, id, debug)

[akerouanton]

Change LGTM. Not sure what's going on with types/fieldpath.proto though.