UML has a virtual filesystem, hostfs, which provides direct access to the host filesystem. This is done by implementing the VFS interface in terms of file access calls on the host. Most VFS operations translate directly into equivalent libc calls on the host.
hostfs can also be the root filesystem. This is done by registering it as a device filesystem as well as a virtual filesystem, and having the block driver recognize when it's booting from a directory rather than a file and faking a hostfs superblock. When hostfs sees the faked superblock, it claims the filesystem and performs all subsequent operations itself, without further involvement from the block driver.