Microsoft WSL 2.9.8 Pre-release Adds wslc Docker Parity, Healthchecks, and Enterprise Policies
The WSL team has dropped a massive cumulative update covering version 2.9.3 through 2.9.8. The headline feature is a serious push toward Docker CLI compatibility in wslc, along with container healthchecks, idle-terminate session VMs, and new enterprise policy controls.
Keep in mind this isn't a single incremental bump. The 2.9.8 tag bundles roughly 60 pull requests. We're looking at dozens of new flags, networking fixes, memory reclamation improvements, and distro image updates all in one shot.
wslc Docker Parity Takes a Big Step Forward
The largest body of work targets wslc. Microsoft is clearly aiming to make the WSL container CLI a drop-in replacement for Docker in many workflows.
You can now pass --ip, --link, --link-local-ip, --driver-opt, and --network-alias when creating or running a container. Mount support arrived with the --mount flag, and image builds gained --secret, --output, --iidfile, and --pull.
Output formatting is getting a serious overhaul. JSON output from wslc version and list now matches Docker's format, and image list is being aligned as well. Volume management now includes --volumes for removing anonymous volumes, and filters work on network list and volume list.
Progress output for builds supports --progress and cached step reporting. Pull commands accept --quiet. Signal defaults in stop and kill commands have been updated.
The CLI parser received under-the-hood improvements. Argument validation idempotency, unified typed value accessors, and argument caching are now in place. The Reporter and Terminal classes were renamed for better output routing, with color table support and help routing added.
Networking and Memory
Networking saw significant additions. UDP and IPv6 port exposure for containers is now supported. Host loopback networking works, meaning containers can bind to 127.0.0.1.
Track implicit autobind ports from listen() now prevents port leaks. The ephemeral range cap prevents port exhaustion when mirrored mode is active.
Link-local gateway routes are marked as onlink, fixing VPN /32 networking failures for WSL2 guests behind VPNs. Offlink default gateways are handled in GNS for better multi-interface routing. The HTTPS proxy misconfiguration when PAC is used has been resolved.
Memory management improvements focus on guest memory reclaim. The algorithm for returning unused pages to the host received refinements. DrvFs storage HW queue count is capped at 4 to avoid saturating the virtio device. A single virtiofs device is now used for all shares, reducing device overhead.
Lifecycle, Healthchecks, and Enterprise
Container healthchecks are finally here. wslc now supports HEALTHCHECK instructions, and status is reported via inspect. Idle-terminate inactive per-user session VMs help conserve resources.
Configurable storage paths for the default wslc session let users place container storage on a different drive. wslc network connect/disconnect allows dynamic network attachment. Container cp command supports tar archive upload. Discard and TRIM are enabled for WSLc volumes.
Enterprise features are gaining traction. Registry allowlist support restricts which container registries images can be pulled from. An ADMX policy now allows group policy management for privileged WSL containers. Explicit tokens for user registry access replace less secure mechanisms. KdRelay is bound to loopback only.
Distro Updates and Fixes
Distro images have been bumped: Kali 2026.2, openSUSE Tumbleweed v20260724.0, SLES 16.0, and Arch Linux 2026.08.01.174141.
Bug fixes include a hang with exec/run -i when using a self-exiting command. A potential use-after-free on the container deletion path has been patched. Stdio forwarding partial writes are handled correctly. Timeout for create process accepts prevents hangs on slow systems.
Port 0 tracking now works for threads. The default route classification logic in DrvFs mount path is corrected. EFSBADCRC is treated as disk corruption instead of being silently ignored.
What's Next
The WSL team is clearly committed to wslc maturation. With full Docker CLI feature parity still a goal, expect more subcommand alignment in upcoming releases. Container healthchecks and lifecycle automation suggest orchestration infrastructure is taking shape. Enterprise policy controls point toward production use cases.
Head here to download the pre-release installer. It's a heavy release, but one that signals wslc is moving fast. If you've been waiting for better Docker compatibility or enterprise controls, this is worth a look.
