WSL 2.9.13 Pre-release Ships With Docker-Parity Containers and Security Hardening
Microsoft has published a new pre-release of the Windows Subsystem for Linux, and the standout feature is its continued push to make its own wslc container CLI feel indistinguishable from Docker.
The 2.9.13 build went live today, published by Microsoft engineer OneBlue (Bing Hong) through the microsoft/WSL GitHub repository. It sits roughly ten commits ahead of 2.9.12 on master, and it comes bundled with a nightly Linux kernel from the separate WSL2-Linux-Kernel repo. As with every WSL pre-release, this one targets testers and developers who want to poke at changes before they hit the stable channel. Microsoft still recommends installing it somewhere you can roll back quickly.
For context: Microsoft built wslc as a native, Docker-Engine-compatible container stack that ships inside WSL. The CLI mirrors Docker's subcommands, so wslc image and wslc container behave much like their docker counterparts. The whole point is letting people build, run, and push Linux containers without needing Docker Desktop. Not free to build, but it's clearly a strategic bet.
The microsoft/WSL repo itself now carries more than 33,000 stars on GitHub. That's a long way from its early days as a Windows Insider side project back in 2016.
A whole lot of wslc parity
The container CLI work dominates this release. There are several additions worth naming.
First, a new --all-tags flag (alias -a) on wslc pull and wslc image pull. Pulling a repository without a tag normally gets you just latest. With --all-tags, you grab every published tag. The implementation refuses the contradictory combo of naming a specific tag while passing --all-tags, and it prints the repo name rather than a single reference, matching Docker.
Also new: a --digests flag for wslc image list, a --follow-link option for wslc cp, and a wslc events command exposing network lifecycle hooks. On the backend, PR #41546 adds command-scoped global options to support nested commands like Docker Compose. That's the most architecturally interesting change here. It lets a global flag appear after the command that declares it, for example wslc --session foo compose --progress plain up.
Craig Loewen added a dedicated "WSL Container" page to the WSL Settings onboarding flow, complete with its own nav entry and a "NEW" badge. Microsoft is framing containers as a first-class experience, and it's worth watching whether that messaging holds once the feature reaches general availability.
Security and reliability round it out
Two changes carry an explicit security benefit. PR #41542 by Ben Hillis enables the Windows Redirection Trust mitigation (PROCESS_MITIGATION_REDIRECTION_TRUST_POLICY) in enforce mode. It toughens defenses against gadget and ROP-based attacks that abuse file-redirection handles. OneBlue noted in review that it had previously hit a blocking issue stopping the flag from turning on, then couldn't remember what it was. As Blue put it, it was approved "since I can't find a good reason not to enable it." Hillis acknowledged the somewhat ominous tone.
The second fix, PR #41664, closes a potential out-of-bounds memory access that could occur when pretty-printing a string field in initialization messages. Those bounds-check fixes are exactly the kind of defensive hardening that prevents crashes and shuts down exploitable paths.
On the reliability front, the release covers a lot of ground. There's a fix for a service-lifecycle misclassification that treated activating an already-stopping service as an out-of-memory condition, plus route-update changes for mirrored networking mode. Configuration parsing got a fix too: a single invalid line in wsl.conf no longer discards the rest of the file, and WSL now warns about an escaped carriage return instead of dropping it silently. New contributor Leo Camus made that last change his first PR.
Diagnostics also get a bump. Ben Hillis substantially improved collect-wsl-logs.ps1, the script that packages diagnostic traces. It now writes a collection-info.txt file recording capture provenance: which WPR profile was used, the mapped profile and file, the relevant switches, and the timestamp. That provenance can't be recovered from the trace providers alone, so shipped archives should be far easier to triage.
Keep in mind that this release drew on contributions from eleven collaborators. Ben Hillis and OneBlue drove the security and diagnostics work, while ggarzia-MSFT handled most of the container tooling. Alongside them are cnihelton, dkbennett, chemwolf6922, craigloewen-msft, beena352, and FetoiuCatalin. Anton Kesy, another newcomer, rounded out the roster with documentation typo fixes.
As a pre-release, 2.9.13 isn't a mandatory production update. But those two security fixes and the container-parity features give developers plenty to try.
Head here to grab it if you want to experiment. Install through the Microsoft Store's pre-release channel, or update on the preview track:
wsl --version wslc --help wslc image pull ubuntu --all-tags
People filing bug reports will benefit most from the improved log-collection provenance. Those who prefer predictable behavior should wait for the matching stable build. That release will fold in whatever from 2.9.13 passes Microsoft's nightly validation, including confirmation that the newly enabled Redirection Guard mitigation doesn't break older Windows builds.
