Sandboxes plugin is mandatory and otherwise containerd clients fail
to discover the runtime service. Other plugins like streaming,
transfer and nri, are not enabled although they are included in
containerd 1.7.

Now master services (scheduler and controller manager) all authenticate
using the master bearer token. This goes against the least privilege
principle but those run in the same process as the master itself, so
very little harm is to expect from this simplification.