In order for this to work it is expected that the Docker host exposes the devices in /dev/dri to the guest system, and that the render nodes have GID 800 (usually that would be the "render" group, but the GID for that group is dynamically assigned, so we explicitly agree on a fixed number).
It might be helpful to document that in image.docker and/or the accompanying documentation (*cough*) instead of burying it in the git commit log.