nerdctl pull 127.0.0.1:5000/foo with rootless doesn't work as expected because pull occurs in the child namespace.

Needs something like socat exec:'containerd-rootless-setuptool.sh nsenter socat "tcp-listen:5000,reuseaddr,fork" "stdio"' tcp-connect:127.0.0.1:5000 (WIP: this exits on HTTP error)