Correct. It does the bare minimum system calls to boot the system, then exec to an unprivileged service manager on a read only nosuid, nodev filesystem.

I design confidential compute systems.