Yes.

There are AppContainers. Those have existed for a while and are mostly targeted at developers intending to secure their legacy applications.

https://learn.microsoft.com/en-us/windows/win32/secauthz/app...

There's also Docker for Windows, with native Windows container support. This one is new-ish:

https://learn.microsoft.com/en-us/virtualization/windowscont...

The low level API of process isolation on Windows is Job Objects, that provide the necessary kernel APIs for namespacing objects and controlling resource use.

AppContainers, and Docker for Windows (the one for running dockerized windows apps, not running linux docker containers on top of WSL) is using this API, these high-level features are just the 'porcelain'

Windows containers are actually quite nice once you get past a few issues. Perf is the biggest as it seems to run in a VM in windows 11.

Perf is much better on Windows server. It's actually really pleasant to get your office appliances (a build agent etc) in a container on a beefy Windows machine running Windows server.

> Perf is the biggest as it seems to run in a VM in windows 11.

Doesn’t “virtualization-based security” mean everything does, container or no? Or are they actually VMs even with VBS disabled?

With a standard windows server license you are only allowed to have a two hyperv virtual machines but unlimited "windows containers". The design is similar to Linux with namespaces bolted onto the main kernel so they don't provide any better security guaranies than Linux namespaces.

Very useful if you are packaging trusted software don't want to upgrade your windows server license.