Microsoft Enables Linux Containers on Windows Subsystem for Linux (WSL) – New Control Points for Endpoint Security
What Happened — Microsoft announced the general availability of WSL Containers, a CLI (wslc.exe/container.exe) and API that let Windows developers build, run, and manage Linux containers directly on Windows. The release adds container‑restart, health‑checks, network commands, file copy, real‑time events, and storage configuration.
Why It Matters for Trust & Control Assurance
- The feature integrates with Microsoft Defender for Endpoint, giving security teams visibility into process, file, and network activity inside containers and tying it back to the Windows host.
- Intune can now disable WSL Containers or enforce registry‑allow‑lists, providing a policy‑driven way to ensure only approved container images are used.
- Continuous‑control programs can now capture evidence of container‑runtime configuration, image provenance, and monitoring as part of a defensible audit trail.
Who Is Affected – Enterprises that run Windows workstations or dev‑ops pipelines, especially software‑development, cloud‑infrastructure, and AI/ML teams that rely on Linux tooling within Windows.
Recommended Actions
- Review your endpoint hardening policies and add WSL Containers to your inventory of monitored workloads.
- Use Intune to define approved container registries and enforce the policy across all managed devices.
- Enable Defender for Endpoint telemetry for WSL containers and begin collecting logs as evidence for your control‑assurance program. Source: BleepingComputer
Technical Notes
- New CLI (
wslc.exe) and alias (container.exe) replace Docker‑style commands; the API (WSL Containers API) allows Windows apps to launch containers programmatically. - Features include container restart, health checks, network connect/disconnect, real‑time events, mount support, and configurable storage.
- Performance gains of up to 2× when accessing Windows files from Linux containers have been reported. Source: BleepingComputer