In order for this to work it is expected that the Docker host exposes
the devices in /dev/dri to the guest system, and that the render nodes
have GID 800 (usually that would be the "render" group, but the GID
for that group is dynamically assigned, so we explicitly agree on a
fixed number).
