A microkernel by the book, is just a bunch of processes doing stuff that would be on the kernel otherwise, if we are then discussing minutae.

Nothing else, critical set of OS services are no longer hosted in a single process space, rather required a distributed system of processes running on a single computer node.

The moment these processes are able to be hosted in a set of computing nodes, we enter the realm of distributed OSes, is is another discussion.

The amount of services that remain on the mikrokernel, versus what is hosted in each OS process, running outside of the kernel, depends on each microkernel, there is no rule for this division of labour and each one that was ever designed has chosen a different approach.

If you cannot see the parallel between this and a swarm of containers running on a node, doing the actual workload and only requiring the kernel services due to the way KVM is implemented, and rather focus on a security mechanism that is detail on how Linux works, well, it isn't on me to further break it down.