It can be quite complicated if you use a docker version without containerd's CRI. And you do if you follow the version recommendations (because docker has a lot of regressions). GKE does it, so we do it.
Kubelet actually has a translation layer baked into it that it starts in-process when detecting docker, which provides the gRPC CRI interface on a real filesystem socket.