Microsoft Bakes Linux Container Support Directly into Windows
Microsoft’s move matters less as a new way to run containers and more as a change in where the Linux-container control plane can live inside enterprise development environments. For teams standardised on Windows endpoints, WSL containers reduce the architectural mismatch between developer laptops and Linux-first production targets. That can simplify local build fidelity, but it also shifts attention to how organisations want container workflows governed when the runtime is now part of the operating environment rather than an added developer tool.
The practical question is not whether WSLc can run OCI containers, but how it fits into existing pipelines, policies and support models. Teams should validate image compatibility, volume behaviour and file I/O patterns when projects depend on cross-platform mounts, generated artifacts or hot-reload workflows. Native ext4 semantics and VirtioFS may improve consistency for Linux-oriented tooling, yet mixed Windows/Linux path usage can still become a source of subtle build or permission issues if repositories and caches are not laid out deliberately.
The security and operations angle is equally important. Intune and Defender integration suggests WSLc is being positioned as manageable enterprise infrastructure, not just a developer convenience. That creates opportunities for registry allow-listing, endpoint telemetry correlation and standardised device policy, but it also means platform teams should define who owns runtime configuration, patch cadence, container provenance and incident response across the Windows-to-WSL boundary.
For architects, the larger implication is strategic: if local Windows machines can host Linux-native container workflows with first-party governance, some organisations may revisit whether Docker Desktop remains a universal requirement or becomes one option among several depending on developer experience, cloud handoff and tooling interoperability needs.
TL;DR — Key Takeaways
– Microsoft has made WSL containers generally available, giving developers a native way to build and run OCI-based Linux containers on Windows.
– WSLc integrates with Windows tools including Microsoft Intune, Microsoft Defender for Endpoint and .NET Aspire.
– The runtime supports native ext4 storage, VirtioFS bind mounts and a new networking model called Consommé.
Linux developers relegated to working on corporate Windows machines no longer have to wrangle with Docker Desktop, file system translations or container lifecycle incompatibilities.
This week, Microsoft has released into general availability WSL containers, a Windows Subsystem for Linux (WSL) runtime for building and running containers based on the Open Container Initiative (OCI) standard.
It is different from Windows Containers, introduced 10 years ago, in that the software produces and manages fully native Linux containers.
The setup is ideal for building native Linux-based containers with Windows tooling. WSL runs a managed Linux environment inside Windows.
Updating WSL from the command line will bring forth these new capabilities. Or the bits can be downloaded from GitHub as well. WSLc, like WSL itself, is fully open source.
The release comes with two components. One is a command line interface (CLI) that can be launched from wslc.exe or the container.exe alias, and can be used to build, run and deploy Linux containers on Windows.
The other component is an API, which provides a way to programmatically control the containers from native Windows applications. Developers can also use the API to run cloud-based containerized applications locally.
Of course, you can do all of this with Docker Desktop as well. But one advantage that WSLc brings is its integration with native Windows capabilities.
Pairs Well With Windows
Both Microsoft Intune and Microsoft Defender for Endpoint (MDE) already support WSLc. Intune provides unified endpoint management for controlling and configuring resources, while MDE was made for securing those endpoints from threats.
Intune, which has been updated to manage WSL containers, can enable or disable WSL containers and restrict image pulls to approved registries. MDE can show process, file and network activity of running WSL containers, which then can be coordinated with other behaviors within Windows for deeper investigations.
Also: The Microsoft .NET Aspire cloud-native stack can run WSLc as a container runtime.
Managing Linux containers in-house also opens possibilities with integrating workflows with third-party and open source software packages. For instance, WSLc can manage dev containers for VS Code, and, within VS Code, manage the WSLc container, via an extension.
WSLc containers can also be managed through the Lazywslc terminal dashboard or the
WSL Container Desktop Windows app.
Linux and Windows NT: Together Forever
In a technical deep dive, Microsoft Senior Software Engineer Pierre Boulay examined how WSLc works within the Microsoft environment, focusing on architectural benefits it brings with storage, networking and security.
Storage-wise, WSLc can create native ext4-formatted virtual hard drive (VHD) volumes that provide full Linux ext4 semantics. And with the new VirtioFS bind mounts, processes can “use a volume to share a Windows path with a container,” Boulay wrote.
For networking, WSLc introduced a new networking model, Consommé. Consommé gives WSLc fine control over the Linux virtual machine for activities such as port mapping and host loopback, while remaining conversant with the Windows networking stack.
On the security side, container lifecycle operations – such as spawning containers, binding ports, mounting file systems – execute in user space rather than as a core system service.
Docker Not Standing Still
While Microsoft may be encroaching on the turf of Docker Desktop, Docker has been busy as well. Last month, Docker introduced Docker Cloud Sandboxes, which is fully integrated with Desktop. The Sandboxes, built on OCI images, give developers the ability to compose an agent on a local machine, then easily upload it to a cloud environment for execution.
Docker also partnered with the Cloud Native Computing Foundation (CNCF) to author the Docker Sandbox Kit Spec, an extension of OCI to provide an agent, a set of tools and resources an agent can tap into.
Frequently Asked Questions
WSL containers are Linux containers that run through Windows Subsystem for Linux using the OCI container standard.
WSL containers run native Linux container workloads, while Windows Containers are designed for Windows-based containerized applications.
Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.