It's in a container with xorg running. It doesn't need kernel level access but it does need userland access which it does have access to in the container.