WSL Containers Reach General Availability, With an Intune Registry Allow List and No Compose Yet

Microsoft has made WSL containers generally available, a Linux container runtime built into the Windows Subsystem for Linux and driven by a command-line tool named wslc.exe. Help Net Security reported the release on Sept. 30, a day after Microsoft's own engineering post.

Developers install it with wsl --update or from Microsoft's GitHub releases page. The tool has an alias, container.exe, and a native Windows API for programs that need to start Linux containers themselves.

What WSL containers ship with

The release adds commands for restarting containers, copying files and checking the state of the environment. It also adds health checks and live event streaming. VS Code dev containers and Aspire integrations already exist, according to Help Net Security.

Microsoft says the release gives "up to 2x faster access to Windows files from Linux environments". That is a vendor figure and the sources give no benchmark setup for it. The architecture post makes a related claim: container volumes use virtiofs, which it describes as twice as fast as Plan9.

How the design differs from WSL

Pierre Boulay, a Senior Software Engineer at Microsoft, wrote the architecture post on Sept. 29. Plain WSL keeps the virtual machine in a service process. WSLC does not. The service, wslservice.exe, creates a wslcsession.exe process on behalf of each user, and the post says this gives "strong isolation between sessions".

Session disks live in %AppData%\Local\wslc\sessions. Volumes can be virtiofs shares or VHD-backed, and the VHD kind gets a native Linux filesystem with a size limit.

Networking goes through virtio queues to a user-mode Windows process the post calls Consommé. That process handles DNS, TCP and UDP routing and port mapping, and Boulay writes that it keeps "extensive compatibility with VPNs and firewalls". The project is open source in the microsoft/WSL repository on GitHub.

Feature	Detail	Source
CLI	wslc.exe, alias container.exe	Help Net Security
Install	wsl --update or GitHub releases	Help Net Security
Per-user isolation	One wslcsession.exe per user	Microsoft blog
Volumes	virtiofs or size-limited VHD	Microsoft blog
Endpoint security	Defender for Endpoint covers WSL containers	Help Net Security

The controls an administrator gets

Two Intune settings ship at launch. One turns the feature on or off for the whole fleet. The other restricts image pulls to approved container registries. Microsoft says the allow list "is meant to keep developers pulling only images that meet an organization's security and compliance requirements".

Microsoft Defender for Endpoint now covers WSL containers. It surfaces process, file and network activity and ties container activity back to the Windows host.

What is missing

Compose is the gap. Boulay's post calls adding compose support "our top feature request" for upcoming iterations. A team whose local environment is a compose.yaml with a database, a queue and an app cannot move to wslc as a drop-in replacement, and the post gives no date for the feature.

Agent sandboxes are the other place containers are changing, as in NVIDIA's OpenShell, which gained 2,503 GitHub stars in a day at v0.1.2. Teams choosing a runtime for either now have a Microsoft-built option on Windows. Support windows are the other thing to read before adopting any platform tool, as Google's ChromeOS 2034 cutoff showed for Chromebooks.

The task that decides adoption is therefore a small one: take the file you already have and run it. Until Compose lands, that means rewriting each service as separate wslc commands or staying on the current tool.

The sources do not say how wslc pricing or licensing compares with other container tools, and neither names a Compose release date.