WSL containers are generally available on Windows
Microsoft made WSL containers generally available with Intune controls and Defender for Endpoint visibility.
Microsoft made WSL containers generally available, letting Windows run Linux containers through the Windows Subsystem for Linux. Administrators can enable or disable the feature in Intune and limit image pulls to approved registries. Microsoft Defender for Endpoint now surfaces container process, file, and network activity and links it to the Windows host. The release adds wslc.exe (alias container.exe), a Windows API, VS Code and Aspire integrations, and a consomme network mode, but Docker Compose support is still planned.
- WSL containers are generally available and install via wsl --update or GitHub.
- Intune can disable the feature and restrict image pulls to approved registries.
- Defender for Endpoint now reports container process, file, and network activity tied to the Windows host.
- Compose support is still missing; Microsoft calls it the top requested feature.
Full article341 words · extracted from helpnetsecurity.com · click to collapse
Microsoft made WSL containers generally available and shipped the feature with controls that let administrators switch it off or limit where it pulls images from. WSL containers run Linux containers on Windows through the Windows Subsystem for Linux. They install with wsl --update or from Microsoft’s GitHub releases page.
Source: Microsoft
If your developers work on Windows laptops, the two Intune settings are the ones to look at first. Intune, Microsoft’s device management product, can now enable or disable the feature and restrict image pulls to approved registries, the servers that host container images. Microsoft says the allow list is meant to keep developers pulling only images that meet an organization’s security and compliance requirements.
What developers get
The feature includes a command-line tool, wslc.exe, with an alias, container.exe, for people who already know container commands. It also includes an API that lets native Windows apps run Linux containers, and Microsoft points to local AI workloads as one use. Since the public preview, Microsoft has added commands to restart containers, copy files in and out, and check the state of the container environment, along with health checks and a live stream of container events.
Two editor integrations are already out. VS Code dev containers can use wslc as their default driver, and Aspire can treat WSL containers as a container runtime.
What Defender sees
Microsoft Defender for Endpoint already had a plugin for WSL, and it now covers containers. Microsoft says it can surface process, file and network activity from a container and connect that activity to the Windows host, so investigators do not need a separate workflow.
Speed and what is missing
Microsoft says wslc supports up to 2x faster access to Windows files from Linux environments. “Up to” makes that a ceiling, and Microsoft gives no test conditions for it. The release also adds a network mode called consomme for container workflows.
Compose is the gap. Microsoft calls it the top feature request for WSL containers, and the goal is for existing compose.yaml files to run unchanged.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/09/30/microsoft-wsl-containers-available/