transactional-update is wrapping all binaries which will modify the file system with tukit, which will in turn use chroot to execute the command in the new snapshot. That way e.g. zypper will install packages into the new snapshot only.