runc has --debug option. When docker daemon is invoked in debug mode, containerd should passthrough this option to runc. Also, the log stream for runc (which is different from the daemon logs) should be specified using --log. This can be a log file with PID suffix in /tmp.

This is essential for debugging containers.

cc @tonistiigi