Though in a Unikernel, the kernel only implements what is needed to run the service. So a database, for example, would be lacking functionality like a shell to escape to.. or even a TTY to run that shell on.. or an implementation of connect() to even initiate outbound TCP connections, in the extreme case.
Also, isn't Docker people the ones talking about unikernels? Where everything run not only with superuser powers, but at kernel level?