Microsoft puts a Linux container runtime on Windows laptops with an Intune off switch

For code already running on a Windows laptop, the API is the new capability. Microsoft's pitch is to "run Linux containers programmatically in your native Windows apps," for "running local AI workloads or using cloud-based containerized applications locally" ^[4].

The CLI builds images as well as running them. Microsoft describes wslc.exe as a way "to directly build, run and deploy Linux containers on Windows" ^[3]. Detection rules keyed on process names need two entries: wslc.exe and its built-in alias, container.exe ^[3].

The registry control is written around pulls. "With container registry allow lists, administrators can define approved registries and help ensure developers only pull container images from that list, that meet organizational security and compliance requirements," Microsoft said ^[9]. Neither report says how that policy treats an image built on the laptop itself ^[9].

For data-loss and egress rules, look at the general availability additions that move data across the host boundary. They are copying files in and out, mount support, network connect and disconnect commands, and configurable storage locations ^[5]. Help Net Security also reports a new network mode for container workflows, called consomme ^[13].

The speed figure has no bearing on the security decision. Microsoft claims up to 2x faster access to Windows files from Linux environments, and Help Net Security notes that the "up to" wording makes it a ceiling ^[14].