Why run Ubuntu on Windows? It’s about getting the best of both worlds. Many organizations rely on Windows applications, enterprise software, and policy configurations; but for developers and system administrators, Ubuntu’s native command-line tools, package managers, and server environments are invaluable. Likewise, with its broad ecosystem of machine learning tools and libraries, and silicon optimizations, Ubuntu is ideally suited for AI workloads.
To drill down into a more specific example: for developers in regulated industries with tightly brokered elevated privileges, building applications with Node.js, Python, and other toolchains can lead to development hurdles on Windows. Navigating privilege and access control discrepancies requires specialized skillsets, and may change development timelines. By installing Ubuntu within Windows, organizations can avoid this complexity. Microsoft and Canonical’s management tooling complement one another, providing a comprehensive suite of turnkey compliance, auditing, hardening, and security capabilities.
The beauty of this ecosystem is that there is no single “right” way to do it, because different users have different needs: from simple script execution to locally simulating production environments, there are multiple ways to bridge Windows and Ubuntu. Each virtualization solution for Ubuntu in Windows comes with varying degrees of centralized management, and risk mitigation capabilities. In this article, I will explore the best ways to run Ubuntu on Windows, breaking down how each method works, so you can choose the exact right setup for your workflow.
Manually reconfiguring a new virtual machine is time consuming: run commands to install packages, wait for the packages to install, and then configure them when the installation completes. Virtual machines used for development purposes need additional configurations, such as SSH keys for interacting with git repositories and access to other Linux environments, configuring AI assistants, and setting up workspaces where coding and prototyping happens. All of these time consuming activities can be automated through cloud-init, which is supported by all the virtualization solutions mentioned in this article. Building reproducible environments with cloud-init is the industry standard practice for configuring virtual machines. Multipass and Ubuntu on WSL support cloud-init natively, and Hyper-V and VirtualBox support cloud-init through the NoCloud method.
The NoCloud method entails creating an ISO which includes cloud-init configuration files. Follow these steps to generate a NoCloud ISO image if you are on Ubuntu:
user-data and meta-data. The contents of the user-data file must be valid cloud-init YAML. The meta-data file can be empty.apt install genoisoimagecidata) containing the user-data and meta-data runtime configuration files:mkisofs -output seed.iso -volid cidata -joliet -rock user-data meta-dataHyper-V is Microsoft’s native hypervisor technology that enables hardware virtualization, enabling you to create and manage multiple virtual machines (VMs) on a single Windows physical host. It is a Type 1 hypervisor – meaning that it runs directly on bare metal hardware – commonly used for server virtualization in data centers and running isolated virtual environments on Windows 10 or 11. Hyper-V is included in Windows Pro and Enterprise editions.
If you need deep separation between the Linux environment and the Windows file system, and also want to run Canonical’s Ubuntu kernels in your virtual machines, Hyper-V is the native Windows solution. Virtual machines can be installed on Hyper-V from an Ubuntu ISO. Alternatively, a vhdx disk image can be used, and Ubuntu can be configured with cloud-init:
apt install qemu-utilsqemu-img convert -f vmdk -O vhdx ubuntu-26.04-server-cloudimg-amd64.vmdk ubuntu-26.04-server-cloudimg-amd64.vhdxOracle VirtualBox is a general-purpose full virtualization software which works on computers powered by x86_64 and arm chips. It’s commonly used in laptops, desktops, and servers. VirtualBox is an application that runs on top of Windows, which makes it a Type 2 hypervisor. It relies on Windows to manage hardware resources like the CPU, RAM, and networking. VirtualBox provides passthrough USB support, but can have limited performance for disk I/O or CPU-bound tasks, and has no high performance GPU capabilities. This means that VirtualBox is not optimized for AI workloads. There is a feature called PCI passthrough which allows a VirtualBox VM to assume complete control of a physical GPU, but the GPU access would then be limited to a single virtual machine.
Virtual machines can be installed on VirtualBox from an Ubuntu ISO. Alternatively, a vmdk disk image can be used, and Ubuntu can be configured with cloud-init using the NoCloud method, and the seed.iso as described above.
While it is possible to use either Hyper-V or VirtualBox as standalone solutions for running Ubuntu on Windows, you can also use WSL or Canonical’s Multipass to make virtualized instances more accessible and manageable.
Multipass is a mini-cloud for your Windows, macOS, or Linux workstation. On Windows, it can use either VirtualBox or Hyper-V behind the scenes. You can manage everything through a simple Multipass CLI and UI, making it the fastest way to spin up ephemeral or long-running Ubuntu instances that can run as background services. The Multipass daemon (multipassd) is set to start automatically at system boot and will restore persistent Ubuntu instances after a restart. This happens at the service/daemon level, not requiring a user login.
When launching a Multipass VM, user-data can be passed by adding the --cloud-init flag with an appropriate YAML file containing the user-data. Multipass supports cloud-init natively, and does not require the NoCloud method.
All Windows editions (except Windows 10 and 11 S Mode or certain legacy IoT builds) include WSL, which utilizes a specialized Hyper-V subset to host a high-performance Linux VM.
WSL is a feature of the Windows operating system that enables you to run a Linux file system, along with Linux command-line tools and GUI apps, directly on Windows, alongside your traditional Windows desktop and apps. WSL uses the Virtual Machine Platform component in Hyper-V to run the Linux kernel. It provides full Linux system call compatibility, with high performance. A system call (syscall) is the way a program asks the operating system’s kernel to do something, like opening a file or starting a network connection. This means your Linux binaries no longer rely on a translation layer to talk to Windows; it’s the difference between using a translator and speaking the native language. With the Linux kernel available inside a lightweight utility VM, when an app makes a syscall, it’s talking to a real Linux engine, resulting in near 100% compatibility with Linux software. Because the Linux kernel manages its own virtual hard disk (ext4), operations like git clone, npm install, or compiling large codebases happen at speeds comparable to a native Linux machine.
WSL uses a technology called GPU Paravirtualization (vGPU). Instead of the Linux kernel competing with Windows for control of the graphics card, Windows shares the GPU. The dxgkrnl driver projects a virtual abstraction of the GPU into the WSL instance. For tasks using NVIDIA CUDA, performance on WSL2 can be comparable to native Linux (within 1%) for large, long-running workloads. This compatibility enables you to run Linux GUI apps via Windows Subsystem for Linux GUI (WSLg) with hardware acceleration, meaning they feel smooth rather than laggy. While GPU access is excellent, direct hardware access to things like proprietary USB devices or specialized serial ports may require troubleshooting compared to native Linux.
Ubuntu on WSL supports cloud-init natively:
%USERPROFILE%\.cloud-init\<DistroName>.user-data (e.g., Ubuntu-26.04.user-data).When you first run wsl --install Ubuntu-26.04, WSL will pick up this file and automate your setup.
Microsoft Intune is a cloud-based endpoint management solution that can manage configurations of Windows computers. Microsoft Intune can execute commands within a WSL instance by leveraging PowerShell scripts that interact with the wsl.exe executable. You can enable and manage WSL using Microsoft Intune by using the “Settings Catalog” to configure settings or by deploying the WSL MSI app.
Canonical Landscape goes beyond arbitrary command execution in WSL instances, and provides enterprise features for configuration, compliance, hardening, auditing, patching, reporting, and inventory of users and software. Pairing Microsoft Intune with Ubuntu, and using Landscape for managing WSL at scale enables developers to accelerate their workflows in even the most tightly regulated environments.
Contact Us
Ubuntu Pro for WSL is Windows software that provides turnkey security maintenance and enterprise support for Ubuntu 24.04 LTS and Ubuntu 26.04 LTS WSL instances in Windows. The Ubuntu Pro for WSL Windows software works with free and paid Ubuntu Pro subscriptions. Installing Ubuntu Pro for WSL ensures that anyone using Ubuntu on WSL is always security maintained, in addition to enabling comprehensive management and insights through Landscape, Canonical’s systems management solution for Ubuntu.
The Ubuntu Pro for WSL software is packaged as an MSI application. Installing and configuring MSI packages is natively supported by Microsoft Intune and Active Directory. The simplest method for installing Ubuntu Pro for WSL using Microsoft Intune is to deploy it as a line-of-business (LOB) app. In a regulated environment where WSL is enabled, the Ubuntu Pro for WSL .msi file should be chosen as a Required (automatically installed) package in Microsoft Intune. The most secure location to store the Ubuntu Pro for WSL agent configurations is the Windows Registry. Remediation scripts can be used in Microsoft Intune, where a detection script checks for the necessary keys and values, and a remediation script can set missing or deviated values, ensuring continuous compliance.
Navigate to your Microsoft Intune admin center portal, and then select: Devices > Configuration Profiles > Create > New Policy > Windows 10 and later > Settings Catalog. Create a name for the new policy and search for “Windows Subsystem for Linux” to see and add the full list of available settings. Important WSL-specific settings include:
Ubuntu Pro for Windows contains the user configurations that define root (sudo and su) privileges in cloud-init.yaml. Microsoft recently built native Entra ID integration directly into WSL to secure the launching of WSL instances, and this integration is managed via Microsoft Intune. This combination provides control over who can use Ubuntu on WSL, and if root privileges are granted in Ubuntu on WSL. When you use the Entra ID login for Linux VMs extension in Azure, Entra ID controls who can launch Ubuntu on WSL. It does this via Azure Role-Based Access Control (RBAC). Entra ID’s sign-in logs will tell you when a user authenticated to the Linux machine, but it stops there. It will not log the commands they type after a successful session begins.
The actual tracking of sudo and su is done by the Linux operating system itself. Whenever a user escalates privileges, Ubuntu logs this activity to its local system logs at /var/log/auth.log. To track this activity centrally, you need to bridge the gap between the local Linux logs and your cloud environment. Install the Azure Monitor Agent (AMA), configure a Data Collection Rule (DCR) in Azure to instruct the AMA to collect the authpriv syslog facility (which contains the sudo and su events and send these logs to an Azure Log Analytics Workspace. Connect your Log Analytics Workspace to Microsoft Sentinel (Microsoft’s SIEM). You can now write KQL (Kusto Query Language) queries to alert your security team every time someone successfully or unsuccessfully executes sudo or su.
Between the controls available in Microsoft Intune and Landscape, it is possible to centrally provision WSL instances for users. Users are able to self-service the creation of new, compliant instances, and administrators are able to survey a Windows estate for compliance within the WSL instances. Ubuntu Pro for WSL ensures Expanded Security Maintenance (ESM) is enabled, providing CVE security updates that can be applied subject to administrative policy. Canonical provides up to 15 years of CVE security patching for software packaged and published through Ubuntu’s repositories. Ubuntu Pro subscriptions also cover security maintenance for popular toolchains on WSL, such as Python, Go, Rust, and more. This turnkey solution ensures security vulnerabilities are patched quickly and reliably, making WSL a viable, compliant option for enterprise environments.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。