Microsoft Bakes Linux Container Support Directly into Windows

Linux developers relegated to working on corporate Windows machines no longer have to wrangle with Docker Desktop, file system translations or container lifecycle incompatibilities. 

This week, Microsoft has released into general availability WSL containers, a Windows Subsystem for Linux (WSL) runtime for building and running containers based on the Open Container Initiative (OCI) standard.

It is different from Windows Containers, introduced 10 years ago, in that the software produces and manages fully native Linux containers. 

The setup is ideal for building native Linux-based containers with Windows tooling. WSL runs a managed Linux environment inside Windows.

Updating WSL from the command line will bring forth these new capabilities. Or the bits can be downloaded from GitHub as well. WSLc, like WSL itself, is fully open source.

The release comes with two components. One is a command line interface (CLI) that can be launched from wslc.exe or the container.exe alias, and can be used to build, run and deploy Linux containers on Windows.

The other component is an API, which provides a way to programmatically control the containers from native Windows applications. Developers can also use the API to run cloud-based containerized applications locally.

Of course, you can do all of this with Docker Desktop as well. But one advantage that WSLc brings is its integration with native Windows capabilities. 

Pairs Well With Windows

Both Microsoft Intune and Microsoft Defender for Endpoint (MDE) already support WSLc. Intune provides unified endpoint management for controlling and configuring resources, while MDE was made for securing those endpoints from threats. 

Intune, which has been updated to manage WSL containers, can enable or disable WSL containers and restrict image pulls to approved registries. MDE can show process, file and network activity of running WSL containers, which then can be coordinated with other behaviors within Windows for deeper investigations.

Also: The Microsoft .NET Aspire cloud-native stack can run WSLc as a container runtime.

Managing Linux containers in-house also opens possibilities with integrating workflows with third-party and open source software packages. For instance, WSLc can manage dev containers for VS Code, and, within VS Code, manage the WSLc container, via an extension. 

WSLc containers can also be managed through the Lazywslc terminal dashboard or the 

WSL Container Desktop Windows app.

Linux and Windows NT: Together Forever

In a technical deep dive, Microsoft Senior Software Engineer Pierre Boulay examined how WSLc works within the Microsoft environment, focusing on architectural benefits it brings with storage, networking and security. 

Storage-wise, WSLc can create native ext4-formatted virtual hard drive (VHD) volumes that provide full Linux ext4 semantics. And with the new VirtioFS bind mounts, processes can “use a volume to share a Windows path with a container,” Boulay wrote. 

For networking, WSLc introduced a new networking model, Consommé. Consommé gives WSLc fine control over the Linux virtual machine for activities such as port mapping and host loopback, while remaining conversant with the Windows networking stack.

On the security side, container lifecycle operations – such as spawning containers, binding ports, mounting file systems – execute in user space rather than as a core system service.

Docker Not Standing Still

While Microsoft may be encroaching on the turf of Docker Desktop, Docker has been busy as well. Last month, Docker introduced Docker Cloud Sandboxes, which is fully integrated with Desktop. The Sandboxes, built on OCI images, give developers the ability to compose an agent on a local machine, then easily upload it to a cloud environment for execution. 

Docker also partnered with the Cloud Native Computing Foundation (CNCF) to author the Docker Sandbox Kit Spec, an extension of OCI to provide an agent, a set of tools and resources an agent can tap into.