project
Windows Subsystem for Linux version 2, whose access to Windows-hosted files under /mnt/c is the subject of the post's benchmark and analysis.
No evidence-backed relationships are recorded.
Docker's engine is Apache-2.0 and the paid part is the application around it, so a team that cancels only has to serve the Engine API on the pipe docker.exe already opens. Microsoft's own wslc starts a real dockerd and leaves that endpoint closed.
Reality
The human still taps the security key, and what crosses to the agent is one origin's cookies, normalized and pushed over 127.0.0.1. The identity provider sits on the relay's blocklist, which is the part worth copying.
Reality
Seatbelt on macOS and bubblewrap on Linux now stop the agent's shell at the folder it was invoked in and route its traffic through a domain allowlist. That is a boundary a security team can approve once.
Reality
A week-long failure log on two RTX 3090s under WSL2 lands on one config at 170-210 tok/s. Everything before it died in dependency resolution, not in the math.
Reality
A dev.to write-up argues the WSL2 slowness everyone complains about is a per-crossing cost, not a tuning problem, and hands you an A/B benchmark to prove it locally.
Reality