Motivation
The bottlerocket OS has two containerd runtime with different sock file, one for k8s, one for host-containers(management), currently only the k8s containerd is monitored, but we need falco to monitor another containerd.

And also in some scenarios, like Docker in Docker, the CI pod would host another docker daemon for build purpose.

Feature
Support multiple container runtime in one node.

Alternatives
None.

Additional context

Bottlerocket uses host containers(exclude from the k8s containerd, called host-containerd) to run ssh server (admin-container) and aws ssm. And these host containers should be monitored because of all the privileges that host containers have can access the k8s pods.