Skip to content
Today
Sections

Security Independently confirmed3 publishers 2 min read Published Updated

Microsoft puts a Linux container runtime on Windows laptops with an Intune off switch

Microsoft made WSL Containers generally available with a wslc.exe CLI, an app-facing API, and Intune settings to disable it or allow-list registries. Through that API any native Windows app can start a Linux container, so policy has to cover software launches as well as developers at a prompt.

The Watch · Security desk

Send a correction

Illustration accompanying Microsoft puts a Linux container runtime on Windows laptops with an Intune off switch
Generated illustration

What happened

  • The feature installs through a routine wsl --update or from Microsoft's GitHub releases page.
  • Defender for Endpoint's existing WSL plugin now covers containers, surfacing process, file and network activity and tying it back to the Windows host.
  • VS Code Dev Containers can use wslc as its default driver, and Aspire and the VS Code Containers extension already support WSL Containers.
  • Compose support is the top feature request, and Microsoft says work on a wsl compose up command has started.

Why it matters

  • Who has to decide decision Intune administrators have to pick a state for WSL Containers: off, limited to approved registries, or open. Whatever they pick takes effect on machines as developers update WSL.
  • What it limits constraint Container telemetry and policy, as Microsoft describes them, come through Defender for Endpoint and Intune, so shops running other endpoint products are outside what Microsoft has shipped.
  • What it sets up precedent Once wsl compose up ships, existing compose.yaml stacks are meant to run on the same laptops unchanged. More of a team's services would then fall under whatever container policy is set now.

For code already running on a Windows laptop, the API is the new capability. Microsoft's pitch is to "run Linux containers programmatically in your native Windows apps," for "running local AI workloads or using cloud-based containerized applications locally" [4].

The CLI builds images as well as running them. Microsoft describes wslc.exe as a way "to directly build, run and deploy Linux containers on Windows" [3]. Detection rules keyed on process names need two entries: wslc.exe and its built-in alias, container.exe [3].

The registry control is written around pulls. "With container registry allow lists, administrators can define approved registries and help ensure developers only pull container images from that list, that meet organizational security and compliance requirements," Microsoft said [9]. Neither report says how that policy treats an image built on the laptop itself [9].

For data-loss and egress rules, look at the general availability additions that move data across the host boundary. They are copying files in and out, mount support, network connect and disconnect commands, and configurable storage locations [5]. Help Net Security also reports a new network mode for container workflows, called consomme [13].

The speed figure has no bearing on the security decision. Microsoft claims up to 2x faster access to Windows files from Linux environments, and Help Net Security notes that the "up to" wording makes it a ceiling [14].

What to watch

  • Microsoft documentation on whether WSL Containers are enabled by default on devices with no Intune policy applied.
  • Endpoint vendors other than Microsoft announcing visibility into process, file and network activity inside WSL containers.
  • Whether the registry allow list governs images that wsl compose up pulls from existing compose.yaml files when that command ships.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence64
Adoption
Not scored
Hype gap+12
Incentives58
Confidence70

Perspective Coverage

3 publishers
Builder
Builder 53%
Operator
Operator 42%
Investor
Investor 5%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    WSL Containers is now generally available, and users get the feature by running wsl --update.

    Reported SupportedView cited source
  2. [2]

    WSL containers install with wsl --update or from Microsoft's GitHub releases page.

    Reported SupportedView cited source
  3. [3]

    Microsoft described the new CLI as: "wslc.exe to directly build, run and deploy Linux containers on Windows, or use its built-in alias container.exe to run the same familiar container commands."

    Reported Supported Source: Microsoft, as quoted by BleepingComputerView cited source
  4. [4]

    The WSL Containers API lets Windows apps programmatically launch and interact with Linux containers. Microsoft wrote that developers can "run Linux containers programmatically in your native Windows apps", "unlocking scenarios like running local AI workloads or using cloud-based containerized applications locally."

    Reported Supported Source: Microsoft, as quoted by BleepingComputerView cited source
  5. [5]

    The general availability release adds restarting containers, copying files in and out, health checks, network connect and disconnect commands, real-time container events, mount support, and configurable storage locations.

    Reported SupportedView cited source
  6. [6]

    WSL Containers integrates with Microsoft Defender for Endpoint, so security teams can see process, file, and network activity inside containers and relate it back to the Windows host.

    Reported SupportedView cited source
  7. [7]

    Microsoft Defender for Endpoint already had a plugin for WSL and it now covers containers; Microsoft says it surfaces process, file and network activity from a container and connects it to the Windows host so investigators do not need a separate workflow.

    Reported Supported Source: Microsoft, as reported by Help Net SecurityView cited source
  8. [8]

    Microsoft Intune can disable WSL Containers entirely or restrict developers to images from approved container registries.

    Reported SupportedView cited source
  9. [9]

    "With container registry allow lists, administrators can define approved registries and help ensure developers only pull container images from that list, that meet organizational security and compliance requirements," Microsoft said.

    Reported Supported Source: Microsoft, as quoted by BleepingComputerView cited source
  10. [10]

    VS Code Dev Containers can use wslc as their default driver, while Aspire and the VS Code Containers extension now support WSL Containers.

    Reported SupportedView cited source
  11. [11]

    "Our aim is for wsl compose up to work with your existing compose.yaml files, unchanged," Microsoft said. "We've started on this and hope to share more soon."

    Reported Supported Source: Microsoft, as quoted by BleepingComputerView cited source
  12. [12]

    Microsoft calls Compose support the top feature request for WSL containers.

    Reported SupportedView cited source
  13. [13]

    The release adds a network mode called consomme for container workflows.

    Reported SupportedView cited source
  14. [14]

    Microsoft says wslc supports up to 2x faster access to Windows files from Linux environments; Help Net Security notes 'up to' makes that a ceiling and that Microsoft gives no test conditions.

    Reported Contested Source: Help Net SecurityView cited source

Sources

3 independent publishers whose own reporting we read for this story.

  1. bleepingcomputer.com

    1 article · September 29, 2026

    Microsoft is rolling out Linux container support to WSL
  2. helpnetsecurity.com

    1 article · September 29, 2026

    WSL containers are generally available on Windows
  3. phoronix.com

    1 article · September 29, 2026

    Microsoft Announces General Availability Of WSLC: Linux Containers On Windows

Topics and entities

Topics

Entities