How WSL2 Runs a Real Linux Kernel in a Lightweight VM

Windows Subsystem for Linux 2 (WSL2) delivers native Linux functionality inside Windows by replacing the translation architecture of WSL1 with a highly optimized, lightweight virtual machine. By leveraging a stripped-down subset of Microsoft’s Hyper-V hypervisor, WSL2 boots an authentic, custom-built Linux kernel in less than a second. This design grants complete system call compatibility, rapid file system performance, and dynamic hardware resource allocation while maintaining seamless integration with the host Windows desktop environment.

The Shift from Translation to Virtualization

WSL1 functioned via an emulation layer that translated Linux system calls into Windows NT kernel system calls on the fly. While this avoided the overhead of traditional virtualization, it suffered from incomplete system call compatibility and slower file I/O operations.

WSL2 fundamentally changes this model by discarding translation entirely. Instead of attempting to mimic Linux behaviors on top of the NT kernel, WSL2 runs actual Linux binaries directly against an authentic Linux kernel.

The Lightweight Utility Virtual Machine

Traditional virtual machines introduce significant overhead: they require manual configuration, pre-allocate fixed amounts of RAM and CPU resources, take several seconds or minutes to boot, and run isolated from the host operating system. WSL2 bypasses these limitations using a "utility VM" built on the Hyper-V architecture:

• Instantaneous Boot Times: The utility VM is stripped of standard PC platform emulation (such as emulated BIOS/UEFI firmware, legacy hardware devices, and virtualized PCI buses). Because it initializes only the bare essentials needed to run the kernel, execution begins almost instantaneously—typically in under one second.
• Dynamic Memory Reclaiming: Rather than locking a static block of host RAM, WSL2 requests memory from Windows as the Linux environment demands it. When memory is freed inside Linux, a memory-ballooning driver returns the unused pages to the Windows host, preventing memory starvation.
• Direct CPU Scheduling: The virtual processors inside the WSL2 VM map directly to the logical processors of the host CPU, allowing the Hyper-V hypervisor to schedule Linux threads alongside Windows threads with minimal latency.

The Tailored Linux Kernel

At the core of WSL2 is a real, open-source Linux kernel based on stable kernel.org releases, customized and maintained directly by Microsoft.

This kernel is specifically compiled to operate within the utility VM. Microsoft strips out unnecessary hardware drivers (such as physical Ethernet controllers, discrete sound cards, and storage controllers) and compiles in specific optimizations for virtualized environments. Because it is a real kernel rather than an emulation layer, it provides 100% system call compatibility. This allows developers to run software requiring deep kernel features—such as Docker containers, FUSE filesystems, and eBPF tracing tools—without modification. Microsoft delivers updates, security patches, and improvements to this kernel automatically via standard Windows Update mechanisms.

Storage and Cross-OS Communication

To achieve high file input/output performance, WSL2 hosts the Linux root filesystem inside a virtual hard disk file (ext4.vhdx). Because the real Linux kernel manages this virtual disk formatted with a native ext4 filesystem, read and write operations inside the Linux environment match bare-metal performance.

Interoperability between the two operating systems is handled through specialized protocols:

• Windows Accessing Linux Files: Windows accesses files inside the Linux container via an internal Plan 9 network protocol (9P) file server running inside the VM, exposed through a standard network redirector.
• Linux Accessing Windows Files: Linux accesses host drives (such as /mnt/c) using a custom file system driver that bridges the guest kernel to the host file system over virtual sockets (Hyper-V sockets or vsock).
• Networking: The VM operates on a virtualized Network Address Translation (NAT) switch, allowing the Linux environment to seamlessly share network interfaces with the Windows host, with support for mirrored networking modes to bind localhost ports across both environments.