Rings and run levels

Unix runlevels are orthogonal (in the sense "unrelated", "independent of" - see comments) to protection rings.

Runlevels are basically a run time configurations/states of the operating system as a whole, they describe what services are available ("to the user") - like SSH access, MTA, file server, GUI.

Rings are a hardware aided concept which allows finer grained control over the hardware (as mentioned in the wikipedia page you link to). For example code running in higher Ring may not be able to execute some CPU instructions.

Linux on the x86 architecture usually uses Ring0 for kernel (including device drivers) and Ring3 for userspace applications (regerdless of whether they are run by root or another ordinary or privileged user).

Hence you can't really say that a runlevel is running in some specific Ring - there are always1 userspace applications (at least PID 1 - the init) running in Ring3 and the kernel (Ring0).


1As always, the "always" really means "almost always", since you can run "normal" programs in Ring0, but you are unlikely to see that in real life (unless you work on HPC).