apart from this, you totally can mount the host containerd socket inside your container. But then you're not any bit less unsecure than using privileged containers.