18

I found this document on github:

WSL2 Distributions Run As Containers

It hasn't been updated in a while though, so I'm wondering if anyone knows whether or not Microsoft has published a technical document yet that describes the implementation of WSL2 distributions as containers.

1
  • 4
    FWIW, an increasing number of systems using containers are moving away from Docker to other alternatives (Podman seems to be the most popular one right now for use on developer systems). The core primitives leveraged by Docker can be used by anything though, so you can also find things like firejail (designed for security, not packaging like Docker was) or the containerization built in to Flatpak and Snap. Aug 11 at 20:08

2 Answers 2

22

There's a question in your title and a bit of a different question in the body. Highly related questions, to be sure.

Are Windows WSL2 "distributions" just docker containers under the hood?

As @DanielB already answered, WSL2 distributions utilize the same container/namespace technologies from the Linux kernel that Docker uses, but they are not Docker containers.

Pretty much every container technology on Linux uses these same technologies at the core - LXC, systemd-nspawn, and plenty of others.

And yes, that means that when we run Docker Engine or Docker Desktop on WSL2, we're really using (Docker) containers inside (WSL2) containers inside the WSL2 managed VM.

I'm wondering if anyone knows whether or not Microsoft has published a technical document yet that describes the implementation of WSL2 distributions as containers.

As far as I can tell, no. The MicrosoftDocs/WSL Github issue you linked is still open, of course.

And in the Announcing WSL 2 post on the CommandLine devblog, it's mentioned that:

You can expect more detail on the exact changes to the architecture posted to this blog in the near future, so please stay tuned!

However, I never did see a deep-dive on the blog.

The closest they come to describing it, that I can find, is in this Build 2019 session. A little more than 40 minutes in, it's mentioned that they utilize standard Linux namespace and container APIs to create the distributions inside the WSL2 VM.

Learning by examining

And while it would be great to have in-depth documentation on this, we now at least have a nice alternative -- The ability to get a commandline into the root WSL2 namespace and inspect the distribution namespaces directly.

Starting with release 0.51.2, you can add the following to your %userprofile%\.wslconfig:

[wsl2]
debugShell=true

Then issue a wsl --shutdown. The next time you start a WSL2 distribution, you'll also get a separate console logged in as root to the Mariner distribution running directly in WSL2 VM. Running a ps axjf will get you a fairly extensive process list, including the processes running in each distribution. Assuming you are only running one distribution, you can:

pgrep -u 1000 bash

... to find the bash shell running as uid 1000 (the default WSL uid). And then examine the namespaces via:

lsns -p $(pgrep -u 1000 bash)

I'll leave it to you to explore from there.

2
  • Thanks for the excellent response. The section "Learning by Examining" is exactly what I was looking for. Hope it can be useful for others at well. Aug 11 at 18:32
  • 1
    @StackExchanger Excellent - Have fun with that investigation. I'm looking forward to hearing what people learn about WSL through the use of the (relatively) new debugShell. I just noticed it in the release notes a couple of weeks ago, so I haven't had too much of a chance to dig into it yet myself. Aug 11 at 18:41
6

Sort-of, yes. They are containers, but Docker isn’t involved. Instead, WSL 2 builds directly upon the Linux technologies that also enable Docker (namespaces and control groups).

WSL 2 distribution containers have their own PID and mount namespaces, but all distributions share a single network namespace.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.