unikernels do not have to run in ring 0 although a lot of early ones did. You can run them in ring 2, and they probably never need ring 0 access after boot so there does not have to be any way to return.