What's Changed

• Run the distro validation script daily by Blue (@OneBlue) in #40920
• Added WSLc API docs by Craig Loewen (@craigloewen-msft) in #40922
• Add a script to validate & fix mismatches CRLF in the repo by Blue (@OneBlue) in #40933
• Remove '.' from HCS suffix by Blue (@OneBlue) in #40946
• fix socket channel set exit events by Feng Wang (@chemwolf6922) in #40924
• Use strict detection of http line ending for docker response by yao-msft in #40932
• CLI: Fix hang with exec/run -i with self-exiting command and open stdin by David Bennett (@dkbennett) in #40921
• Don't append the build prefix when a line is being continued from a previous log entry by Blue (@OneBlue) in #40947
• Implement --stop-timeout in wslc create|run and support -1 (infinite) timeouts by Blue (@OneBlue) in #40919
• fix: use lowercased key when validating windowsterminal.profileTemplate by Syed Osama Ali Shah (@Osamaali313) in #40911
• Use throwing overloads in SetupTestDirectory by beena352 in #40964
• Publish the WSLC nuget package on github releases by Blue (@OneBlue) in #40962
• Support arbitrary network driver options in wslc network create by beena352 in #40859
• Fix various issues in the virtionet tests by Blue (@OneBlue) in #40963
• Don't use an overlay for the gpu libraries if the inbox folder isn't present by Blue (@OneBlue) in #40969
• Fix Lost sub directory structure when mapping to a VHD volume by Kevin Vega (@kvega005) in #40857
• Add support for callback when loading images and display loaded images in wslc image load by Blue (@OneBlue) in #40960
• Bump Kali to 2026.2 by g0tmi1k (@g0tmi1k) in #40982
• Fix https proxy not set when pac is used by Feng Wang (@chemwolf6922) in #40950
• Fix E_ACCESSDENIED during download if temp is hidden by Feng Wang (@chemwolf6922) in #40708
• Add configurable storage path for the default wslc session by Ben Hillis (@benhillis) in #40956
• Added samples to the API by Craig Loewen (@craigloewen-msft) in #40930
• Document what the session creation parameters do, and which of them ae visible to all users on the machine by Blue (@OneBlue) in #41020
• fix(l10n): add localization guidance comments for commonly mistranslated terms by Gordon Lam (@yeelam-gordon) in #14440
• Cap storage hw queue count to 4 by Feng Wang (@chemwolf6922) in #40975
• test(drvfs): add O_APPEND ftruncate coverage, skip on virtiofs by Ben Hillis (@benhillis) in #41032
• Update validate-line-endings.py to not depend on pip packages by Blue (@OneBlue) in #41022
• Fix potential use-after-free on the container deletion path by Blue (@OneBlue) in #41018
• Remove comment in packages.config causing powershell parsing error by Blue (@OneBlue) in #41036
• Collect WSLg logs and crash dumps in collect-wsl-logs.ps1 by Ben Hillis (@benhillis) in #40913
• Log an error when connect() fails in the NAT mode relay by Blue (@OneBlue) in #41033
• Mark routes via a link-local gateway as onlink to fix VPN /32 networking failures by Ben Hillis (@benhillis) in #41003
• Add wslc network connect and disconnect commands by beena352 in #41011
• Fix flaky E2E network list test assertion by beena352 in #41009
• Add support for container healthchecks by Blue (@OneBlue) in #41012
• Bump DeviceHost to 1.2.48-0 and enable virtiofs O_APPEND ftruncate test by Ben Hillis (@benhillis) in #41044
• Read /etc/locale.conf when configuring the distro locale by i4M1k0SU (@i4M1k0SU) in #40940
• Retry to delete WSL distribution shortcut for up to 10 seconds by Blue (@OneBlue) in #41046
• Make the release pipeline logic to push to the store optional (and disabled by default) by Blue (@OneBlue) in #41045
• Add wslc container cp command for tar archive upload by Pooja Trivedi (@ptrivedi) in #40835
• Pre-download socat to avoid test failing due to connectivity issues by Blue (@OneBlue) in #41035
• Enable rollback on install failures during update by Gordon Lam (@yeelam-gordon) in #40524
• CLI: Help improvements - Table output with color and routing support by David Bennett (@dkbennett) in #40848
• Fix: handle partial write in stdio forwarding by Feng Wang (@chemwolf6922) in #41065
• Protect critical WSL processes under heavy load with cgroup & isolate distro cgroups by Feng Wang (@chemwolf6922) in #40519
• Localization change from build: 152044029 by Blue (@OneBlue) in #41066
• Add --format option to wslc version command by ggarzia-MSFT in #41078
• Add missing error code mappings found in user visible errors by Feng Wang (@chemwolf6922) in #41074
• Refine CODEOWNERS for WSLC by Ben Hillis (@benhillis) in #41079
• Start the plan9 server on WSL2 even when automount and mountFsTab are… by Shuo Li (@Lsseeker) in #41057
• Remove hard-coded password from C# API docs by Ben Hillis (@benhillis) in #41098
• Simplify e2e build-test image cleanup with per-test RAII ownership by ggarzia-MSFT in #41094
• Use bespoke interfaces to communicate with wsldevicehost by Brian Perkins (@Brian-Perkins) in #41099
• CLI: Update all non-help output to use Reporter by David Bennett (@dkbennett) in #41010
• CLI: Route wslc warnings through Reporter by David Bennett (@dkbennett) in #41111
• Fix cgmanifest.json hash format and add type:git entries for NOTICE generation by beena352 in #41025
• Update .NET runtime packages to 10.0.10 by Ben Hillis (@benhillis) in #41127
• Use single virtiofs device for all shares by Daman Mulye (@damanm24) in #41129
• Bump Linux SDK to 1.23.0 and guard char->wide formatters to Windows by Ben Hillis (@benhillis) in #41071
• Fix MoveDistribution VHD ownership restore to reuse the resolved file handle by Ben Hillis (@benhillis) in #41131
• Add --ip, --link, --link-local-ip, --driver-opt, --network-alias flag… by beena352 in #41070
• CLI: Add quiet support to pull and align with Docker by David Bennett (@dkbennett) in #41121
• WSLC: Add UDP and IPv6 support for exposed image ports by David Bennett (@dkbennett) in #41124
• CLI: Make container id required for stop command by David Bennett (@dkbennett) in #41108
• Fix various issues in the distro validation script by Blue (@OneBlue) in #41141
• Handle offlink default gateways in GNS by Ben Hillis (@benhillis) in #41130
• Fix spurious ERROR log for unsupported optional cgroup controllers by Ben Hillis (@benhillis) in #41122
• Retry to delete distribution VHD for up to 10 seconds by Blue (@OneBlue) in #41153
• Bump gitpython from 3.1.50 to 3.1.52 in /tools/devops by Dependabot (@dependabot)[bot] in #41159
• Track implicit autobind ports from listen() in Consomme networking by Ben Hillis (@benhillis) in #41125
• Fix a teardown race in HttpProxyStateTracker by Ben Hillis (@benhillis) in #41097
• Update GitHub Actions workflow for issue comments by piercosta in #41142
• virtiofs: Use aggregate share feature in WSLC by Daman Mulye (@damanm24) in #41151
• Fix recurring TSA onboarding failure in release builds by Ben Hillis (@benhillis) in #41167
• WSLC: Refactor ParseImage and ParseRepository (PR Feedback followup) by David Bennett (@dkbennett) in #41154
• Update Tumbleweed v20260724.0 by Scott Bradnick (@sbradnick) in #41168
• Use an azure key vault to store Github tokens for automated pull requests & release creation by Blue (@OneBlue) in #41158
• Improve WSL2 guest memory reclaim by Ben Hillis (@benhillis) in #41096
• CLI: Align WSLC argument parser with Docker flag and value semantics by David Bennett (@dkbennett) in #41160
• fixed title error visibility by Shawn Yuan (@shuaiyuanxx) in #41118
• Follow up to the cgroup PR #40519 by Feng Wang (@chemwolf6922) in #41073
• Use 4 request queues for aggregate virtiofs devices by Ben Hillis (@benhillis) in #41169
• Address memory reclaim follow-ups from #41096 by Ben Hillis (@benhillis) in #41171
• Add --ip-...

What's Changed

• Mount plugin folders on behalf of the user owning the wsl session (#41331)
• [release/2.7] Fix VHD ownership during distribution moves by Ben Hillis (@benhillis) in #41354

Full Changelog: 2.7.11...2.7.12

What's Changed

• Fix MoveDistribution VHD ownership restore to reuse the resolved file handle (backport to release/2.7) by Ben Hillis (@benhillis) in #41147
• Backport security fixes to release/2.7 by Ben Hillis (@benhillis) in #41155

Full Changelog: 2.7.10...2.7.11

What's Changed

• Remove '.' from HCS suffix by Blue (@OneBlue) in #40946
• fix socket channel set exit events by Feng Wang (@chemwolf6922) in #40924
• Use strict detection of http line ending for docker response by yao-msft in #40932
• CLI: Fix hang with exec/run -i with self-exiting command and open stdin by David Bennett (@dkbennett) in #40921
• Don't append the build prefix when a line is being continued from a previous log entry by Blue (@OneBlue) in #40947
• Implement --stop-timeout in wslc create|run and support -1 (infinite) timeouts by Blue (@OneBlue) in #40919
• fix: use lowercased key when validating windowsterminal.profileTemplate by Syed Osama Ali Shah (@Osamaali313) in #40911
• Publish the WSLC nuget package on github releases by Blue (@OneBlue) in #40962
• Support arbitrary network driver options in wslc network create by beena352 in #40859
• Don't use an overlay for the gpu libraries if the inbox folder isn't present by Blue (@OneBlue) in #40969
• Fix Lost sub directory structure when mapping to a VHD volume by Kevin Vega (@kvega005) in #40857
• Add support for callback when loading images and display loaded images in wslc image load by Blue (@OneBlue) in #40960
• Fix https proxy not set when pac is used by Feng Wang (@chemwolf6922) in #40950
• Fix E_ACCESSDENIED during download if temp is hidden by Feng Wang (@chemwolf6922) in #40708
• Add configurable storage path for the default wslc session by Ben Hillis (@benhillis) in #40956
• Cap storage hw queue count to 4 by Feng Wang (@chemwolf6922) in #40975
• Fix potential use-after-free on the container deletion path by Blue (@OneBlue) in #41018
• Log an error when connect() fails in the NAT mode relay by Blue (@OneBlue) in #41033
• Mark routes via a link-local gateway as onlink to fix VPN /32 networking failures by Ben Hillis (@benhillis) in #41003
• Add wslc network connect and disconnect commands by beena352 in #41011
• Add support for container healthchecks by Blue (@OneBlue) in #41012
• Bump DeviceHost to 1.2.48-0 and to fix virtiofs O_APPEND ftruncate by Ben Hillis (@benhillis) in #41044
• Read /etc/locale.conf when configuring the distro locale by i4M1k0SU (@i4M1k0SU) in #40940
• Retry to delete WSL distribution shortcut for up to 10 seconds by Blue (@OneBlue) in #41046
• Add wslc container cp command for tar archive upload by Pooja Trivedi (@ptrivedi) in #40835

New Contributors

• Syed Osama Ali Shah (@Osamaali313) made their first contribution in #40911
• i4M1k0SU (@i4M1k0SU) made their first contribution in #40940

Full Changelog: 2.9.3...2.9.4

Release Notes

WSL Containers (WSLC) is now in Public Preview

We're excited to announce that WSL Containers (WSLC) is now available in public preview. WSLC brings native Linux container support to WSL, letting you build, run, and manage containers directly through the new wslc command line tool and a fully projected SDK (C++, C#/WinRT).

Highlights of what's available in this preview:

• Container lifecycle: create, run, start, kill, export, prune, and inspect containers, with per-container resource limits (--cpus, --memory, --ulimit), --shm-size, and configurable stop signals.
• Images: build (with --label support), pull, push, import, save (including multiple images in a single tar), inspect, list/prune with filters, and multi-image delete.
• Networking: create and manage networks, attach containers to multiple networks, network aliases, container:<name|id> network mode, custom network types, port publishing, and network prune.
• Volumes: create, list, prune, and remove volumes, with VHD-backed volumes and Uid/Gid/Fixed driver options.
• GPU support: GPU-enabled containers with CDI, mounted GPU executables and libraries accessible to non-root users.
• Sessions: named sessions with a default session created on demand, configurable storage location, and a default of 32 GB session storage.
• SDK: a C++ and C#/WinRT projection of the WSLC API, shipped as NuGet packages, plus a documented plugin API.
• Tooling: wslc logs with --timestamps, --since, --until, and -n; container stats; structured CLI output with color; MSBuild and CMake build integration; and group policy (ADMX) support for management.

Bug Fixes

• Fixed a stuck systemctl poweroff that could block VM termination by Feng Wang (@chemwolf6922) in #40866
• Fixed use-after-free issues in the virtiofs request worker thread by Blue (@OneBlue) in #40792 and in WSLC container exec-process teardown by yao-msft in #40822
• Fixed a potential init crash by catching exceptions in scope_exit reset by Blue (@OneBlue) in #40691
• Fixed shared pointer circular reference leaks by Feng Wang (@chemwolf6922) in #40480
• Fixed an IPv6 guest port reservation leak in Consomme (VirtioProxy) networking by Ben Hillis (@benhillis) in #40803
• Fixed mirrored mode port tracking for implicit binds from accept() calls by FetoiuCatalin in #40287 and denied guest binds to the host ephemeral port range in mirrored mode by FetoiuCatalin in #40597
• Avoided a distro zombie state when WSL init dies in systemd mode by Feng Wang (@chemwolf6922) in #40433
• Protected binfmt_misc from a cross-distro wipe at shutdown by Ben Hillis (@benhillis) in #40621
• Fixed incorrect wslpath translation of \\wsl.localhost when the current distro name is a subset of the target distro name by Blue (@OneBlue) in #40687
• Fixed CreateInstance failure when the Windows hosts file exceeds the message size cap by Ben Hillis (@benhillis) in #40718
• Fixed various initial tty sizing issues and added test coverage by Blue (@OneBlue) in #40722
• Improved virtiofs and VirtioProxy performance with a per-device SWIOTLB pool by Ben Hillis (@benhillis) in #40654

Fixes and Improvements

• Renamed the VirtioProxy networking mode to Consomme by Ben Hillis (@benhillis) in #40873
• Updated VM termination logic to enforce timeouts and avoid hanging when init is stuck by Blue (@OneBlue) in #40431
• Improved DNS tunneling reliability and VirtioNet tracing by Ben Hillis (@benhillis) in #40430 and Daman Mulye (@damanm24) in #40446
• Avoided std::terminate in the Plan9 FsUserContext destructor by Ben Hillis (@benhillis) in #40417
• Hardened VHD attach/restore by impersonating the mounting user, fixing a TOCTOU by Ben Hillis (@benhillis) in #40782
• Fixed MoveDistribution failing with E_ACCESSDENIED when setting the VHD owner under impersonation by Ben Hillis (@benhillis) in #40717
• Downgraded the system integrity-level impersonation token to high by Brian Perkins (@Brian-Perkins) in #40447

Security

• Updated the .NET runtime to 10.0.9 (CVE-2026-45491).
• Updated MSRDC to 1.2.7214 (CVE-2026-32157).

Full Changelog: 2.7.10...2.9.3

What's Changed

• Pass the mounting user's token on VHD restore (2.7 backport) by Ben Hillis (@benhillis) in #40907

Full Changelog: 2.7.9...2.7.10

• Update Microsoft.WSL.Kernel version to 6.18.33.2-2 to resolve a Windows under KVM and older AMD chipset boot regression

What's Changed

• Fix CreateInstance failure when Windows hosts file exceeds message size cap (2.7 backport) by Ben Hillis (@benhillis) in #40726
• Update kernel to 6.18.33.1-1 by Mitchell Levy (@chessturo) in #40728

Full Changelog: 2.7.7...2.7.8

What's Changed

• Update Microsoft.WSLg to version 1.0.73.2 by Ben Hillis (@benhillis) in #40585

Full Changelog: 2.7.6...2.7.7

What's Changed

• Update Microsoft.WSL.Kernel to 6.18.26.1 (#40161) by Mitchell Levy (@chessturo)
• Service: Best-effort grant of VMWP access to user-supplied VHDs (#40485) by Ben Hillis (@benhillis)

Full Changelog: 2.7.3...2.7.5