diff --git a/CMakeLists.txt b/CMakeLists.txt
index c0a350ad3..f557fdc47 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -40,6 +40,26 @@ FetchContent_Declare(nlohmannjson
 FetchContent_MakeAvailable(nlohmannjson)
 FetchContent_GetProperties(nlohmannjson SOURCE_DIR NLOHMAN_JSON_SOURCE_DIR)
 
+set(BOOST_VERSION "1.90.0")
+set(BOOST_TARBALL "boost_${BOOST_VERSION}")
+string(REPLACE "." "_" BOOST_TARBALL "${BOOST_TARBALL}")
+
+FetchContent_Declare(
+  boost_headers
+  URL https://archives.boost.io/release/${BOOST_VERSION}/source/${BOOST_TARBALL}.tar.gz
+  # URL_HASH SHA256=TODO
+)
+
+# Download & unpack to boost_headers_SOURCE_DIR (no add_subdirectory!)
+FetchContent_GetProperties(boost_headers)
+if(NOT boost_headers_POPULATED)
+  FetchContent_Populate(boost_headers)
+endif()
+
+# Path where Boost headers reside (root has 'boost/' folder)
+include_directories(${boost_headers_SOURCE_DIR})
+
+
 # Import modules
 list(APPEND CMAKE_MODULE_PATH "${CMAKE_CURRENT_LIST_DIR}/cmake")
 find_package(IDL REQUIRED)
diff --git a/msipackage/package.wix.in b/msipackage/package.wix.in
index 0ef367e0d..370d482a7 100644
--- a/msipackage/package.wix.in
+++ b/msipackage/package.wix.in
@@ -262,6 +262,12 @@
                     <RegistryValue Value="WSLAProcess" Type="string" />
                 </RegistryKey>
 
+                <!-- WSLAContainerProcess -->
+                <RegistryKey Root="HKCR" Key="CLSID\{3A5DB29D-6D1D-4619-B89D-578EB34C8E52}">
+                    <RegistryValue Name="AppId" Value="{E9B79997-57E3-4201-AECC-6A464E530DD2}" Type="string" />
+                    <RegistryValue Value="WSLAContainerProcess" Type="string" />
+                </RegistryKey>
+
                 <!-- WSLAUserSession -->
                 <RegistryKey Root="HKCR" Key="CLSID\{a9b7a1b9-0671-405c-95f1-e0612cb4ce8f}">
                     <RegistryValue Name="AppId" Value="{E9B79997-57E3-4201-AECC-6A464E530DD2}" Type="string" />
diff --git a/nuget.config b/nuget.config
index cf8d07af2..c0a0caabd 100644
--- a/nuget.config
+++ b/nuget.config
@@ -18,7 +18,7 @@
     </packageRestore>
     <packageSources>
         <clear />
-        <add key="WSL" value="https://pkgs.dev.azure.com/shine-oss/wsl/_packaging/WslDependencies/nuget/v3/index.json" />
+        <add key="WSL" value="C:\\Users\\piboulay\\repos\\Wsl-deps\\wsla-rootfs" />
     </packageSources>
     <disabledPackageSources>
         <!-- Override any User and Computer NuGet package settings to guarantee
diff --git a/packages.config b/packages.config
index 636ef78d3..4b6a29f43 100644
--- a/packages.config
+++ b/packages.config
@@ -23,7 +23,7 @@
   <package id="Microsoft.WSL.LinuxSdk" version="1.20.0" targetFramework="native" />
   <package id="Microsoft.WSL.TestData" version="0.1.0" />
   <package id="Microsoft.WSL.TestDistro" version="2.5.7-47" />
-  <package id="Microsoft.WSL.WslaRootfs" version="0.1.2" />
+  <package id="Microsoft.WSL.WslaRootfs" version="0.1.3" />
   <package id="Microsoft.WSLg" version="1.0.71" />
   <package id="Microsoft.Xaml.Behaviors.WinUI.Managed" version="3.0.0" />
   <package id="StrawberryPerl" version="5.32.1.1" />
diff --git a/src/linux/init/WSLAInit.cpp b/src/linux/init/WSLAInit.cpp
index 7f2da7276..48187a1c4 100644
--- a/src/linux/init/WSLAInit.cpp
+++ b/src/linux/init/WSLAInit.cpp
@@ -182,6 +182,107 @@ void HandleMessageImpl(wsl::shared::SocketChannel& Channel, const WSLA_OPEN& Mes
     result = 0;
 }
 
+void HandleMessageImpl(wsl::shared::SocketChannel& Channel, const WSLA_UNIX_CONNECT& Message, const gsl::span<gsl::byte>& Buffer)
+{
+    // Make sure to close the channel since no more messages can be processed after this.
+    auto closeChannel = wil::scope_exit([&]() { Channel.Close(); });
+
+    int result = -1;
+
+    auto sendResult = wil::scope_exit([&]() { Channel.SendResultMessage(result); });
+
+    wil::unique_fd socket;
+
+    const auto* path = wsl::shared::string::FromSpan(Buffer, Message.PathOffset);
+    THROW_ERRNO_IF(EINVAL, path == nullptr);
+
+    try
+    {
+        socket = UtilConnectUnix(path);
+        result = 0;
+    }
+    catch (...)
+    {
+        result = wil::ResultFromCaughtException();
+    }
+
+    if (result != 0)
+    {
+        return;
+    }
+
+    sendResult.reset();
+
+    // Relay data between the two sockets.
+    pollfd pollDescriptors[2];
+    pollDescriptors[0].fd = socket.get();
+    pollDescriptors[0].events = POLLIN;
+    pollDescriptors[1].fd = Channel.Socket();
+    pollDescriptors[1].events = POLLIN;
+
+    std::vector<gsl::byte> relayBuffer;
+    while (true)
+    {
+        auto result = poll(pollDescriptors, COUNT_OF(pollDescriptors), -1);
+        THROW_LAST_ERROR_IF(result < 0);
+
+        if (pollDescriptors[0].revents & (POLLIN | POLLHUP | POLLERR))
+        {
+            auto bytesRead = UtilReadBuffer(pollDescriptors[0].fd, relayBuffer);
+            if (bytesRead < 0)
+            {
+                LOG_ERROR("read failed {}", errno);
+                break;
+            }
+            else if (bytesRead == 0)
+            {
+                // Unix socket has been closed.
+                pollDescriptors[0].fd = -1;
+                break;
+            }
+            else
+            {
+                auto bytesWritten = write(Channel.Socket(), relayBuffer.data(), bytesRead);
+                if (bytesWritten < 0)
+                {
+                    LOG_ERROR("write failed {}", errno);
+                    break;
+                }
+            }
+        }
+
+        if (pollDescriptors[1].revents & (POLLIN | POLLHUP | POLLERR))
+        {
+            auto bytesRead = UtilReadBuffer(pollDescriptors[1].fd, relayBuffer);
+            if (bytesRead < 0)
+            {
+                LOG_ERROR("read failed {}", errno);
+                break;
+            }
+            else if (bytesRead == 0)
+            {
+                // hvsocket has been closed.
+                pollDescriptors[1].fd = -1;
+
+                // Shutdown the write side of the socket. This is required so docker know when stdin is EOF for instance.
+                if (shutdown(socket.get(), SHUT_WR) < 0)
+                {
+                    LOG_ERROR("shutdown({}, SHUT_WR) failed {}", socket.get(), errno);
+                }
+            }
+            else
+            {
+                auto bytesWritten = write(socket.get(), relayBuffer.data(), bytesRead);
+                if (bytesWritten < 0)
+                {
+                    LOG_ERROR("write failed {}", errno);
+                    break;
+                }
+            }
+        }
+    }
+}
+
 void HandleMessageImpl(wsl::shared::SocketChannel& Channel, const WSLA_TTY_RELAY& Message, const gsl::span<gsl::byte>&)
 {
     THROW_LAST_ERROR_IF(fcntl(Message.TtyMaster, F_SETFL, O_NONBLOCK) < 0);
@@ -766,7 +867,7 @@ void ProcessMessage(wsl::shared::SocketChannel& Channel, LX_MESSAGE_TYPE Type, c
 {
     try
     {
-        HandleMessage<WSLA_GET_DISK, WSLA_MOUNT, WSLA_EXEC, WSLA_FORK, WSLA_CONNECT, WSLA_WAITPID, WSLA_SIGNAL, WSLA_TTY_RELAY, WSLA_PORT_RELAY, WSLA_OPEN, WSLA_UNMOUNT, WSLA_DETACH, WSLA_ACCEPT, WSLA_WATCH_PROCESSES>(
+        HandleMessage<WSLA_GET_DISK, WSLA_MOUNT, WSLA_EXEC, WSLA_FORK, WSLA_CONNECT, WSLA_WAITPID, WSLA_SIGNAL, WSLA_TTY_RELAY, WSLA_PORT_RELAY, WSLA_OPEN, WSLA_UNMOUNT, WSLA_DETACH, WSLA_ACCEPT, WSLA_WATCH_PROCESSES, WSLA_UNIX_CONNECT>(
             Channel, Type, Buffer);
     }
     catch (...)
diff --git a/src/shared/inc/JsonUtils.h b/src/shared/inc/JsonUtils.h
index e25242440..b1ba03e5f 100644
--- a/src/shared/inc/JsonUtils.h
+++ b/src/shared/inc/JsonUtils.h
@@ -62,6 +62,7 @@ T FromJson(const char* Value)
 
 #ifdef WIN32
 
+        WSL_LOG("InvalidJson", TraceLoggingValue(Value, "JsonValue"), TraceLoggingValue(e.what(), "Error"));
         THROW_HR_WITH_USER_ERROR(WSL_E_INVALID_JSON, wsl::shared::Localization::MessageInvalidJson(e.what()));
 
 #else
diff --git a/src/shared/inc/SocketChannel.h b/src/shared/inc/SocketChannel.h
index f472ed021..7ecf3440e 100644
--- a/src/shared/inc/SocketChannel.h
+++ b/src/shared/inc/SocketChannel.h
@@ -318,6 +318,11 @@ class SocketChannel
         return m_socket.get();
     }
 
+    auto Release()
+    {
+        return std::move(m_socket);
+    }
+
     bool Connected() const
     {
         return m_socket.get() >= 0;
diff --git a/src/shared/inc/lxinitshared.h b/src/shared/inc/lxinitshared.h
index b64fbf13e..f7b7639fb 100644
--- a/src/shared/inc/lxinitshared.h
+++ b/src/shared/inc/lxinitshared.h
@@ -397,7 +397,8 @@ typedef enum _LX_MESSAGE_TYPE
     LxMessageWSLADetach,
     LxMessageWSLATerminalChanged,
     LxMessageWSLAWatchProcesses,
-    LxMessageWSLAProcessExited
+    LxMessageWSLAProcessExited,
+    LxMessageWSLAUnixConnect,
 } LX_MESSAGE_TYPE,
     *PLX_MESSAGE_TYPE;
 
@@ -509,6 +510,7 @@ inline auto ToString(LX_MESSAGE_TYPE messageType)
         X(LxMessageWSLATerminalChanged)
         X(LxMessageWSLAWatchProcesses)
         X(LxMessageWSLAProcessExited)
+        X(LxMessageWSLAUnixConnect)
 
     default:
         return "<unexpected LX_MESSAGE_TYPE>";
@@ -1881,6 +1883,20 @@ struct WSLA_PROCESS_EXITED
     PRETTY_PRINT(FIELD(Header), FIELD(Pid), FIELD(Code), FIELD(Signaled));
 };
 
+struct WSLA_UNIX_CONNECT
+{
+    static inline auto Type = LxMessageWSLAUnixConnect;
+    using TResponse = RESULT_MESSAGE<int32_t>;
+
+    DECLARE_MESSAGE_CTOR(WSLA_UNIX_CONNECT);
+
+    MESSAGE_HEADER Header;
+    unsigned int PathOffset;
+    char Buffer[];
+
+    PRETTY_PRINT(FIELD(Header), STRING_FIELD(PathOffset));
+};
+
 typedef struct _LX_MINI_INIT_IMPORT_RESULT
 {
     static inline auto Type = LxMiniInitMessageImportResult;
diff --git a/src/windows/common/CMakeLists.txt b/src/windows/common/CMakeLists.txt
index 73e290ec0..a72362696 100644
--- a/src/windows/common/CMakeLists.txt
+++ b/src/windows/common/CMakeLists.txt
@@ -52,6 +52,7 @@ set(SOURCES
 
 set(HEADERS
     ../../../generated/Localization.h
+    ../inc/docker_schema.h
     ../inc/lxssbusclient.h
     ../inc/lxssclient.h
     ../inc/LxssDynamicFunction.h
diff --git a/src/windows/common/WSLAContainerLauncher.cpp b/src/windows/common/WSLAContainerLauncher.cpp
index a954b794a..c919895bc 100644
--- a/src/windows/common/WSLAContainerLauncher.cpp
+++ b/src/windows/common/WSLAContainerLauncher.cpp
@@ -79,6 +79,19 @@ void wsl::windows::common::WSLAContainerLauncher::AddVolume(const std::wstring&
 }
 
 std::pair<HRESULT, std::optional<RunningWSLAContainer>> WSLAContainerLauncher::LaunchNoThrow(IWSLASession& Session)
+{
+    auto [result, container] = CreateNoThrow(Session);
+    if (FAILED(result))
+    {
+        return std::make_pair(result, std::optional<RunningWSLAContainer>{});
+    }
+
+    result = container.value().Get().Start();
+
+    return std::make_pair(result, std::move(container));
+}
+
+std::pair<HRESULT, std::optional<RunningWSLAContainer>> WSLAContainerLauncher::CreateNoThrow(IWSLASession& Session)
 {
     WSLA_CONTAINER_OPTIONS options{};
     options.Image = m_image.c_str();
@@ -114,4 +127,12 @@ RunningWSLAContainer WSLAContainerLauncher::Launch(IWSLASession& Session)
     THROW_IF_FAILED(result);
 
     return std::move(container.value());
+}
+
+wsl::windows::common::docker_schema::InspectContainer wsl::windows::common::RunningWSLAContainer::Inspect()
+{
+    wil::unique_cotaskmem_ansistring output;
+    THROW_IF_FAILED(m_container->Inspect(&output));
+
+    return wsl::shared::FromJson<docker_schema::InspectContainer>(output.get());
 }
\ No newline at end of file
diff --git a/src/windows/common/WSLAContainerLauncher.h b/src/windows/common/WSLAContainerLauncher.h
index f3450bd93..35cc9824a 100644
--- a/src/windows/common/WSLAContainerLauncher.h
+++ b/src/windows/common/WSLAContainerLauncher.h
@@ -14,6 +14,7 @@ Module Name:
 
 #pragma once
 #include "WSLAProcessLauncher.h"
+#include "docker_schema.h"
 
 namespace wsl::windows::common {
 
@@ -28,6 +29,7 @@ class RunningWSLAContainer
     WSLA_CONTAINER_STATE State();
     ClientRunningWSLAProcess GetInitProcess();
     void Reset();
+    docker_schema::InspectContainer Inspect();
 
 private:
     wil::com_ptr<IWSLAContainer> m_container;
@@ -52,6 +54,8 @@ class WSLAContainerLauncher : private WSLAProcessLauncher
     void AddVolume(const std::wstring& HostPath, const std::string& ContainerPath, bool ReadOnly);
     void AddPort(uint16_t WindowsPort, uint16_t ContainerPort, int Family);
 
+    std::pair<HRESULT, std::optional<RunningWSLAContainer>> CreateNoThrow(IWSLASession& Session);
+
     RunningWSLAContainer Launch(IWSLASession& Session);
     std::pair<HRESULT, std::optional<RunningWSLAContainer>> LaunchNoThrow(IWSLASession& Session);
 
diff --git a/src/windows/common/WslClient.cpp b/src/windows/common/WslClient.cpp
index 7fbfc72d8..a53fa6c79 100644
--- a/src/windows/common/WslClient.cpp
+++ b/src/windows/common/WslClient.cpp
@@ -1539,9 +1539,12 @@ int WslaShell(_In_ std::wstring_view commandLine)
     sessionSettings.MaximumStorageSizeMb = 4096;
 
     std::string shell = "/bin/bash";
+    std::string cmd;
 
     std::string containerImage;
     bool help = false;
+    bool noTty = false;
+    bool exec = false;
     std::wstring debugShell;
 
     std::wstring storagePath;
@@ -1561,6 +1564,9 @@ int WslaShell(_In_ std::wstring_view commandLine)
     parser.AddArgument(Integer(reinterpret_cast<int&>(sessionSettings.NetworkingMode)), L"--networking-mode");
     parser.AddArgument(Utf8String(containerImage), L"--image");
     parser.AddArgument(debugShell, L"--debug-shell");
+    parser.AddArgument(noTty, L"--no-tty");
+    parser.AddArgument(Utf8String(cmd), L"--cmd");
+    parser.AddArgument(exec, L"--exec");
     parser.AddArgument(help, L"--help");
     parser.Parse();
 
@@ -1643,11 +1649,21 @@ int WslaShell(_In_ std::wstring_view commandLine)
     }
     else
     {
-        std::vector<WSLA_PROCESS_FD> fds{
-            WSLA_PROCESS_FD{.Fd = 0, .Type = WSLAFdTypeTerminalInput},
-            WSLA_PROCESS_FD{.Fd = 1, .Type = WSLAFdTypeTerminalOutput},
-            WSLA_PROCESS_FD{.Fd = 2, .Type = WSLAFdTypeTerminalControl},
-        };
+        THROW_IF_FAILED(session->PullImage(containerImage.c_str(), nullptr, nullptr));
+
+        std::vector<WSLA_PROCESS_FD> fds;
+
+        if (noTty)
+        {
+            fds.emplace_back(WSLA_PROCESS_FD{.Fd = 0, .Type = WSLAFdTypeDefault});
+            fds.emplace_back(WSLA_PROCESS_FD{.Fd = 1, .Type = WSLAFdTypeDefault});
+            fds.emplace_back(WSLA_PROCESS_FD{.Fd = 2, .Type = WSLAFdTypeDefault});
+        }
+        else
+        {
+            fds.emplace_back(WSLA_PROCESS_FD{.Fd = 0, .Type = WSLAFdTypeTerminalInput});
+            fds.emplace_back(WSLA_PROCESS_FD{.Fd = 1, .Type = WSLAFdTypeTerminalOutput});
+        }
 
         WSLA_CONTAINER_OPTIONS containerOptions{};
         containerOptions.Image = containerImage.c_str();
@@ -1657,70 +1673,125 @@ int WslaShell(_In_ std::wstring_view commandLine)
         containerOptions.InitProcessOptions.TtyColumns = Info.srWindow.Right - Info.srWindow.Left + 1;
         containerOptions.InitProcessOptions.TtyRows = Info.srWindow.Bottom - Info.srWindow.Top + 1;
 
+        std::vector<std::string> cmdStorage;
+        for (const auto& e : cmd | std::views::split(' '))
+        {
+            cmdStorage.emplace_back(e.begin(), e.end());
+        }
+
+        std::vector<const char*> cmdPtr;
+        for (auto&& e : cmdStorage)
+        {
+            cmdPtr.push_back(e.c_str());
+        }
+
+        if (!cmdPtr.empty())
+        {
+            containerOptions.InitProcessOptions.CommandLine = cmdPtr.data();
+            containerOptions.InitProcessOptions.CommandLineCount = gsl::narrow_cast<DWORD>(cmdPtr.size());
+        }
+
         container.emplace();
         THROW_IF_FAILED(session->CreateContainer(&containerOptions, &container.value()));
+        THROW_IF_FAILED((*container)->Start());
 
-        wil::com_ptr<IWSLAProcess> initProcess;
-        THROW_IF_FAILED((*container)->GetInitProcess(&initProcess));
-        process.emplace(std::move(initProcess), std::move(fds));
+        wil::com_ptr<IWSLAProcess> createdProcess;
+
+        if (exec)
+        {
+            int error = -1;
+            THROW_IF_FAILED((*container)->Exec(&containerOptions.InitProcessOptions, &createdProcess, &error));
+        }
+        else
+        {
+            THROW_IF_FAILED((*container)->GetInitProcess(&createdProcess));
+        }
+
+        process.emplace(std::move(createdProcess), std::move(fds));
     }
 
-    // Save original console modes so they can be restored on exit.
-    DWORD OriginalInputMode{};
-    DWORD OriginalOutputMode{};
-    UINT OriginalOutputCP = GetConsoleOutputCP();
-    THROW_LAST_ERROR_IF(!::GetConsoleMode(Stdin, &OriginalInputMode));
-    THROW_LAST_ERROR_IF(!::GetConsoleMode(Stdout, &OriginalOutputMode));
+    if (noTty)
+    {
+        using namespace wsl::windows::common::relay;
+        wsl::windows::common::relay::MultiHandleWait io;
 
-    auto restoreConsoleMode = wil::scope_exit_log(WI_DIAGNOSTICS_INFO, [&] {
-        SetConsoleMode(Stdin, OriginalInputMode);
-        SetConsoleMode(Stdout, OriginalOutputMode);
-        SetConsoleOutputCP(OriginalOutputCP);
-    });
+        io.AddHandle(std::make_unique<RelayHandle>(GetStdHandle(STD_INPUT_HANDLE), process->GetStdHandle(0)));
+        io.AddHandle(std::make_unique<RelayHandle>(process->GetStdHandle(1), GetStdHandle(STD_OUTPUT_HANDLE)));
+        io.AddHandle(std::make_unique<RelayHandle>(process->GetStdHandle(2), GetStdHandle(STD_ERROR_HANDLE)));
 
-    // Configure console for interactive usage.
-    DWORD InputMode = OriginalInputMode;
-    WI_SetAllFlags(InputMode, (ENABLE_WINDOW_INPUT | ENABLE_VIRTUAL_TERMINAL_INPUT));
-    WI_ClearAllFlags(InputMode, (ENABLE_ECHO_INPUT | ENABLE_INSERT_MODE | ENABLE_LINE_INPUT | ENABLE_PROCESSED_INPUT));
-    THROW_IF_WIN32_BOOL_FALSE(::SetConsoleMode(Stdin, InputMode));
+        io.Run({});
+    }
+    else
+    {
+        // Save original console modes so they can be restored on exit.
+        DWORD OriginalInputMode{};
+        DWORD OriginalOutputMode{};
+        UINT OriginalOutputCP = GetConsoleOutputCP();
+        THROW_LAST_ERROR_IF(!::GetConsoleMode(Stdin, &OriginalInputMode));
+        THROW_LAST_ERROR_IF(!::GetConsoleMode(Stdout, &OriginalOutputMode));
+
+        auto restoreConsoleMode = wil::scope_exit_log(WI_DIAGNOSTICS_INFO, [&] {
+            SetConsoleMode(Stdin, OriginalInputMode);
+            SetConsoleMode(Stdout, OriginalOutputMode);
+            SetConsoleOutputCP(OriginalOutputCP);
+        });
 
-    DWORD OutputMode = OriginalOutputMode;
-    WI_SetAllFlags(OutputMode, ENABLE_PROCESSED_OUTPUT | ENABLE_VIRTUAL_TERMINAL_PROCESSING | DISABLE_NEWLINE_AUTO_RETURN);
-    THROW_IF_WIN32_BOOL_FALSE(::SetConsoleMode(Stdout, OutputMode));
+        // Configure console for interactive usage.
+        DWORD InputMode = OriginalInputMode;
+        WI_SetAllFlags(InputMode, (ENABLE_WINDOW_INPUT | ENABLE_VIRTUAL_TERMINAL_INPUT));
+        WI_ClearAllFlags(InputMode, (ENABLE_ECHO_INPUT | ENABLE_INSERT_MODE | ENABLE_LINE_INPUT | ENABLE_PROCESSED_INPUT));
+        THROW_IF_WIN32_BOOL_FALSE(::SetConsoleMode(Stdin, InputMode));
 
-    THROW_LAST_ERROR_IF(!::SetConsoleOutputCP(CP_UTF8));
+        DWORD OutputMode = OriginalOutputMode;
+        WI_SetAllFlags(OutputMode, ENABLE_PROCESSED_OUTPUT | ENABLE_VIRTUAL_TERMINAL_PROCESSING | DISABLE_NEWLINE_AUTO_RETURN);
+        THROW_IF_WIN32_BOOL_FALSE(::SetConsoleMode(Stdout, OutputMode));
+
+        THROW_LAST_ERROR_IF(!::SetConsoleOutputCP(CP_UTF8));
 
-    {
-        // Create a thread to relay stdin to the pipe.
         auto exitEvent = wil::unique_event(wil::EventOptions::ManualReset);
 
-        wsl::shared::SocketChannel controlChannel{
-            wil::unique_socket{(SOCKET)process->GetStdHandle(2).release()}, "TerminalControl", exitEvent.get()};
+        std::vector<wil::unique_handle> handleStorage;
+        HANDLE ttyInput = nullptr;
+        HANDLE ttyOutput = nullptr;
+        if (!containerImage.empty())
+        {
+            auto& it = handleStorage.emplace_back(process->GetStdHandle(0));
+            ttyInput = it.get();
+            ttyOutput = it.get();
+        }
+        else
+        {
+            ttyInput = handleStorage.emplace_back(process->GetStdHandle(0)).get();
+            ttyOutput = handleStorage.emplace_back(process->GetStdHandle(1)).get();
+        }
 
-        std::thread inputThread([&]() {
-            auto updateTerminal = [&controlChannel, &Stdout]() {
-                CONSOLE_SCREEN_BUFFER_INFOEX info{};
-                info.cbSize = sizeof(info);
+        {
+            // Create a thread to relay stdin to the pipe.
 
-                THROW_IF_WIN32_BOOL_FALSE(GetConsoleScreenBufferInfoEx(Stdout, &info));
+            std::thread inputThread([&]() {
+                auto updateTerminal = [&Stdout, &process]() {
+                    CONSOLE_SCREEN_BUFFER_INFOEX info{};
+                    info.cbSize = sizeof(info);
 
-                WSLA_TERMINAL_CHANGED message{};
-                message.Columns = info.srWindow.Right - info.srWindow.Left + 1;
-                message.Rows = info.srWindow.Bottom - info.srWindow.Top + 1;
+                    THROW_IF_WIN32_BOOL_FALSE(GetConsoleScreenBufferInfoEx(Stdout, &info));
 
-                controlChannel.SendMessage(message);
-            };
+                    WSLA_TERMINAL_CHANGED message{};
+                    message.Columns = info.srWindow.Right - info.srWindow.Left + 1;
+                    message.Rows = info.srWindow.Bottom - info.srWindow.Top + 1;
+                    LOG_IF_FAILED(process->Get().ResizeTty(message.Rows, message.Columns));
+                };
 
-            wsl::windows::common::relay::StandardInputRelay(Stdin, process->GetStdHandle(0).get(), updateTerminal, exitEvent.get());
-        });
+                wsl::windows::common::relay::StandardInputRelay(Stdin, ttyInput, updateTerminal, exitEvent.get());
+            });
 
-        auto joinThread = wil::scope_exit_log(WI_DIAGNOSTICS_INFO, [&]() {
-            exitEvent.SetEvent();
-            inputThread.join();
-        });
+            auto joinThread = wil::scope_exit_log(WI_DIAGNOSTICS_INFO, [&]() {
+                exitEvent.SetEvent();
+                inputThread.join();
+            });
 
-        // Relay the contents of the pipe to stdout.
-        wsl::windows::common::relay::InterruptableRelay(process->GetStdHandle(1).get(), Stdout);
+            // Relay the contents of the pipe to stdout.
+            wsl::windows::common::relay::InterruptableRelay(ttyOutput, Stdout);
+        }
     }
 
     process->GetExitEvent().wait();
diff --git a/src/windows/common/hvsocket.cpp b/src/windows/common/hvsocket.cpp
index 69e05f375..a7f1ee7cd 100644
--- a/src/windows/common/hvsocket.cpp
+++ b/src/windows/common/hvsocket.cpp
@@ -90,6 +90,9 @@ wil::unique_socket wsl::windows::common::hvsocket::Connect(
         socket::GetResult(Socket.get(), Overlapped, INFINITE, ExitHandle, Location);
     }
 
+    // Mark the socket as connected (required to call shutdown() later).
+    THROW_LAST_ERROR_IF(setsockopt(Socket.get(), SOL_SOCKET, SO_UPDATE_CONNECT_CONTEXT, nullptr, 0) == SOCKET_ERROR);
+
     return Socket;
 }
 
diff --git a/src/windows/common/relay.cpp b/src/windows/common/relay.cpp
index 270044f63..5f6fd163f 100644
--- a/src/windows/common/relay.cpp
+++ b/src/windows/common/relay.cpp
@@ -16,12 +16,16 @@ Module Name:
 #include "relay.hpp"
 #pragma hdrstop
 
+using wsl::windows::common::relay::DockerIORelayHandle;
 using wsl::windows::common::relay::EventHandle;
+using wsl::windows::common::relay::HandleWrapper;
+using wsl::windows::common::relay::HTTPChunkBasedReadHandle;
 using wsl::windows::common::relay::IOHandleStatus;
 using wsl::windows::common::relay::LineBasedReadHandle;
 using wsl::windows::common::relay::MultiHandleWait;
 using wsl::windows::common::relay::OverlappedIOHandle;
 using wsl::windows::common::relay::ReadHandle;
+using wsl::windows::common::relay::RelayHandle;
 using wsl::windows::common::relay::ScopedMultiRelay;
 using wsl::windows::common::relay::ScopedRelay;
 using wsl::windows::common::relay::WriteHandle;
@@ -967,7 +971,7 @@ bool MultiHandleWait::Run(std::optional<std::chrono::milliseconds> Timeout)
         // Remove completed handles from m_handles.
         std::erase_if(m_handles, [&](const auto& e) { return e->GetState() == IOHandleStatus::Completed; });
 
-        if (m_handles.empty())
+        if (m_handles.empty() || m_cancel)
         {
             break;
         }
@@ -1037,8 +1041,8 @@ HANDLE EventHandle::GetHandle() const
     return Handle;
 }
 
-ReadHandle::ReadHandle(wil::unique_handle&& MovedHandle, std::function<void(const gsl::span<char>& Buffer)>&& OnRead) :
-    Handle(std::move(MovedHandle)), OnRead(OnRead)
+ReadHandle::ReadHandle(HandleWrapper&& MovedHandle, std::function<void(const gsl::span<char>& Buffer)>&& OnRead) :
+    Handle(std::move(MovedHandle)), OnRead(OnRead), Offset(InitializeFileOffset(Handle.Get()))
 {
     Overlapped.hEvent = Event.get();
 }
@@ -1048,9 +1052,13 @@ ReadHandle::~ReadHandle()
     if (State == IOHandleStatus::Pending)
     {
         DWORD bytesRead{};
-        if (CancelIoEx(Handle.get(), &Overlapped))
+        if (CancelIoEx(Handle.Get(), &Overlapped))
         {
-            LOG_LAST_ERROR_IF(!GetOverlappedResult(Handle.get(), &Overlapped, &bytesRead, true) && GetLastError() != ERROR_CONNECTION_ABORTED);
+            if (!GetOverlappedResult(Handle.Get(), &Overlapped, &bytesRead, true))
+            {
+                auto error = GetLastError();
+                LOG_LAST_ERROR_IF(error != ERROR_CONNECTION_ABORTED && error != ERROR_OPERATION_ABORTED);
+            }
         }
         else
         {
@@ -1068,8 +1076,12 @@ void ReadHandle::Schedule()
 
     // Schedule the read.
     DWORD bytesRead{};
-    if (ReadFile(Handle.get(), Buffer.data(), static_cast<DWORD>(Buffer.size()), &bytesRead, &Overlapped))
+    Overlapped.Offset = Offset.LowPart;
+    Overlapped.OffsetHigh = Offset.HighPart;
+    if (ReadFile(Handle.Get(), Buffer.data(), static_cast<DWORD>(Buffer.size()), &bytesRead, &Overlapped))
     {
+        Offset.QuadPart += bytesRead;
+
         // Signal the read.
         OnRead(gsl::make_span<char>(Buffer.data(), static_cast<size_t>(bytesRead)));
 
@@ -1091,7 +1103,7 @@ void ReadHandle::Schedule()
             return;
         }
 
-        THROW_LAST_ERROR_IF_MSG(error != ERROR_IO_PENDING, "Handle: 0x%p", (void*)Handle.get());
+        THROW_LAST_ERROR_IF_MSG(error != ERROR_IO_PENDING, "Handle: 0x%p", (void*)Handle.Get());
 
         // The read is pending, update to 'Pending'
         State = IOHandleStatus::Pending;
@@ -1107,7 +1119,7 @@ void ReadHandle::Collect()
 
     // Complete the read.
     DWORD bytesRead{};
-    if (!GetOverlappedResult(Handle.get(), &Overlapped, &bytesRead, false))
+    if (!GetOverlappedResult(Handle.Get(), &Overlapped, &bytesRead, false))
     {
         auto error = GetLastError();
         THROW_WIN32_IF(error, error != ERROR_HANDLE_EOF && error != ERROR_BROKEN_PIPE);
@@ -1116,6 +1128,8 @@ void ReadHandle::Collect()
         WI_ASSERT(bytesRead == 0);
     }
 
+    Offset.QuadPart += bytesRead;
+
     // Signal the read.
     OnRead(gsl::make_span<char>(Buffer.data(), static_cast<size_t>(bytesRead)));
 
@@ -1131,8 +1145,8 @@ HANDLE ReadHandle::GetHandle() const
     return Event.get();
 }
 
-LineBasedReadHandle::LineBasedReadHandle(wil::unique_handle&& MovedHandle, std::function<void(const gsl::span<char>& Line)>&& OnLine) :
-    ReadHandle(std::move(MovedHandle), [this](const gsl::span<char>& Buffer) { OnRead(Buffer); }), OnLine(OnLine)
+LineBasedReadHandle::LineBasedReadHandle(HandleWrapper&& Handle, std::function<void(const gsl::span<char>& Line)>&& OnLine) :
+    ReadHandle(std::move(Handle), [this](const gsl::span<char>& Buffer) { OnRead(Buffer); }), OnLine(OnLine)
 {
 }
 
@@ -1163,7 +1177,82 @@ void LineBasedReadHandle::OnRead(const gsl::span<char>& Buffer)
     PendingBuffer.insert(PendingBuffer.end(), begin, end);
 }
 
-WriteHandle::WriteHandle(wil::unique_handle&& MovedHandle, const std::vector<char>& Buffer) :
+HTTPChunkBasedReadHandle::HTTPChunkBasedReadHandle(HandleWrapper&& MovedHandle, std::function<void(const gsl::span<char>& Line)>&& OnChunk) :
+    LineBasedReadHandle(std::move(MovedHandle), [this](const gsl::span<char>& Buffer) { OnRead(Buffer); }), OnChunk(OnChunk)
+{
+}
+
+HTTPChunkBasedReadHandle::~HTTPChunkBasedReadHandle()
+{
+    LOG_HR_IF(E_UNEXPECTED, !PendingBuffer.empty() || PendingChunkSize != 0);
+}
+
+void HTTPChunkBasedReadHandle::OnRead(const gsl::span<char>& Input)
+{
+    // See: https://httpwg.org/specs/rfc9112.html#field.transfer-encoding
+
+    auto buffer = Input;
+
+    auto advance = [&](size_t count) {
+        WI_ASSERT(buffer.size() >= count);
+        buffer = buffer.subspan(count);
+    };
+
+    while (!buffer.empty())
+    {
+        if (PendingChunkSize == 0 || !ReadingChunk)
+        {
+            if (buffer.front() == '\r' || buffer.front() == '\n')
+            {
+                // Consume CRLF's between chunks.
+                advance(1);
+                continue;
+            }
+        }
+
+        if (PendingChunkSize == 0)
+        {
+            auto lf = std::ranges::find(buffer, '\r');
+
+            THROW_HR_IF_MSG(
+                E_INVALIDARG, lf == buffer.end(), "Unexpected HTTP chunk trailer: %hs", std::string(buffer.data(), buffer.size()).c_str());
+
+            auto chunkSizeStr = std::string{buffer.begin(), lf};
+
+            try
+            {
+                PendingChunkSize = std::stoul(chunkSizeStr.c_str(), nullptr, 16);
+            }
+            catch (...)
+            {
+                THROW_HR_MSG(E_INVALIDARG, "Failed to parse chunk size: %hs", chunkSizeStr.c_str());
+            }
+
+            advance(chunkSizeStr.size());
+            ReadingChunk = false;
+        }
+        else
+        {
+            // Consume the chunk.
+            ReadingChunk = true;
+
+            auto consumedBytes = std::min(PendingChunkSize, buffer.size());
+            PendingBuffer.insert(PendingBuffer.end(), buffer.data(), buffer.data() + consumedBytes);
+            advance(consumedBytes);
+
+            WI_ASSERT(PendingChunkSize >= PendingChunkSize);
+            PendingChunkSize -= consumedBytes;
+
+            if (PendingChunkSize == 0)
+            {
+                OnChunk(PendingBuffer);
+                PendingBuffer.clear();
+            }
+        }
+    }
+}
+
+WriteHandle::WriteHandle(HandleWrapper&& MovedHandle, const std::vector<char>& Buffer) :
     Handle(std::move(MovedHandle)), Buffer(Buffer)
 {
     Overlapped.hEvent = Event.get();
@@ -1174,9 +1263,13 @@ WriteHandle::~WriteHandle()
     if (State == IOHandleStatus::Pending)
     {
         DWORD bytesRead{};
-        if (CancelIoEx(Handle.get(), &Overlapped))
+        if (CancelIoEx(Handle.Get(), &Overlapped))
         {
-            LOG_LAST_ERROR_IF(!GetOverlappedResult(Handle.get(), &Overlapped, &bytesRead, true) && GetLastError() != ERROR_CONNECTION_ABORTED);
+            if (!GetOverlappedResult(Handle.Get(), &Overlapped, &bytesRead, true))
+            {
+                auto error = GetLastError();
+                LOG_LAST_ERROR_IF(error != ERROR_CONNECTION_ABORTED && error != ERROR_OPERATION_ABORTED);
+            }
         }
         else
         {
@@ -1194,10 +1287,10 @@ void WriteHandle::Schedule()
 
     // Schedule the write.
     DWORD bytesWritten{};
-    if (WriteFile(Handle.get(), Buffer.data() + Offset, static_cast<DWORD>(Buffer.size() - Offset), &bytesWritten, &Overlapped))
+    if (WriteFile(Handle.Get(), Buffer.data(), static_cast<DWORD>(Buffer.size()), &bytesWritten, &Overlapped))
     {
-        Offset += bytesWritten;
-        if (Offset >= Buffer.size())
+        Buffer.erase(Buffer.begin(), Buffer.begin() + bytesWritten);
+        if (Buffer.empty())
         {
             State = IOHandleStatus::Completed;
         }
@@ -1205,7 +1298,7 @@ void WriteHandle::Schedule()
     else
     {
         auto error = GetLastError();
-        THROW_LAST_ERROR_IF_MSG(error != ERROR_IO_PENDING, "Handle: 0x%p", (void*)Handle.get());
+        THROW_LAST_ERROR_IF_MSG(error != ERROR_IO_PENDING, "Handle: 0x%p", (void*)Handle.Get());
 
         // The write is pending, update to 'Pending'
         State = IOHandleStatus::Pending;
@@ -1221,16 +1314,256 @@ void WriteHandle::Collect()
 
     // Complete the write.
     DWORD bytesWritten{};
-    THROW_IF_WIN32_BOOL_FALSE(GetOverlappedResult(Handle.get(), &Overlapped, &bytesWritten, false));
+    THROW_IF_WIN32_BOOL_FALSE(GetOverlappedResult(Handle.Get(), &Overlapped, &bytesWritten, false));
 
-    Offset += bytesWritten;
-    if (Offset >= Buffer.size())
+    Buffer.erase(Buffer.begin(), Buffer.begin() + bytesWritten);
+    if (Buffer.empty())
     {
         State = IOHandleStatus::Completed;
     }
 }
 
+void WriteHandle::Push(const gsl::span<char>& Content)
+{
+    // Don't write if a WriteFile() is pending, since that could cause the buffer to reallocate.
+    WI_ASSERT(State == IOHandleStatus::Standby || State == IOHandleStatus::Completed);
+    WI_ASSERT(!Content.empty());
+
+    Buffer.insert(Buffer.end(), Content.begin(), Content.end());
+
+    State = IOHandleStatus::Standby;
+}
+
 HANDLE WriteHandle::GetHandle() const
 {
     return Event.get();
+}
+
+RelayHandle::RelayHandle(HandleWrapper&& ReadHandle, HandleWrapper&& WriteHandle) :
+    Read(std::move(ReadHandle), [this](const gsl::span<char>& Buffer) { return OnRead(Buffer); }), Write(std::move(WriteHandle))
+{
+}
+
+void RelayHandle::Schedule()
+{
+    WI_ASSERT(State == IOHandleStatus::Standby);
+
+    // If the Buffer is empty, then we're reading.
+    if (PendingBuffer.empty())
+    {
+        // If the output buffer is empty and the reading end is completed, then we're done.
+        if (Read.GetState() == IOHandleStatus::Completed)
+        {
+            State = IOHandleStatus::Completed;
+            return;
+        }
+
+        Read.Schedule();
+
+        // If the read is pending, update to 'Pending'
+        if (Read.GetState() == IOHandleStatus::Pending)
+        {
+            State = IOHandleStatus::Pending;
+        }
+    }
+    else
+    {
+        Write.Push(PendingBuffer);
+        PendingBuffer.clear();
+
+        Write.Schedule();
+
+        if (Write.GetState() == IOHandleStatus::Pending)
+        {
+            // The write is pending, update to 'Pending'
+            State = IOHandleStatus::Pending;
+        }
+    }
+}
+
+void RelayHandle::OnRead(const gsl::span<char>& Content)
+{
+    WI_ASSERT(PendingBuffer.empty());
+
+    PendingBuffer.insert(PendingBuffer.end(), Content.begin(), Content.end());
+}
+
+void RelayHandle::Collect()
+{
+    WI_ASSERT(State == IOHandleStatus::Pending);
+
+    // Transition back to standby
+    State = IOHandleStatus::Standby;
+
+    if (Read.GetState() == IOHandleStatus::Pending)
+    {
+        Read.Collect();
+    }
+    else
+    {
+        WI_ASSERT(Write.GetState() == IOHandleStatus::Pending);
+        Write.Collect();
+    }
+}
+
+HANDLE RelayHandle::GetHandle() const
+{
+    if (Read.GetState() == IOHandleStatus::Pending)
+    {
+        return Read.GetHandle();
+    }
+    else
+    {
+        WI_ASSERT(Write.GetState() == IOHandleStatus::Pending);
+        return Write.GetHandle();
+    }
+}
+
+DockerIORelayHandle::DockerIORelayHandle(HandleWrapper&& ReadHandle, HandleWrapper&& Stdout, HandleWrapper&& Stderr) :
+    Read(std::move(ReadHandle), [this](const gsl::span<char>& Buffer) { return OnRead(Buffer); }),
+    WriteStdout(std::move(Stdout)),
+    WriteStderr(std::move(Stderr))
+{
+}
+
+void DockerIORelayHandle::Schedule()
+{
+    WI_ASSERT(State == IOHandleStatus::Standby);
+
+    // If we have an active handle and a buffer, try to flush that first.
+    if (ActiveHandle != nullptr)
+    {
+        // Push the data to the selected handle.
+        DWORD bytesToWrite = std::min(static_cast<DWORD>(RemainingBytes), static_cast<DWORD>(PendingBuffer.size()));
+
+        ActiveHandle->Push(gsl::make_span(PendingBuffer.data(), bytesToWrite));
+
+        // Consume the written bytes.
+        RemainingBytes -= bytesToWrite;
+        PendingBuffer.erase(PendingBuffer.begin(), PendingBuffer.begin() + bytesToWrite);
+
+        // Schedule the write.
+        ActiveHandle->Schedule();
+
+        // If the write is pending, update to 'Pending'
+        if (ActiveHandle->GetState() == IOHandleStatus::Pending)
+        {
+            State = IOHandleStatus::Pending;
+        }
+        else if (ActiveHandle->GetState() == IOHandleStatus::Completed)
+        {
+            // Switch back to reading if we've written all bytes for this chunk.
+            ActiveHandle = nullptr;
+        }
+    }
+    else
+    {
+        if (Read.GetState() == IOHandleStatus::Completed)
+        {
+            // No more data to read, we're done.
+            State = IOHandleStatus::Completed;
+            return;
+        }
+
+        // Schedule a read from the input.
+        Read.Schedule();
+        if (Read.GetState() == IOHandleStatus::Pending)
+        {
+            State = IOHandleStatus::Pending;
+        }
+    }
+}
+
+void DockerIORelayHandle::Collect()
+{
+    WI_ASSERT(State == IOHandleStatus::Pending);
+
+    if (ActiveHandle != nullptr)
+    {
+        // Complete the write.
+        ActiveHandle->Collect();
+
+        // If the write is completed, switch back to reading.
+        if (ActiveHandle->GetState() == IOHandleStatus::Completed)
+        {
+            ActiveHandle = nullptr;
+        }
+
+        // Transition back to standby if there's still data to read.
+        // Otherwise switch to Completed since everything is done.
+        if (Read.GetState() == IOHandleStatus::Completed)
+        {
+            State = IOHandleStatus::Completed;
+        }
+        else
+        {
+            State = IOHandleStatus::Standby;
+        }
+    }
+    else
+    {
+        // Complete the read.
+        Read.Collect();
+
+        // Transition back to standby.
+        State = IOHandleStatus::Standby;
+    }
+}
+
+HANDLE DockerIORelayHandle::GetHandle() const
+{
+    if (ActiveHandle != nullptr)
+    {
+        return ActiveHandle->GetHandle();
+    }
+    else
+    {
+        return Read.GetHandle();
+    }
+}
+
+void DockerIORelayHandle::OnRead(const gsl::span<char>& Buffer)
+{
+
+#pragma pack(push, 1)
+    struct MultiplexedHeader
+    {
+        uint8_t Fd;
+        char Zeroes[3];
+        uint32_t Length;
+    };
+#pragma pack(pop)
+
+    static_assert(sizeof(MultiplexedHeader) == 8);
+
+    PendingBuffer.insert(PendingBuffer.end(), Buffer.begin(), Buffer.end());
+
+    if (ActiveHandle == nullptr)
+    {
+        // If no handle is active, expect a header.
+        if (PendingBuffer.size() < sizeof(MultiplexedHeader))
+        {
+            // Not enough data for a header yet.
+            return;
+        }
+
+        const auto* header = reinterpret_cast<const MultiplexedHeader*>(PendingBuffer.data());
+        RemainingBytes = ntohl(header->Length);
+
+        if (header->Fd == 1)
+        {
+            ActiveHandle = &WriteStdout;
+        }
+        else if (header->Fd == 2)
+        {
+            ActiveHandle = &WriteStderr;
+        }
+        else
+        {
+            THROW_HR_MSG(E_UNEXPECTED, "Unexpected Docker IO multiplexed header fd: %u", header->Fd);
+        }
+
+        // Consume the header.
+        PendingBuffer.erase(PendingBuffer.begin(), PendingBuffer.begin() + sizeof(MultiplexedHeader));
+    }
 }
\ No newline at end of file
diff --git a/src/windows/common/relay.hpp b/src/windows/common/relay.hpp
index b1b75f91a..6f18092fa 100644
--- a/src/windows/common/relay.hpp
+++ b/src/windows/common/relay.hpp
@@ -159,6 +159,60 @@ enum class IOHandleStatus
     Completed
 };
 
+struct HandleWrapper
+{
+    DEFAULT_MOVABLE(HandleWrapper);
+
+    HandleWrapper(
+        wil::unique_handle&& handle, std::function<void()>&& OnClose = []() {}) :
+        OwnedHandle(std::move(handle)), Handle(OwnedHandle.get()), OnClose(std::move(OnClose))
+    {
+    }
+
+    HandleWrapper(
+        SOCKET handle, std::function<void()>&& OnClose = []() {}) :
+        Handle(reinterpret_cast<HANDLE>(handle)), OnClose(std::move(OnClose))
+    {
+    }
+
+    HandleWrapper(HANDLE handle, std::function<void()>&& OnClose = []() {}) : Handle(handle), OnClose(std::move(OnClose))
+    {
+    }
+
+    HandleWrapper(
+        wil::unique_hfile&& handle, std::function<void()>&& OnClose = []() {}) :
+        OwnedHandle(handle.release()), Handle(OwnedHandle.get()), OnClose(std::move(OnClose))
+    {
+    }
+
+    ~HandleWrapper()
+    {
+        Reset();
+    }
+
+    HANDLE Get() const
+    {
+        return Handle;
+    }
+
+    void Reset()
+    {
+        if (OnClose != nullptr)
+        {
+            OnClose();
+            OnClose = {};
+        }
+
+        OwnedHandle.reset();
+        Handle = nullptr;
+    }
+
+private:
+    wil::unique_handle OwnedHandle;
+    HANDLE Handle{};
+    std::function<void()> OnClose;
+};
+
 class OverlappedIOHandle
 {
 public:
@@ -200,18 +254,19 @@ class ReadHandle : public OverlappedIOHandle
     NON_COPYABLE(ReadHandle);
     NON_MOVABLE(ReadHandle);
 
-    ReadHandle(wil::unique_handle&& MovedHandle, std::function<void(const gsl::span<char>& Buffer)>&& OnRead);
+    ReadHandle(HandleWrapper&& MovedHandle, std::function<void(const gsl::span<char>& Buffer)>&& OnRead);
     virtual ~ReadHandle();
     void Schedule() override;
     void Collect() override;
     HANDLE GetHandle() const override;
 
 private:
-    wil::unique_handle Handle;
+    HandleWrapper Handle;
     std::function<void(const gsl::span<char>& Buffer)> OnRead;
     wil::unique_event Event{wil::EventOptions::ManualReset};
     OVERLAPPED Overlapped{};
     std::vector<char> Buffer = std::vector<char>(LX_RELAY_BUFFER_SIZE);
+    LARGE_INTEGER Offset{};
 };
 
 class LineBasedReadHandle : public ReadHandle
@@ -220,7 +275,7 @@ class LineBasedReadHandle : public ReadHandle
     NON_COPYABLE(LineBasedReadHandle);
     NON_MOVABLE(LineBasedReadHandle);
 
-    LineBasedReadHandle(wil::unique_handle&& MovedHandle, std::function<void(const gsl::span<char>& Buffer)>&& OneLine);
+    LineBasedReadHandle(HandleWrapper&& Handle, std::function<void(const gsl::span<char>& Buffer)>&& OnLine);
     ~LineBasedReadHandle();
 
 private:
@@ -230,24 +285,84 @@ class LineBasedReadHandle : public ReadHandle
     std::string PendingBuffer;
 };
 
+class HTTPChunkBasedReadHandle : public LineBasedReadHandle
+{
+public:
+    NON_COPYABLE(HTTPChunkBasedReadHandle);
+    NON_MOVABLE(HTTPChunkBasedReadHandle);
+
+    HTTPChunkBasedReadHandle(HandleWrapper&& Handler, std::function<void(const gsl::span<char>& Buffer)>&& OnChunk);
+    ~HTTPChunkBasedReadHandle();
+
+    void OnRead(const gsl::span<char>& Line);
+
+private:
+    std::function<void(const gsl::span<char>& Buffer)> OnChunk;
+    std::string PendingBuffer;
+    uint64_t PendingChunkSize = 0;
+    bool ReadingChunk = false;
+};
+
 class WriteHandle : public OverlappedIOHandle
 {
 public:
     NON_COPYABLE(WriteHandle);
     NON_MOVABLE(WriteHandle);
 
-    WriteHandle(wil::unique_handle&& MovedHandle, const std::vector<char>& Buffer);
+    WriteHandle(HandleWrapper&& Handle, const std::vector<char>& Buffer = {});
     ~WriteHandle();
     void Schedule() override;
     void Collect() override;
     HANDLE GetHandle() const override;
+    void Push(const gsl::span<char>& Buffer);
 
 private:
-    wil::unique_handle Handle;
+    HandleWrapper Handle;
     wil::unique_event Event{wil::EventOptions::ManualReset};
     OVERLAPPED Overlapped{};
-    const std::vector<char>& Buffer;
-    DWORD Offset = 0;
+    std::vector<char> Buffer;
+};
+
+class RelayHandle : public OverlappedIOHandle
+{
+public:
+    NON_COPYABLE(RelayHandle);
+    NON_MOVABLE(RelayHandle);
+
+    RelayHandle(HandleWrapper&& Input, HandleWrapper&& Output);
+
+    void Schedule() override;
+    void Collect() override;
+    HANDLE GetHandle() const override;
+
+private:
+    void OnRead(const gsl::span<char>& Buffer);
+
+    ReadHandle Read;
+    WriteHandle Write;
+    std::vector<char> PendingBuffer;
+};
+
+class DockerIORelayHandle : public OverlappedIOHandle
+{
+public:
+    NON_COPYABLE(DockerIORelayHandle);
+    NON_MOVABLE(DockerIORelayHandle);
+
+    DockerIORelayHandle(HandleWrapper&& Input, HandleWrapper&& Stdout, HandleWrapper&& Stderr);
+    void Schedule() override;
+    void Collect() override;
+    HANDLE GetHandle() const override;
+
+private:
+    void OnRead(const gsl::span<char>& Buffer);
+
+    ReadHandle Read;
+    WriteHandle WriteStdout;
+    WriteHandle WriteStderr;
+    std::vector<char> PendingBuffer;
+    WriteHandle* ActiveHandle = nullptr;
+    size_t RemainingBytes = 0;
 };
 
 class MultiHandleWait
diff --git a/src/windows/common/wslutil.cpp b/src/windows/common/wslutil.cpp
index 8c4ad8ac3..81258d431 100644
--- a/src/windows/common/wslutil.cpp
+++ b/src/windows/common/wslutil.cpp
@@ -144,7 +144,8 @@ static const std::map<HRESULT, LPCWSTR> g_commonErrors{
     X_WIN32(WSAECONNREFUSED),
     X_WIN32(ERROR_BAD_PATHNAME),
     X(WININET_E_TIMEOUT),
-    X_WIN32(ERROR_INVALID_SID)};
+    X_WIN32(ERROR_INVALID_SID),
+    X_WIN32(ERROR_INVALID_STATE)};
 
 #undef X
 
diff --git a/src/windows/inc/docker_schema.h b/src/windows/inc/docker_schema.h
new file mode 100644
index 000000000..cc6346184
--- /dev/null
+++ b/src/windows/inc/docker_schema.h
@@ -0,0 +1,138 @@
+#pragma once
+
+#include "JsonUtils.h"
+
+namespace wsl::windows::common::docker_schema {
+
+struct CreatedContainer
+{
+    std::string Id;
+    std::vector<std::string> Warnings;
+
+    NLOHMANN_DEFINE_TYPE_INTRUSIVE(CreatedContainer, Id, Warnings);
+};
+
+struct ErrorResponse
+{
+    std::string message;
+
+    NLOHMANN_DEFINE_TYPE_INTRUSIVE_WITH_DEFAULT(ErrorResponse, message);
+};
+
+struct EmtpyRequest
+{
+    using TResponse = void;
+};
+
+struct EmptyObject
+{
+};
+
+inline void to_json(nlohmann::json& j, const EmptyObject& memory)
+{
+    j = nlohmann::json::object();
+}
+
+struct Mount
+{
+    std::string Source;
+    std::string Target;
+    std::string Type;
+    bool ReadOnly;
+
+    NLOHMANN_DEFINE_TYPE_INTRUSIVE_WITH_DEFAULT(Mount, Target, Source, Type, ReadOnly);
+};
+
+struct PortMapping
+{
+    std::string HostIp;
+    std::string HostPort;
+
+    NLOHMANN_DEFINE_TYPE_INTRUSIVE_WITH_DEFAULT(PortMapping, HostIp, HostPort);
+};
+
+struct HostConfig
+{
+    std::vector<Mount> Mounts;
+    std::map<std::string, std::vector<PortMapping>> PortBindings;
+    std::string NetworkMode;
+    NLOHMANN_DEFINE_TYPE_INTRUSIVE_WITH_DEFAULT(HostConfig, Mounts, PortBindings, NetworkMode);
+};
+
+struct CreateContainer
+{
+    using TResponse = CreatedContainer;
+
+    std::string Image;
+    bool Tty{};
+    bool OpenStdin{};
+    bool StdinOnce{};
+    bool AttachStdin{};
+    bool AttachStdout{};
+    bool AttachStderr{};
+    std::vector<std::string> Cmd;
+    std::vector<std::string> Entrypoint; // TODO: Find a way to ommit if the caller wants the default entrypoint.
+    std::vector<std::string> Env;
+    std::map<std::string, EmptyObject> ExposedPorts;
+    HostConfig HostConfig;
+
+    NLOHMANN_DEFINE_TYPE_INTRUSIVE_ONLY_SERIALIZE(CreateContainer, Image, Cmd, Tty, OpenStdin, StdinOnce, Entrypoint, Env, ExposedPorts, HostConfig);
+};
+
+struct InspectContainer
+{
+    std::string Id;
+    std::string Name;
+    HostConfig HostConfig;
+
+    NLOHMANN_DEFINE_TYPE_INTRUSIVE_WITH_DEFAULT(InspectContainer, Id, Name, HostConfig);
+};
+
+struct Image
+{
+    std::string Id;
+    std::vector<std::string> RepoTags;
+    uint64_t Size;
+
+    NLOHMANN_DEFINE_TYPE_INTRUSIVE_WITH_DEFAULT(Image, Id, RepoTags, Size);
+};
+
+struct ImportStatus
+{
+    std::string status;
+
+    NLOHMANN_DEFINE_TYPE_INTRUSIVE_WITH_DEFAULT(ImportStatus, status);
+};
+
+struct CreateExecResponse
+{
+    std::string Id;
+    NLOHMANN_DEFINE_TYPE_INTRUSIVE_WITH_DEFAULT(CreateExecResponse, Id);
+};
+
+struct CreateExec
+{
+    using TResponse = CreateExecResponse;
+
+    bool AttachStdin;
+    bool AttachStdout;
+    bool AttachStderr;
+    bool Tty;
+    std::vector<ULONG> ConsoleSize;
+    std::vector<std::string> Cmd;
+    std::vector<std::string> Env;
+    std::string WorkingDir;
+
+    NLOHMANN_DEFINE_TYPE_INTRUSIVE_WITH_DEFAULT(CreateExec, AttachStdin, AttachStdout, AttachStderr, Tty, ConsoleSize, Cmd, Env, WorkingDir);
+};
+
+struct StartExec
+{
+    using TResponse = void;
+    bool Tty;
+    std::vector<ULONG> ConsoleSize;
+
+    NLOHMANN_DEFINE_TYPE_INTRUSIVE_ONLY_SERIALIZE(StartExec, Tty, ConsoleSize);
+};
+
+} // namespace wsl::windows::common::docker_schema
\ No newline at end of file
diff --git a/src/windows/wslaservice/exe/CMakeLists.txt b/src/windows/wslaservice/exe/CMakeLists.txt
index 34fdde509..a6efbba74 100644
--- a/src/windows/wslaservice/exe/CMakeLists.txt
+++ b/src/windows/wslaservice/exe/CMakeLists.txt
@@ -1,6 +1,8 @@
 set(SOURCES
     application.manifest
+    WSLAContainerProcess.cpp
     ContainerEventTracker.cpp
+    DockerHTTPClient.cpp
     main.rc
     ServiceMain.cpp
     ServiceProcessLauncher.cpp
@@ -14,6 +16,8 @@ set(SOURCES
 
 set(HEADERS
     ContainerEventTracker.h
+    WSLAContainerProcess.h
+    DockerHTTPClient.h
     ServiceProcessLauncher.h
     WSLAContainer.h
     WSLAProcess.h
@@ -41,4 +45,4 @@ target_link_libraries(wslaservice
                       Synchronization.lib)
 
 target_precompile_headers(wslaservice REUSE_FROM common)
-set_target_properties(wslaservice PROPERTIES FOLDER windows)
\ No newline at end of file
+set_target_properties(wslaservice PROPERTIES FOLDER windows)
diff --git a/src/windows/wslaservice/exe/ContainerEventTracker.cpp b/src/windows/wslaservice/exe/ContainerEventTracker.cpp
index e0a58d7dd..0cebf7ed4 100644
--- a/src/windows/wslaservice/exe/ContainerEventTracker.cpp
+++ b/src/windows/wslaservice/exe/ContainerEventTracker.cpp
@@ -17,6 +17,7 @@ Module Name:
 #include <nlohmann/json.hpp>
 
 using wsl::windows::service::wsla::ContainerEventTracker;
+using wsl::windows::service::wsla::DockerHTTPClient;
 using wsl::windows::service::wsla::WSLAVirtualMachine;
 
 ContainerEventTracker::ContainerTrackingReference::ContainerTrackingReference(ContainerEventTracker* tracker, size_t id) :
@@ -51,15 +52,12 @@ ContainerEventTracker::ContainerTrackingReference::~ContainerTrackingReference()
     Reset();
 }
 
-ContainerEventTracker::ContainerEventTracker(WSLAVirtualMachine& virtualMachine)
+ContainerEventTracker::ContainerEventTracker(DockerHTTPClient& dockerClient)
 {
-    ServiceProcessLauncher launcher{nerdctlPath, {nerdctlPath, "events", "--format", "{{json .}}"}, {}, common::ProcessFlags::Stdout};
+    auto socket = dockerClient.MonitorEvents();
+    m_thread = std::thread([socket = std::move(socket), this]() mutable { Run(std::move(socket)); }
 
-    // Redirect stderr to /dev/null to avoid pipe deadlocks.
-    launcher.AddFd({.Fd = 2, .Type = WSLAFdTypeLinuxFileOutput, .Path = "/dev/null"});
-
-    auto process = launcher.Launch(virtualMachine);
-    m_thread = std::thread(std::bind(&ContainerEventTracker::Run, this, std::move(process)));
+    );
 }
 
 void ContainerEventTracker::Stop()
@@ -83,75 +81,96 @@ ContainerEventTracker::~ContainerEventTracker()
 void ContainerEventTracker::OnEvent(const std::string& event)
 {
     // TODO: log session ID
-    WSL_LOG("NerdCtlEvent", TraceLoggingValue(event.c_str(), "Data"));
+    WSL_LOG("DockerEvent", TraceLoggingValue(event.c_str(), "Data"));
 
     static std::map<std::string, ContainerEvent> events{
-        {"/tasks/create", ContainerEvent::Create},
-        {"/tasks/start", ContainerEvent::Start},
-        {"/tasks/stop", ContainerEvent::Stop},
-        {"/tasks/exit", ContainerEvent::Exit},
-        {"/tasks/destroy", ContainerEvent::Destroy}};
+        {"start", ContainerEvent::Start}, {"die", ContainerEvent::Stop}, {"exec_die", ContainerEvent::ExecDied}};
 
     auto parsed = nlohmann::json::parse(event);
 
-    auto type = parsed.find("Topic");
-    auto details = parsed.find("Event");
+    auto type = parsed.find("Type");
+    auto action = parsed.find("Action");
+    auto actor = parsed.find("Actor");
 
-    THROW_HR_IF_MSG(E_INVALIDARG, type == parsed.end() || details == parsed.end(), "Failed to parse json: %hs", event.c_str());
+    THROW_HR_IF_MSG(
+        E_INVALIDARG, type == parsed.end() || action == parsed.end() || actor == parsed.end(), "Failed to parse json: %hs", event.c_str());
 
-    auto it = events.find(type->get<std::string>());
+    auto it = events.find(action->get<std::string>());
     if (it == events.end())
     {
         return; // Event is not tracked, dropped.
     }
 
-    // N.B. The 'Event' field is a json string.
-    auto innerEventJson = details->get<std::string>();
-    auto innerEvent = nlohmann::json::parse(innerEventJson);
+    auto id = actor->find("ID");
+    THROW_HR_IF_MSG(E_INVALIDARG, id == actor->end(), "Failed to parse json: %hs", event.c_str());
 
-    auto containerIdIt = innerEvent.find("container_id");
-    THROW_HR_IF_MSG(E_INVALIDARG, containerIdIt == innerEvent.end(), "Failed to parse json: %hs", innerEventJson.c_str());
+    auto containerId = id->get<std::string>();
+
+    std::optional<int> exitCode;
+    std::optional<std::string> execId;
+    auto attributes = actor->find("Attributes");
+    if (attributes != actor->end())
+    {
+        auto exitCodeEntry = attributes->find("exitCode");
+        if (exitCodeEntry != attributes->end())
+        {
+            exitCode = std::stoi(exitCodeEntry->get<std::string>());
+        }
+
+        auto execIdEntry = attributes->find("execID");
+        if (execIdEntry != attributes->end())
+        {
+            execId = execIdEntry->get<std::string>();
+        }
+    }
 
     std::lock_guard lock{m_lock};
 
-    std::string containerId = containerIdIt->get<std::string>();
     for (const auto& e : m_callbacks)
     {
-        if (e.ContainerId == containerId)
+        if (e.ContainerId == containerId && (!e.ExecId.has_value() || e.ExecId == execId))
         {
-            e.Callback(it->second);
+            e.Callback(it->second, exitCode);
         }
     }
 }
 
-void ContainerEventTracker::Run(ServiceRunningProcess& process)
+void ContainerEventTracker::Run(wil::unique_socket&& socket)
+try
 {
-    try
-    {
-        wsl::windows::common::relay::MultiHandleWait io;
+    wsl::windows::common::relay::MultiHandleWait io;
 
-        auto oneLineWritten = [&](const gsl::span<char>& buffer) {
-            // nerdctl events' output is line based. Call OnEvent() for each completed line.
+    auto oneLineWritten = [&](const gsl::span<char>& buffer) {
+        // nerdctl events' output is line based. Call OnEvent() for each completed line.
 
-            if (!buffer.empty()) // nerdctl inserts empty lines between events, skip those.
+        if (!buffer.empty()) // nerdctl inserts empty lines between events, skip those.
+        {
+            try
             {
                 OnEvent(std::string{buffer.begin(), buffer.end()});
             }
-        };
+            catch (...)
+            {
+                WSL_LOG(
+                    "DockerEventParseError",
+                    TraceLoggingValue(buffer.data(), "Data"),
+                    TraceLoggingValue(wil::ResultFromCaughtException(), "Error"));
+            }
+        }
+    };
 
-        auto onStop = [&]() { io.Cancel(); };
+    auto onStop = [&]() { io.Cancel(); };
 
-        io.AddHandle(std::make_unique<common::relay::LineBasedReadHandle>(process.GetStdHandle(1), std::move(oneLineWritten)));
-        io.AddHandle(std::make_unique<common::relay::EventHandle>(m_stopEvent.get(), std::move(onStop)));
+    io.AddHandle(std::make_unique<common::relay::HTTPChunkBasedReadHandle>(wil::unique_handle{(HANDLE)socket.release()}, std::move(oneLineWritten)));
+    io.AddHandle(std::make_unique<common::relay::EventHandle>(m_stopEvent.get(), std::move(onStop)));
 
-        if (io.Run({}))
-        {
-            // TODO: Report error to session.
-            WSL_LOG("Unexpected nerdctl exit");
-        }
+    if (io.Run({}))
+    {
+        // TODO: Report error to session.
+        WSL_LOG("Unexpected nerdctl exit");
     }
-    CATCH_LOG();
 }
+CATCH_LOG();
 
 ContainerEventTracker::ContainerTrackingReference ContainerEventTracker::RegisterContainerStateUpdates(
     const std::string& ContainerId, ContainerStateChangeCallback&& Callback)
@@ -159,7 +178,18 @@ ContainerEventTracker::ContainerTrackingReference ContainerEventTracker::Registe
     std::lock_guard lock{m_lock};
 
     auto id = m_callbackId++;
-    m_callbacks.emplace_back(id, ContainerId, std::move(Callback));
+    m_callbacks.emplace_back(id, ContainerId, std::optional<std::string>{}, std::move(Callback));
+
+    return ContainerTrackingReference{this, id};
+}
+
+ContainerEventTracker::ContainerTrackingReference ContainerEventTracker::RegisterExecStateUpdates(
+    const std::string& ContainerId, const std::string& ExecId, ContainerStateChangeCallback&& Callback)
+{
+    std::lock_guard lock{m_lock};
+
+    auto id = m_callbackId++;
+    m_callbacks.emplace_back(id, ContainerId, ExecId, std::move(Callback));
 
     return ContainerTrackingReference{this, id};
 }
diff --git a/src/windows/wslaservice/exe/ContainerEventTracker.h b/src/windows/wslaservice/exe/ContainerEventTracker.h
index 20ec0a777..cfca9a63a 100644
--- a/src/windows/wslaservice/exe/ContainerEventTracker.h
+++ b/src/windows/wslaservice/exe/ContainerEventTracker.h
@@ -13,7 +13,7 @@ Module Name:
 --*/
 #pragma once
 
-#include "ServiceProcessLauncher.h"
+#include "DockerHTTPClient.h"
 
 namespace wsl::windows::service::wsla {
 
@@ -25,7 +25,8 @@ enum class ContainerEvent
     Start,
     Stop,
     Exit,
-    Destroy
+    Destroy,
+    ExecDied
 };
 
 constexpr const char* nerdctlPath = "/usr/bin/nerdctl";
@@ -53,24 +54,26 @@ class ContainerEventTracker
         ContainerEventTracker* m_tracker = nullptr;
     };
 
-    using ContainerStateChangeCallback = std::function<void(ContainerEvent)>;
+    using ContainerStateChangeCallback = std::function<void(ContainerEvent, std::optional<int>)>;
 
-    ContainerEventTracker(WSLAVirtualMachine& virtualMachine);
+    ContainerEventTracker(DockerHTTPClient& dockerClient);
     ~ContainerEventTracker();
 
     void Stop();
 
     ContainerTrackingReference RegisterContainerStateUpdates(const std::string& ContainerId, ContainerStateChangeCallback&& Callback);
+    ContainerTrackingReference RegisterExecStateUpdates(const std::string& ContainerId, const std::string& ExecId, ContainerStateChangeCallback&& Callback);
     void UnregisterContainerStateUpdates(size_t Id);
 
 private:
     void OnEvent(const std::string& event);
-    void Run(ServiceRunningProcess& process);
+    void Run(wil::unique_socket&& Socket);
 
     struct Callback
     {
         size_t CallbackId;
         std::string ContainerId;
+        std::optional<std::string> ExecId;
         ContainerStateChangeCallback Callback;
     };
 
diff --git a/src/windows/wslaservice/exe/DockerHTTPClient.cpp b/src/windows/wslaservice/exe/DockerHTTPClient.cpp
new file mode 100644
index 000000000..ef70320a2
--- /dev/null
+++ b/src/windows/wslaservice/exe/DockerHTTPClient.cpp
@@ -0,0 +1,423 @@
+#include "precomp.h"
+
+#include "DockerHTTPClient.h"
+
+namespace http = boost::beast::http;
+using boost::beast::http::verb;
+using wsl::windows::common::relay::HandleWrapper;
+using wsl::windows::service::wsla::DockerHTTPClient;
+using namespace wsl::windows::common;
+
+DockerHTTPClient::DockerHTTPClient(wsl::shared::SocketChannel&& Channel, HANDLE exitingEvent, GUID VmId, ULONG ConnectTimeoutMs) :
+    m_exitingEvent(exitingEvent), m_channel(std::move(Channel)), m_vmId(VmId), m_connectTimeoutMs(ConnectTimeoutMs)
+{
+}
+
+uint32_t DockerHTTPClient::PullImage(const char* Name, const char* Tag, const OnImageProgress& Callback)
+{
+    auto [code, _] = SendRequest(
+        verb::post,
+        std::format("http://localhost/images/create?fromImage=library/{}&tag={}", Name, Tag),
+        {},
+        [Callback](const gsl::span<char>& span) { Callback(std::string{span.data(), span.size()}); });
+
+    return code;
+}
+
+std::unique_ptr<DockerHTTPClient::HTTPRequestContext> DockerHTTPClient::LoadImage(uint64_t ContentLength)
+{
+    return SendRequestImpl(
+        verb::post,
+        std::format("http://localhost/images/load"),
+        {},
+        {{http::field::content_type, "application/x-tar"}, {http::field::content_length, std::to_string(ContentLength)}});
+}
+
+std::unique_ptr<DockerHTTPClient::HTTPRequestContext> DockerHTTPClient::ImportImage(const std::string& Repo, const std::string& Tag, uint64_t ContentLength)
+{
+    return SendRequestImpl(
+        verb::post,
+        std::format("http://localhost/images/create?fromSrc=-&repo={}&tag={}", Repo, Tag),
+        {},
+        {{http::field::content_type, "application/x-tar"}, {http::field::content_length, std::to_string(ContentLength)}});
+}
+
+void DockerHTTPClient::TagImage(const std::string& Id, const std::string& Repo, const std::string& Tag)
+{
+    Transaction<docker_schema::EmtpyRequest>(verb::post, std::format("http://localhost/images/{}/tag?repo={}&tag={}", Id, Repo, Tag));
+}
+
+std::vector<docker_schema::Image> DockerHTTPClient::ListImages()
+{
+    return Transaction<docker_schema::EmtpyRequest, std::vector<docker_schema::Image>>(verb::get, "http://localhost/images/json");
+}
+
+docker_schema::CreatedContainer DockerHTTPClient::CreateContainer(const docker_schema::CreateContainer& Request)
+{
+    // TODO: Url escaping.
+    return Transaction<docker_schema::CreateContainer>(verb::post, "http://localhost/containers/create", Request);
+}
+
+void DockerHTTPClient::ResizeContainerTty(const std::string& Id, ULONG Rows, ULONG Columns)
+{
+    Transaction(verb::post, std::format("http://localhost/containers/{}/resize?w={}&h={}", Id, Columns, Rows));
+}
+
+void DockerHTTPClient::StartContainer(const std::string& Id)
+{
+    Transaction(verb::post, std::format("http://localhost/containers/{}/start", Id));
+}
+
+void DockerHTTPClient::StopContainer(const std::string& Id, int Signal, ULONG TimeoutSeconds)
+{
+    Transaction(verb::post, std::format("http://localhost/containers/{}/stop?signal={}&t={}", Id, Signal, TimeoutSeconds));
+}
+
+void DockerHTTPClient::SignalContainer(const std::string& Id, int Signal)
+{
+    Transaction(verb::post, std::format("http://localhost/containers/{}/kill?signal={}", Id, Signal));
+}
+
+void DockerHTTPClient::DeleteContainer(const std::string& Id)
+{
+    Transaction(verb::delete_, std::format("http://localhost/containers/{}", Id));
+}
+
+std::string DockerHTTPClient::InspectContainer(const std::string& Id)
+{
+    auto url = std::format("http://localhost/containers/{}/json", Id);
+    auto [code, response] = SendRequest(verb::get, url);
+
+    if (code < 200 || code >= 300)
+    {
+        throw DockerHTTPException(code, verb::get, url, "", response);
+    }
+
+    return response;
+}
+
+wil::unique_socket DockerHTTPClient::AttachContainer(const std::string& Id)
+{
+    std::map<boost::beast::http::field, std::string> headers{
+        {boost::beast::http::field::upgrade, "tcp"}, {boost::beast::http::field::connection, "upgrade"}};
+
+    auto url = std::format("http://localhost/containers/{}/attach?stream=1&stdin=1&stdout=1&stderr=1&logs=true", Id);
+    auto [status, socket] = SendRequest(verb::post, url, {}, {}, headers);
+
+    if (status != 101)
+    {
+        throw DockerHTTPException(status, verb::post, url, "", "");
+    }
+
+    return std::move(socket);
+}
+
+docker_schema::CreateExecResponse DockerHTTPClient::CreateExec(const std::string& Container, const docker_schema::CreateExec& Request)
+{
+    return Transaction<docker_schema::CreateExec>(verb::post, std::format("http://localhost/containers/{}/exec", Container), Request);
+}
+
+wil::unique_socket DockerHTTPClient::StartExec(const std::string& Id, const common::docker_schema::StartExec& Request)
+{
+    std::map<boost::beast::http::field, std::string> headers{
+        {boost::beast::http::field::upgrade, "tcp"}, {boost::beast::http::field::connection, "upgrade"}};
+
+    auto url = std::format("http://localhost/exec/{}/start", Id);
+
+    auto body = wsl::shared::ToJson(Request);
+    auto [status, socket] = SendRequest(verb::post, url, body, {}, headers);
+    if (status != 101)
+    {
+        throw DockerHTTPException(status, verb::post, url, body, "");
+    }
+    return std::move(socket);
+}
+
+void DockerHTTPClient::ResizeExecTty(const std::string& Id, ULONG Rows, ULONG Columns)
+{
+    Transaction(verb::post, std::format("http://localhost/exec/{}/resize?w={}&h={}", Id, Columns, Rows));
+}
+
+wil::unique_socket DockerHTTPClient::MonitorEvents()
+{
+    auto url = "http://localhost/events";
+    auto [status, socket] = SendRequest(verb::get, url, {}, {});
+
+    if (status != 200)
+    {
+        throw DockerHTTPException(status, verb::get, url, "", "");
+    }
+
+    return std::move(socket);
+}
+
+wil::unique_socket DockerHTTPClient::ConnectSocket()
+{
+    auto lock = m_lock.lock_exclusive();
+
+    // Send a fork message.
+    WSLA_FORK message;
+    message.ForkType = WSLA_FORK::Thread;
+    const auto& response = m_channel.Transaction(message);
+
+    THROW_HR_IF_MSG(E_FAIL, response.Pid <= 0, "fork() returned %i", response.Pid);
+
+    // Connect the new hvsocket.
+    wsl::shared::SocketChannel newChannel{
+        wsl::windows::common::hvsocket::Connect(m_vmId, response.Port, m_exitingEvent, m_connectTimeoutMs), "DockerClient", m_exitingEvent};
+    lock.reset();
+
+    // Connect that socket to the docker unix socket.
+    shared::MessageWriter<WSLA_UNIX_CONNECT> writer;
+    writer.WriteString(writer->PathOffset, "/var/run/docker.sock");
+
+    auto result = newChannel.Transaction<WSLA_UNIX_CONNECT>(writer.Span());
+    THROW_HR_IF_MSG(E_FAIL, result.Result < 0, "Failed to connect to unix socket: '/var/run/docker.sock', %i", result.Result);
+
+    return newChannel.Release();
+}
+
+std::pair<uint32_t, std::string> DockerHTTPClient::SendRequest(verb Method, const std::string& Url, const std::string& Body)
+{
+    std::string responseBody;
+    auto OnResponse = [&responseBody](const gsl::span<char>& span) { responseBody.append(span.data(), span.size()); };
+
+    auto [status, _] = SendRequest(Method, Url, Body, OnResponse);
+
+    return {status, std::move(responseBody)};
+}
+
+DockerHTTPClient::DockerHttpResponseHandle::DockerHttpResponseHandle(
+    HTTPRequestContext& context,
+    std::function<void(const http::message<false, http::buffer_body>&)>&& onResponseHeader,
+    std::function<void(const gsl::span<char>&)>&& onResponseBytes,
+    std::function<void()>&& onCompleted) :
+    common::relay::ReadHandle(
+        HandleWrapper{context.stream.native_handle()}, std::bind(&DockerHttpResponseHandle::OnRead, this, std::placeholders::_1)),
+    Context(context),
+    OnResponseHeader(std::move(onResponseHeader)),
+    OnResponse(std::move(onResponseBytes)),
+    OnCompleted(std::move(onCompleted))
+{
+}
+
+DockerHTTPClient::DockerHttpResponseHandle::~DockerHttpResponseHandle()
+{
+    if (State == common::relay::IOHandleStatus::Completed)
+    {
+        OnCompleted();
+    }
+}
+
+void DockerHTTPClient::DockerHttpResponseHandle::OnRead(const gsl::span<char>& Content)
+{
+    // If the HTTP parser is done, then these bytes are part of the response body
+    if (Parser.is_header_done())
+    {
+        OnResponseBytes(Content);
+    }
+    else
+    {
+        // Otherwise keep parsing the HTTP response header.
+        size_t i{};
+        for (i = 0; i < Content.size() && LineFeeds < 2; i++)
+        {
+            if (Content[i] == '\n')
+            {
+                LineFeeds++;
+            }
+            else if (Content[i] != '\r')
+            {
+                LineFeeds = 0;
+            }
+        }
+
+        // Feed the parser up to the end of the heaer.
+        boost::beast::error_code error;
+        Parser.put(boost::asio::buffer(Content.data(), i), error);
+
+        THROW_HR_IF_MSG(
+            E_UNEXPECTED, error && error != boost::beast::http::error::need_more, "Error parsing HTTP response: %hs", error.what().c_str());
+
+        if (Parser.is_header_done())
+        {
+            const auto& response = Parser.get();
+            OnResponseHeader(response);
+
+            // If the response is chunked, then create a chunked reader.
+            // TODO: Proper header parsing.
+            auto transferEncoding = response.find(http::field::transfer_encoding);
+            if (transferEncoding != response.end() && transferEncoding->value() == "chunked")
+            {
+                ResponseParser.emplace(HandleWrapper{Context.stream.native_handle()}, std::move(OnResponse));
+            }
+
+            auto contentLength = response.find(http::field::content_length);
+            if (contentLength != response.end())
+            {
+                RemainingContentLength = std::stoul(contentLength->value());
+            }
+        }
+
+        // If any buffer remains, then it's part of the response body.
+        auto remaining = Content.subspan(i);
+        if (!remaining.empty())
+        {
+            WI_ASSERT(Parser.is_header_done());
+            OnResponseBytes(remaining);
+        }
+    }
+}
+
+void DockerHTTPClient::DockerHttpResponseHandle::OnResponseBytes(const gsl::span<char>& Content)
+{
+    auto span = Content;
+
+    // If the HTTP response had a Content-Length, make sure not to read past it.
+    if (RemainingContentLength.has_value())
+    {
+        auto consume = std::min(span.size(), RemainingContentLength.value());
+
+        *RemainingContentLength -= consume;
+        if (*RemainingContentLength == 0)
+        {
+            State = common::relay::IOHandleStatus::Completed;
+        }
+
+        span = span.subspan(0, consume);
+    }
+
+    if (ResponseParser.has_value())
+    {
+        ResponseParser->OnRead(span);
+    }
+    else
+    {
+        OnResponse(span);
+    }
+}
+
+std::unique_ptr<DockerHTTPClient::HTTPRequestContext> DockerHTTPClient::SendRequestImpl(
+    verb Method, const std::string& Url, const std::string& Body, const std::map<boost::beast::http::field, std::string>& Headers)
+{
+    auto context = std::make_unique<DockerHTTPClient::HTTPRequestContext>(ConnectSocket());
+
+    http::request<http::string_body> req{Method, Url, 11};
+    if (!Body.empty())
+    {
+        req.set(http::field::content_type, "application/json");
+        req.body() = Body;
+
+        // N.B. prepare_payload() overrides content-length.
+        req.prepare_payload();
+    }
+
+    req.set(http::field::host, "localhost");
+    req.set(http::field::connection, "close");
+    req.set(http::field::accept, "application/json");
+
+    for (const auto [field, value] : Headers)
+    {
+        req.set(field, value);
+    }
+
+    http::write(context->stream, req);
+
+#ifdef WSLA_HTTP_DEBUG
+
+    std::ostringstream oss;
+    oss << req;
+
+    auto requestString = oss.str();
+
+    WSL_LOG("HTTPRequestDebug", TraceLoggingValue(Url.c_str(), "Url"), TraceLoggingValue(requestString.c_str(), "Request"));
+
+#endif
+
+    return std::move(context);
+}
+
+std::pair<uint32_t, wil::unique_socket> DockerHTTPClient::SendRequest(
+    verb Method,
+    const std::string& Url,
+    const std::string& Body,
+    const OnResponseBytes& OnResponse,
+    const std::map<boost::beast::http::field, std::string>& Headers)
+{
+    // Write the request
+    auto context = SendRequestImpl(Method, Url, Body, Headers);
+
+    // Parse the response header
+    constexpr auto bufferSize = 4096;
+    size_t Offset = 0;
+    std::vector<char> buffer;
+    http::response_parser<http::buffer_body> parser;
+    parser.eager(false);
+    parser.skip(false);
+
+    size_t lineFeeds = 0;
+    // Consume the socket until the header end is reached
+    while (!parser.is_header_done())
+    {
+        buffer.resize(Offset + bufferSize);
+
+        // Peek for the end of the HTTP header '\r\n'
+        auto bytesRead = common::socket::Receive(
+            context->stream.native_handle(), gsl::span(reinterpret_cast<gsl::byte*>(buffer.data() + Offset), bufferSize), m_exitingEvent, MSG_PEEK);
+
+        THROW_HR_IF(E_ABORT, bytesRead == 0);
+
+        size_t i{};
+        for (i = 0; i < bytesRead + Offset && lineFeeds < 2; i++)
+        {
+            if (buffer[i] == '\n')
+            {
+                lineFeeds++;
+            }
+            else if (buffer[i] != '\r')
+            {
+                lineFeeds = 0;
+            }
+        }
+
+        // Consumme the buffer from the socket.
+        bytesRead = common::socket::Receive(
+            context->stream.native_handle(), gsl::span(reinterpret_cast<gsl::byte*>(buffer.data() + Offset), i - Offset), m_exitingEvent);
+        WI_ASSERT(bytesRead == i - Offset);
+
+        Offset += bytesRead;
+        buffer.resize(Offset);
+
+        if (lineFeeds == 2) // Header is complete, feed it to the parser.
+        {
+            boost::beast::error_code error;
+            parser.put(boost::asio::buffer(buffer.data(), buffer.size()), error);
+
+            THROW_HR_IF_MSG(
+                E_UNEXPECTED,
+                error && error != boost::beast::http::error::need_more,
+                "Error parsing HTTP response: %hs",
+                error.what().c_str());
+        }
+    }
+
+    WSL_LOG("HTTPResult", TraceLoggingValue(Url.c_str(), "Url"), TraceLoggingValue(parser.get().result_int(), "Status"));
+
+    if (OnResponse)
+    {
+        while (!parser.is_done())
+        {
+            boost::beast::flat_buffer adapter;
+
+            parser.get().body().data = buffer.data();
+            parser.get().body().size = buffer.size();
+            http::read(context->stream, adapter, parser);
+
+            auto bytesRead = buffer.size() - parser.get().body().size;
+
+            OnResponse(gsl::span<char>{buffer.data(), bytesRead});
+        }
+    }
+
+    return {parser.get().result_int(), wil::unique_socket{context->stream.release()}};
+}
diff --git a/src/windows/wslaservice/exe/DockerHTTPClient.h b/src/windows/wslaservice/exe/DockerHTTPClient.h
new file mode 100644
index 000000000..3aaa52cd4
--- /dev/null
+++ b/src/windows/wslaservice/exe/DockerHTTPClient.h
@@ -0,0 +1,163 @@
+#pragma once
+
+#include <boost/asio.hpp>
+#include <boost/asio/generic/stream_protocol.hpp>
+#include <boost/beast/core.hpp>
+#include <boost/beast/http.hpp>
+#include "relay.hpp"
+#include "docker_schema.h"
+
+namespace wsl::windows::service::wsla {
+
+class DockerHTTPException : public std::runtime_error
+{
+public:
+    DockerHTTPException(uint16_t StatusCode, boost::beast::http::verb Method, const std::string& Url, const std::string& RequestContent, const std::string& ResponseContent) :
+        std::runtime_error(std::format(
+            "HTTP request failed: {} {} -> {} (Request: {}, Response: {})", boost::beast::http::to_string(Method), Url, StatusCode, RequestContent, ResponseContent)),
+        m_statusCode(StatusCode),
+        m_url(Url),
+        m_request(RequestContent),
+        m_response(ResponseContent)
+    {
+    }
+
+    template <typename T = docker_schema::ErrorResponse>
+    T DockerMessage()
+    {
+        return wsl::shared::FromJson<T>(m_response.c_str());
+    }
+
+    uint16_t StatusCode() const noexcept
+    {
+        return m_statusCode;
+    }
+
+private:
+    uint16_t m_statusCode{};
+    std::string m_url;
+    std::string m_request;
+    std::string m_response;
+};
+
+class DockerHTTPClient
+{
+    NON_COPYABLE(DockerHTTPClient);
+
+public:
+    using OnResponseBytes = std::function<void(gsl::span<char>)>;
+    using OnImageProgress = std::function<void(const std::string&)>;
+
+    struct HTTPRequestContext
+    {
+        NON_COPYABLE(HTTPRequestContext);
+        NON_MOVABLE(HTTPRequestContext);
+
+        HTTPRequestContext(wil::unique_socket&& Socket) : stream(context)
+        {
+            boost::asio::generic::stream_protocol hv_proto(AF_HYPERV, SOCK_STREAM);
+            stream.assign(hv_proto, Socket.release());
+        }
+
+        boost::asio::io_context context;
+        boost::asio::generic::stream_protocol::socket stream;
+    };
+
+    DockerHTTPClient(wsl::shared::SocketChannel&& Channel, HANDLE ExitingEvent, GUID VmId, ULONG ConnectTimeoutMs);
+
+    // Container management.
+    common::docker_schema::CreatedContainer CreateContainer(const common::docker_schema::CreateContainer& Request);
+    void StartContainer(const std::string& Id);
+    void StopContainer(const std::string& Id, int Signal, ULONG TimeoutSeconds);
+    void DeleteContainer(const std::string& Id);
+    void SignalContainer(const std::string& Id, int Signal);
+    std::string InspectContainer(const std::string& Id);
+    wil::unique_socket AttachContainer(const std::string& Id);
+    void ResizeContainerTty(const std::string& Id, ULONG Rows, ULONG Columns);
+
+    // Image management.
+    uint32_t PullImage(const char* Name, const char* Tag, const OnImageProgress& Callback);
+    std::unique_ptr<HTTPRequestContext> ImportImage(const std::string& Repo, const std::string& Tag, uint64_t ContentLength);
+    std::unique_ptr<HTTPRequestContext> LoadImage(uint64_t ContentLength);
+    void TagImage(const std::string& Id, const std::string& Repo, const std::string& Tag);
+    std::vector<common::docker_schema::Image> ListImages();
+
+    // Exec.
+    common::docker_schema::CreateExecResponse CreateExec(const std::string& Container, const common::docker_schema::CreateExec& Request);
+    wil::unique_socket StartExec(const std::string& Id, const common::docker_schema::StartExec& Request);
+    void ResizeExecTty(const std::string& Id, ULONG Rows, ULONG Columns);
+
+    wil::unique_socket MonitorEvents();
+
+    struct DockerHttpResponseHandle : public common::relay::ReadHandle
+    {
+        NON_COPYABLE(DockerHttpResponseHandle);
+        NON_MOVABLE(DockerHttpResponseHandle);
+
+        DockerHttpResponseHandle(
+            HTTPRequestContext& context,
+            std::function<void(const boost::beast::http::message<false, boost::beast::http::buffer_body>&)>&& OnResponseHeader,
+            std::function<void(const gsl::span<char>&)>&& OnResponseBytes,
+            std::function<void()>&& OnCompleted);
+
+        ~DockerHttpResponseHandle();
+
+    private:
+        void OnRead(const gsl::span<char>& Content);
+        void OnResponseBytes(const gsl::span<char>& Content);
+
+        HTTPRequestContext& Context;
+        std::function<void(const boost::beast::http::message<false, boost::beast::http::buffer_body>&)> OnResponseHeader;
+        std::function<void(const gsl::span<char>&)> OnResponse;
+        std::function<void()> OnCompleted;
+        boost::beast::http::response_parser<boost::beast::http::buffer_body> Parser;
+        size_t LineFeeds = 0;
+        std::optional<size_t> RemainingContentLength;
+        std::optional<common::relay::HTTPChunkBasedReadHandle> ResponseParser;
+    };
+
+private:
+    wil::unique_socket ConnectSocket();
+
+    std::unique_ptr<HTTPRequestContext> SendRequestImpl(
+        boost::beast::http::verb Method, const std::string& Url, const std::string& Body, const std::map<boost::beast::http::field, std::string>& Headers);
+
+    std::pair<uint32_t, std::string> SendRequest(
+        boost::beast::http::verb Method, const std::string& Url, const std::string& Body = "");
+
+    std::pair<uint32_t, wil::unique_socket> SendRequest(
+        boost::beast::http::verb Method,
+        const std::string& Url,
+        const std::string& Body,
+        const OnResponseBytes& OnResponse,
+        const std::map<boost::beast::http::field, std::string>& Headers = {});
+
+    template <typename TRequest = common::docker_schema::EmtpyRequest, typename TResponse = TRequest::TResponse>
+    auto Transaction(boost::beast::http::verb Method, const std::string& Url, const TRequest& RequestObject = {})
+    {
+        std::string requestString;
+        if constexpr (!std::is_same_v<TRequest, common::docker_schema::EmtpyRequest>)
+        {
+            requestString = wsl::shared::ToJson(RequestObject);
+        }
+
+        auto [statusCode, responseString] = SendRequest(Method, Url, requestString);
+
+        if (statusCode < 200 || statusCode >= 300)
+        {
+            throw DockerHTTPException(statusCode, Method, Url, requestString, responseString);
+        }
+
+        if constexpr (!std::is_same_v<TResponse, void>)
+        {
+            return wsl::shared::FromJson<TResponse>(responseString.c_str());
+        }
+    }
+
+    ULONG m_connectTimeoutMs{};
+    GUID m_vmId;
+    shared::SocketChannel m_channel;
+    HANDLE m_exitingEvent;
+    wil::srwlock m_lock;
+};
+} // namespace wsl::windows::service::wsla
\ No newline at end of file
diff --git a/src/windows/wslaservice/exe/WSLAContainer.cpp b/src/windows/wslaservice/exe/WSLAContainer.cpp
index e42808302..b1d0b3a8b 100644
--- a/src/windows/wslaservice/exe/WSLAContainer.cpp
+++ b/src/windows/wslaservice/exe/WSLAContainer.cpp
@@ -21,6 +21,8 @@ using wsl::windows::service::wsla::WSLAContainer;
 using wsl::windows::service::wsla::WSLAContainerImpl;
 using wsl::windows::service::wsla::WSLAVirtualMachine;
 
+using namespace wsl::windows::common::docker_schema;
+
 // Constants for required default arguments for "nerdctl create..."
 static std::vector<std::string> defaultNerdctlCreateArgs{//"--pull=never", // TODO: Uncomment once PullImage() is implemented.
                                                          "--ulimit",
@@ -32,7 +34,7 @@ namespace {
 
 // TODO: Determine when ports should be mapped and unmapped (at container creation, start, stop or delete).
 
-auto ProcessPortMappings(const WSLA_CONTAINER_OPTIONS& options, WSLAVirtualMachine& vm, std::vector<std::string>& args)
+auto ProcessPortMappings(const WSLA_CONTAINER_OPTIONS& options, WSLAVirtualMachine& vm)
 {
     THROW_HR_IF_MSG(
         E_INVALIDARG,
@@ -122,9 +124,6 @@ auto ProcessPortMappings(const WSLA_CONTAINER_OPTIONS& options, WSLAVirtualMachi
     {
         THROW_IF_FAILED(vm.MapPort(e.Family, e.HostPort, e.VmPort, false));
         e.MappedToHost = true;
-
-        args.push_back("-p");
-        args.push_back(std::format("{}{}:{}", e.Family == AF_INET6 ? "[::]:" : "", e.VmPort, e.ContainerPort));
     }
 
     return std::make_pair(std::move(mappedPorts), std::move(errorCleanup));
@@ -138,21 +137,27 @@ WSLAContainerImpl::WSLAContainerImpl(
     WSLAVirtualMachine* parentVM,
     const WSLA_CONTAINER_OPTIONS& Options,
     std::string&& Id,
-    ContainerEventTracker& tracker,
     std::vector<VolumeMountInfo>&& volumes,
     std::vector<PortMapping>&& ports,
-    std::function<void(const WSLAContainerImpl*)>&& onDeleted) :
+    std::function<void(const WSLAContainerImpl*)>&& onDeleted,
+    ContainerEventTracker& EventTracker,
+    DockerHTTPClient& DockerClient) :
     m_parentVM(parentVM),
     m_name(Options.Name),
     m_image(Options.Image),
     m_id(std::move(Id)),
     m_mountedVolumes(std::move(volumes)),
     m_mappedPorts(std::move(ports)),
-    m_comWrapper(wil::MakeOrThrow<WSLAContainer>(this, std::move(onDeleted)))
+    m_comWrapper(wil::MakeOrThrow<WSLAContainer>(this, std::move(onDeleted))),
+    m_dockerClient(DockerClient),
+    m_eventTracker(EventTracker),
+    m_containerEvents(EventTracker.RegisterContainerStateUpdates(
+        m_id, std::bind(&WSLAContainerImpl::OnEvent, this, std::placeholders::_1, std::placeholders::_2)))
 {
     m_state = WslaContainerStateCreated;
 
-    m_trackingReference = tracker.RegisterContainerStateUpdates(m_id, std::bind(&WSLAContainerImpl::OnEvent, this, std::placeholders::_1));
+    // TODO: Move this to an API flag.
+    m_tty = ParseFdStatus(Options.InitProcessOptions).second;
 }
 
 WSLAContainerImpl::~WSLAContainerImpl()
@@ -163,6 +168,8 @@ WSLAContainerImpl::~WSLAContainerImpl()
         TraceLoggingValue(m_id.c_str(), "Id"),
         TraceLoggingValue((int)m_state, "State"));
 
+    m_containerEvents.Reset();
+
     // Disconnect from the COM instance. After this returns, no COM calls can be made to this instance.
     m_comWrapper->Disconnect();
 
@@ -179,8 +186,6 @@ WSLAContainerImpl::~WSLAContainerImpl()
         CATCH_LOG();
     }
 
-    m_trackingReference.Reset();
-
     // Release port mappings.
     std::set<uint16_t> allocatedGuestPorts;
     for (const auto& e : m_mappedPorts)
@@ -210,7 +215,7 @@ IWSLAContainer& WSLAContainerImpl::ComWrapper()
     return *m_comWrapper.Get();
 }
 
-void WSLAContainerImpl::Start(const WSLA_CONTAINER_OPTIONS& Options)
+void WSLAContainerImpl::Start()
 {
     std::lock_guard<std::recursive_mutex> lock(m_lock);
 
@@ -221,43 +226,29 @@ void WSLAContainerImpl::Start(const WSLA_CONTAINER_OPTIONS& Options)
         m_name.c_str(),
         m_state);
 
-    ServiceProcessLauncher launcher(nerdctlPath, {nerdctlPath, "start", "-a", m_id}, defaultNerdctlEnv, common::ProcessFlags::None);
-    for (auto i = 0; i < Options.InitProcessOptions.FdsCount; i++)
-    {
-        launcher.AddFd(Options.InitProcessOptions.Fds[i]);
-    }
+    // Attach to the container's init process so no IO is lost.
+    m_initProcess = wil::MakeOrThrow<WSLAContainerProcess>(m_id, m_tty, m_dockerClient, std::optional<std::string>{}, m_eventTracker);
 
-    m_containerProcess = launcher.Launch(*m_parentVM);
+    m_initProcess->AssignIoStream(wil::unique_handle{(HANDLE)m_dockerClient.AttachContainer(m_id).release()});
 
-    auto cleanup = wil::scope_exit([&]() { m_containerProcess.reset(); });
+    auto cleanup = wil::scope_exit_log(WI_DIAGNOSTICS_INFO, [this]() mutable { m_initProcess.Reset(); });
 
-    // Wait for either the container to get into a 'started' state, or the nerdctl process to exit.
-    common::relay::MultiHandleWait wait;
-    wait.AddHandle(std::make_unique<common::relay::EventHandle>(m_containerProcess->GetExitEvent(), [&]() { wait.Cancel(); }));
-    wait.AddHandle(std::make_unique<common::relay::EventHandle>(m_startedEvent.get(), [&]() { wait.Cancel(); }));
-    wait.Run({});
-
-    if (!m_startedEvent.is_signaled())
-    {
-        auto status = GetNerdctlStatus();
-
-        THROW_HR_IF_MSG(
-            E_FAIL,
-            status != "exited",
-            "Failed to start container %hs, nerdctl status: %hs",
-            m_name.c_str(),
-            status.value_or("<empty>").c_str());
-    }
+    m_dockerClient.StartContainer(m_id);
 
-    cleanup.release();
     m_state = WslaContainerStateRunning;
+    cleanup.release();
 }
 
-void WSLAContainerImpl::OnEvent(ContainerEvent event)
+void WSLAContainerImpl::OnEvent(ContainerEvent event, std::optional<int> exitCode)
 {
-    if (event == ContainerEvent::Start)
+    if (event == ContainerEvent::Stop)
     {
-        m_startedEvent.SetEvent();
+        THROW_HR_IF(E_UNEXPECTED, !exitCode.has_value());
+
+        std::lock_guard<std::recursive_mutex> lock(m_lock);
+        m_state = WslaContainerStateExited;
+
+        m_initProcess->OnExited(exitCode.value());
     }
 
     WSL_LOG(
@@ -276,30 +267,25 @@ void WSLAContainerImpl::Stop(int Signal, ULONG TimeoutMs)
         return;
     }
 
-    /* 'nerdctl stop ...'
-     *   returns success and <containerId> on stdout if the container is running or already stopped
-     *   returns error "No such container: <containerId>" on stderr if the container is in 'Created' state or does not exist
-     *
-     * For our case, we treat stopping an already-exited container as a no-op and return success.
-     * Stopping a deleted or created container returns ERROR_INVALID_STATE.
-     * TODO: Discuss and return stdout/stderr or corresponding HRESULT from nerdctl stop for better diagnostics.
-     */
-
-    // Validate that the container is in the running state.
-    THROW_HR_IF_MSG(
-        HRESULT_FROM_WIN32(ERROR_INVALID_STATE),
-        m_state != WslaContainerStateRunning,
-        "Container '%hs' is not in a stoppable state: %i",
-        m_name.c_str(),
-        m_state);
-    ServiceProcessLauncher launcher(
-        nerdctlPath, {nerdctlPath, "stop", m_name, "--time", std::to_string(static_cast<ULONG>(std::round(TimeoutMs / 1000)))}, defaultNerdctlEnv);
+    try
+    {
+        m_dockerClient.StopContainer(m_id, Signal, static_cast<ULONG>(std::round<ULONG>(TimeoutMs / 1000)));
+    }
+    catch (const DockerHTTPException& e)
+    {
+        // HTTP 304 is returned when the container is already stopped.
+        if (e.StatusCode() == 304)
+        {
+            return;
+        }
 
-    // TODO: Figure out how we want to handle custom signals.
-    // nerdctl stop has a --time and a --signal option that can be used
-    // By default, it uses SIGTERM and a default timeout of 10 seconds.
-    auto result = launcher.Launch(*m_parentVM).WaitAndCaptureOutput();
-    THROW_HR_IF_MSG(E_FAIL, result.Code != 0, "%hs", launcher.FormatResult(result).c_str());
+        WSL_LOG(
+            "StopContainerFailed",
+            TraceLoggingValue(m_name.c_str(), "Name"),
+            TraceLoggingValue(m_id.c_str(), "Id"),
+            TraceLoggingValue(e.what(), "Error"));
+        throw;
+    }
 
     m_state = WslaContainerStateExited;
 }
@@ -316,9 +302,7 @@ void WSLAContainerImpl::Delete()
         m_name.c_str(),
         m_state);
 
-    ServiceProcessLauncher launcher(nerdctlPath, {nerdctlPath, "rm", "-f", m_name}, defaultNerdctlEnv);
-    auto result = launcher.Launch(*m_parentVM).WaitAndCaptureOutput(deleteTimeout);
-    THROW_HR_IF_MSG(E_FAIL, result.Code != 0, "%hs", launcher.FormatResult(result).c_str());
+    m_dockerClient.DeleteContainer(m_id);
 
     UnmountVolumes(m_mountedVolumes, *m_parentVM);
 
@@ -330,10 +314,10 @@ WSLA_CONTAINER_STATE WSLAContainerImpl::State() noexcept
     std::lock_guard<std::recursive_mutex> lock(m_lock);
 
     // If the container is running, refresh the init process state before returning.
-    if (m_state == WslaContainerStateRunning && m_containerProcess->State() != WSLAProcessStateRunning)
+    if (m_state == WslaContainerStateRunning && m_initProcess->State().first != WSLAProcessStateRunning)
     {
         m_state = WslaContainerStateExited;
-        m_containerProcess.reset();
+        // m_containerProcess.reset();
     }
 
     return m_state;
@@ -348,8 +332,8 @@ void WSLAContainerImpl::GetInitProcess(IWSLAProcess** Process)
 {
     std::lock_guard<std::recursive_mutex> lock(m_lock);
 
-    THROW_HR_IF(HRESULT_FROM_WIN32(ERROR_INVALID_STATE), !m_containerProcess.has_value());
-    THROW_IF_FAILED(m_containerProcess->Get().QueryInterface(__uuidof(IWSLAProcess), (void**)Process));
+    THROW_HR_IF(HRESULT_FROM_WIN32(ERROR_INVALID_STATE), !m_initProcess);
+    THROW_IF_FAILED(m_initProcess.CopyTo(__uuidof(IWSLAProcess), (void**)Process));
 }
 
 void WSLAContainerImpl::Exec(const WSLA_PROCESS_OPTIONS* Options, IWSLAProcess** Process, int* Errno)
@@ -367,39 +351,41 @@ void WSLAContainerImpl::Exec(const WSLA_PROCESS_OPTIONS* Options, IWSLAProcess**
 
     auto [hasStdin, hasTty] = ParseFdStatus(*Options);
 
-    std::vector<std::string> args{nerdctlPath, "exec"};
-
-    if (hasStdin)
+    common::docker_schema::CreateExec request;
+    for (ULONG i = 0; i < Options->CommandLineCount; i++)
     {
-        args.push_back("-i");
+        request.Cmd.push_back(Options->CommandLine[i]);
     }
 
-    if (hasTty)
+    for (ULONG i = 0; i < Options->EnvironmentCount; i++)
     {
-        args.push_back("-t");
+        request.Env.push_back(Options->Environment[i]);
     }
 
-    AddEnvironmentVariables(args, *Options);
-
-    args.emplace_back(m_id);
-
-    for (ULONG i = 0; i < Options->CommandLineCount; i++)
+    if (Options->CurrentDirectory != nullptr)
     {
-        args.emplace_back(Options->CommandLine[i]);
+        request.WorkingDir = Options->CurrentDirectory;
     }
 
-    ServiceProcessLauncher launcher(nerdctlPath, args, defaultNerdctlEnv, common::ProcessFlags::None);
-    for (auto i = 0; i < Options->FdsCount; i++)
+    try
     {
-        launcher.AddFd(Options->Fds[i]);
-    }
+        auto result = m_dockerClient.CreateExec(m_id, request);
+
+        // N.B. There's no way to delete a created exec instance, it is removed when the container is deleted.
+
+        auto process = wil::MakeOrThrow<WSLAContainerProcess>(result.Id, hasTty, m_dockerClient, m_id, m_eventTracker);
 
-    std::optional<ServiceRunningProcess> process;
-    HRESULT result = E_FAIL;
-    std::tie(result, *Errno, process) = launcher.LaunchNoThrow(*m_parentVM);
-    THROW_IF_FAILED(result);
+        process->AssignIoStream(wil::unique_handle{
+            (HANDLE)m_dockerClient
+                .StartExec(result.Id, common::docker_schema::StartExec{.Tty = hasTty, .ConsoleSize = request.ConsoleSize})
+                .release()});
 
-    THROW_IF_FAILED(process->Get().QueryInterface(__uuidof(IWSLAProcess), (void**)Process));
+        THROW_IF_FAILED(process.CopyTo(__uuidof(IWSLAProcess), (void**)Process));
+    }
+    catch (DockerHTTPException& e)
+    {
+        THROW_HR_MSG(E_FAIL, "Failed to exec process in container %hs: %hs", m_id.c_str(), e.what());
+    }
 }
 
 std::pair<bool, bool> WSLAContainerImpl::ParseFdStatus(const WSLA_PROCESS_OPTIONS& Options)
@@ -447,7 +433,7 @@ std::vector<VolumeMountInfo> wsl::windows::service::wsla::WSLAContainerImpl::Mou
             auto result = parentVM.MountWindowsFolder(volume.HostPath, parentVMPath.c_str(), volume.ReadOnly);
             THROW_IF_FAILED_MSG(result, "Failed to mount %ls -> %hs", volume.HostPath, parentVMPath.c_str());
 
-            mountedVolumes.push_back(VolumeMountInfo{volume.HostPath, parentVMPath, volume.ContainerPath, volume.ReadOnly});
+            mountedVolumes.push_back(VolumeMountInfo{volume.HostPath, parentVMPath, volume.ContainerPath, static_cast<bool>(volume.ReadOnly)});
         }
         catch (...)
         {
@@ -471,150 +457,123 @@ void wsl::windows::service::wsla::WSLAContainerImpl::UnmountVolumes(const std::v
 std::unique_ptr<WSLAContainerImpl> WSLAContainerImpl::Create(
     const WSLA_CONTAINER_OPTIONS& containerOptions,
     WSLAVirtualMachine& parentVM,
-    ContainerEventTracker& eventTracker,
-    std::function<void(const WSLAContainerImpl*)>&& OnDeleted)
+    std::function<void(const WSLAContainerImpl*)>&& OnDeleted,
+    ContainerEventTracker& EventTracker,
+    DockerHTTPClient& DockerClient)
 {
+    // TODO: Think about when 'StdinOnce' should be set.
     auto [hasStdin, hasTty] = ParseFdStatus(containerOptions.InitProcessOptions);
 
-    // Don't support stdin for now since it will hang.
-    // TODO: Remove once stdin is fixed in nerdctl.
-    THROW_HR_IF(HRESULT_FROM_WIN32(ERROR_NOT_SUPPORTED), hasStdin && !hasTty);
+    common::docker_schema::CreateContainer request;
+    request.Image = containerOptions.Image;
 
-    std::vector<std::string> inputOptions;
-    if (hasStdin)
+    if (hasTty)
     {
-        inputOptions.push_back("-i");
+        request.Tty = true;
     }
 
-    if (hasTty)
+    if (hasStdin)
     {
-        inputOptions.push_back("-t");
+        request.OpenStdin = true;
+        request.StdinOnce = true;
     }
 
-    AddEnvironmentVariables(inputOptions, containerOptions.InitProcessOptions);
-
-    // TODO: Rethink command line generation logic.
-    auto [mappedPorts, errorCleanup] = ProcessPortMappings(containerOptions, parentVM, inputOptions);
-
-    auto volumes = MountVolumes(containerOptions, parentVM);
-    auto args = PrepareNerdctlCreateCommand(containerOptions, std::move(inputOptions), volumes);
-
-    ServiceProcessLauncher launcher(nerdctlPath, args, defaultNerdctlEnv);
-    auto result = launcher.Launch(parentVM).WaitAndCaptureOutput();
-
-    // TODO: Have better error codes.
-    THROW_HR_IF_MSG(E_FAIL, result.Code != 0, "Failed to create container: %hs", launcher.FormatResult(result).c_str());
+    if (containerOptions.InitProcessOptions.CommandLineCount > 0)
+    {
+        request.Cmd.insert(
+            request.Cmd.end(),
+            containerOptions.InitProcessOptions.CommandLine,
+            containerOptions.InitProcessOptions.CommandLine + containerOptions.InitProcessOptions.CommandLineCount);
+    }
 
-    auto id = result.Output[1];
-    while (!id.empty() && (id.back() == '\n'))
+    if (containerOptions.InitProcessOptions.Executable != nullptr)
     {
-        id.pop_back();
+        request.Entrypoint = std::vector<std::string>{containerOptions.InitProcessOptions.Executable};
     }
 
-    // N.B. mappedPorts is explicitly copied because it's referenced in errorCleanup, so it can't be moved.
-    auto container = std::make_unique<WSLAContainerImpl>(
-        &parentVM, containerOptions, std::move(id), eventTracker, std::move(volumes), std::vector<PortMapping>(*mappedPorts), std::move(OnDeleted));
+    for (DWORD i = 0; i < containerOptions.InitProcessOptions.EnvironmentCount; i++)
+    {
+        THROW_HR_IF_MSG(
+            E_INVALIDARG,
+            containerOptions.InitProcessOptions.Environment[i][0] == '-',
+            "Invalid environment string at index: %i: %hs",
+            i,
+            containerOptions.InitProcessOptions.Environment[i]);
 
-    errorCleanup.release();
+        request.Env.push_back(containerOptions.InitProcessOptions.Environment[i]);
+    }
 
-    return container;
-}
+    // Mount volumes.
+    auto volumes = MountVolumes(containerOptions, parentVM);
 
-std::vector<std::string> WSLAContainerImpl::PrepareNerdctlCreateCommand(
-    const WSLA_CONTAINER_OPTIONS& options, std::vector<std::string>&& inputOptions, std::vector<VolumeMountInfo>& volumes)
-{
-    std::vector<std::string> args{nerdctlPath};
-    args.push_back("create");
-    args.push_back("--name");
-    args.push_back(options.Name);
-
-    switch (options.ContainerNetwork.ContainerNetworkType)
-    {
-    case WSLA_CONTAINER_NETWORK_HOST:
-        args.push_back("--net=host");
-        break;
-    case WSLA_CONTAINER_NETWORK_NONE:
-        args.push_back("--net=none");
-        break;
-    case WSLA_CONTAINER_NETWORK_BRIDGE:
-        args.push_back("--net=bridge");
-        break;
-    // TODO: uncomment and implement when we have custom networks
-    // case WSLA_CONTAINER_NETWORK_CUSTOM:
-    //     args.push_back(std::format("--net={}", options.ContainerNetwork.ContainerNetworkName));
-    //     break;
-    default:
-        THROW_HR_MSG(
-            E_INVALIDARG,
-            "No such network: type: %i, name: %hs",
-            options.ContainerNetwork.ContainerNetworkType,
-            options.ContainerNetwork.ContainerNetworkName);
-        break;
+    for (const auto& e : volumes)
+    {
+        request.HostConfig.Mounts.emplace_back(
+            common::docker_schema::Mount{.Source = e.ParentVMPath, .Target = e.ContainerPath, .Type = "bind", .ReadOnly = e.ReadOnly});
     }
 
-    if (options.ShmSize > 0)
+    // Set the networking mode.
+    if (containerOptions.ContainerNetwork.ContainerNetworkType == WSLA_CONTAINER_NETWORK_BRIDGE)
+    {
+        request.HostConfig.NetworkMode = "bridge";
+    }
+    else if (containerOptions.ContainerNetwork.ContainerNetworkType == WSLA_CONTAINER_NETWORK_HOST)
+    {
+        request.HostConfig.NetworkMode = "host";
+    }
+    else if (containerOptions.ContainerNetwork.ContainerNetworkType == WSLA_CONTAINER_NETWORK_NONE)
     {
-        args.push_back(std::format("--shm-size={}m", options.ShmSize));
+        request.HostConfig.NetworkMode = "none";
     }
-    if (options.Flags & WSLA_CONTAINER_FLAG_ENABLE_GPU)
+    else
     {
-        args.push_back("--gpus");
-        // TODO: Parse GPU device list from WSLA_CONTAINER_OPTIONS. For now, just enable all GPUs.
-        args.push_back("all");
+        THROW_HR_MSG(E_INVALIDARG, "Invalid networking mode: %i", containerOptions.ContainerNetwork.ContainerNetworkType);
     }
 
-    args.insert(args.end(), defaultNerdctlCreateArgs.begin(), defaultNerdctlCreateArgs.end());
-    args.insert(args.end(), inputOptions.begin(), inputOptions.end());
+    // Process port bindings.
+    auto [mappedPorts, errorCleanup] = ProcessPortMappings(containerOptions, parentVM);
 
-    if (options.InitProcessOptions.Executable != nullptr)
+    for (const auto& e : *mappedPorts)
     {
-        args.push_back("--entrypoint");
-        args.push_back(options.InitProcessOptions.Executable);
+        // TODO: UDP support
+        // TODO: Investigate ipv6 support.
+        auto& portEntry = request.HostConfig.PortBindings[std::format("{}/tcp", e.ContainerPort)];
+        portEntry.emplace_back(common::docker_schema::PortMapping{.HostIp = "127.0.0.1", .HostPort = std::to_string(e.VmPort)});
     }
 
-    for (const auto& volume : volumes)
+    // Send the request to docker.
+    try
     {
-        args.emplace_back(std::format("-v{}:{}{}", volume.ParentVMPath, volume.ContainerPath, volume.ReadOnly ? ":ro" : ""));
-    }
 
-    // TODO:
-    // - Implement port mapping
+        auto result = DockerClient.CreateContainer(request);
 
-    args.push_back(options.Image);
+        // TODO: Rethink command line generation logic.
 
-    if (options.InitProcessOptions.CommandLineCount > 0)
-    {
-        args.push_back("--");
+        // N.B. mappedPorts is explicitly copied because it's referenced in errorCleanup, so it can't be moved.
+        auto container = std::make_unique<WSLAContainerImpl>(
+            &parentVM, containerOptions, std::move(result.Id), std::move(volumes), std::vector<PortMapping>(*mappedPorts), std::move(OnDeleted), EventTracker, DockerClient);
 
-        for (ULONG i = 0; i < options.InitProcessOptions.CommandLineCount; i++)
-        {
-            args.push_back(options.InitProcessOptions.CommandLine[i]);
-        }
-    }
+        errorCleanup.release();
 
-    return args;
+        return container;
+    }
+    catch (const DockerHTTPException& e)
+    {
+        // TODO: propagate error message to caller.
+        THROW_HR_MSG(E_FAIL, "Failed to create container: %hs ", e.what());
+    }
 }
 
-std::optional<std::string> WSLAContainerImpl::GetNerdctlStatus()
+void WSLAContainerImpl::Inspect(LPSTR* Output)
 {
-    ServiceProcessLauncher launcher(nerdctlPath, {nerdctlPath, "inspect", "-f", "{{.State.Status}}", m_name});
-    auto result = launcher.Launch(*m_parentVM).WaitAndCaptureOutput();
-    if (result.Code != 0)
+    try
     {
-        // Can happen if the container is not found.
-        // TODO: Find a way to validate that the container is indeed not found, and not some other error.
-        return {};
+        *Output = wil::make_unique_ansistring<wil::unique_cotaskmem_ansistring>(m_dockerClient.InspectContainer(m_id).data()).release();
     }
-
-    auto& status = result.Output[1];
-
-    while (!status.empty() && status.back() == '\n')
+    catch (const DockerHTTPException& e)
     {
-        status.pop_back();
+        THROW_HR_MSG(E_FAIL, "Failed to inspect container: %hs ", e.what());
     }
-
-    // N.B. nerdctl inspect can return with exit code 0 and no output. Return an empty optional if that happens.
-    return status.empty() ? std::optional<std::string>{} : status;
 }
 
 WSLAContainer::WSLAContainer(WSLAContainerImpl* impl, std::function<void(const WSLAContainerImpl*)>&& OnDeleted) :
@@ -653,6 +612,18 @@ HRESULT WSLAContainer::Stop(int Signal, ULONG TimeoutMs)
     return CallImpl(&WSLAContainerImpl::Stop, Signal, TimeoutMs);
 }
 
+HRESULT WSLAContainer::Start()
+{
+    return CallImpl(&WSLAContainerImpl::Start);
+}
+
+HRESULT WSLAContainer::Inspect(LPSTR* Output)
+{
+    *Output = nullptr;
+
+    return CallImpl(&WSLAContainerImpl::Inspect, Output);
+}
+
 HRESULT WSLAContainer::Delete()
 try
 {
diff --git a/src/windows/wslaservice/exe/WSLAContainer.h b/src/windows/wslaservice/exe/WSLAContainer.h
index a4106c244..bce22c8f5 100644
--- a/src/windows/wslaservice/exe/WSLAContainer.h
+++ b/src/windows/wslaservice/exe/WSLAContainer.h
@@ -18,6 +18,8 @@ Module Name:
 #include "wslaservice.h"
 #include "WSLAVirtualMachine.h"
 #include "ContainerEventTracker.h"
+#include "DockerHTTPClient.h"
+#include "WSLAContainerProcess.h"
 
 namespace wsl::windows::service::wsla {
 
@@ -26,7 +28,7 @@ struct VolumeMountInfo
     std::wstring HostPath;
     std::string ParentVMPath;
     std::string ContainerPath;
-    BOOL ReadOnly;
+    bool ReadOnly;
 };
 
 class WSLAContainer;
@@ -50,19 +52,21 @@ class WSLAContainerImpl
         WSLAVirtualMachine* parentVM,
         const WSLA_CONTAINER_OPTIONS& Options,
         std::string&& Id,
-        ContainerEventTracker& tracker,
         std::vector<VolumeMountInfo>&& volumes,
         std::vector<PortMapping>&& ports,
-        std::function<void(const WSLAContainerImpl*)>&& OnDeleted);
+        std::function<void(const WSLAContainerImpl*)>&& OnDeleted,
+        ContainerEventTracker& EventTracker,
+        DockerHTTPClient& DockerClient);
     ~WSLAContainerImpl();
 
-    void Start(const WSLA_CONTAINER_OPTIONS& Options);
+    void Start();
 
     void Stop(_In_ int Signal, _In_ ULONG TimeoutMs);
     void Delete();
     void GetState(_Out_ WSLA_CONTAINER_STATE* State);
     void GetInitProcess(_Out_ IWSLAProcess** process);
     void Exec(_In_ const WSLA_PROCESS_OPTIONS* Options, _Out_ IWSLAProcess** Process, _Out_ int* Errno);
+    void Inspect(LPSTR* Output);
 
     IWSLAContainer& ComWrapper();
 
@@ -72,27 +76,28 @@ class WSLAContainerImpl
     static std::unique_ptr<WSLAContainerImpl> Create(
         const WSLA_CONTAINER_OPTIONS& Options,
         WSLAVirtualMachine& parentVM,
-        ContainerEventTracker& tracker,
-        std::function<void(const WSLAContainerImpl*)>&& OnDeleted);
+        std::function<void(const WSLAContainerImpl*)>&& OnDeleted,
+        ContainerEventTracker& EventTracker,
+        DockerHTTPClient& DockerClient);
 
 private:
-    void OnEvent(ContainerEvent event);
+    void OnEvent(ContainerEvent event, std::optional<int> exitCode);
     void WaitForContainerEvent();
 
-    std::optional<std::string> GetNerdctlStatus();
-
     std::recursive_mutex m_lock;
-    wil::unique_event m_startedEvent{wil::EventOptions::ManualReset};
-    std::optional<ServiceRunningProcess> m_containerProcess;
     std::string m_name;
     std::string m_image;
     std::string m_id;
+    bool m_tty{}; // TODO: have a flag for this at the API level.
+    DockerHTTPClient& m_dockerClient;
     WSLA_CONTAINER_STATE m_state = WslaContainerStateInvalid;
     WSLAVirtualMachine* m_parentVM = nullptr;
-    ContainerEventTracker::ContainerTrackingReference m_trackingReference;
     std::vector<PortMapping> m_mappedPorts;
     std::vector<VolumeMountInfo> m_mountedVolumes;
     Microsoft::WRL::ComPtr<WSLAContainer> m_comWrapper;
+    Microsoft::WRL::ComPtr<WSLAContainerProcess> m_initProcess;
+    ContainerEventTracker& m_eventTracker;
+    ContainerEventTracker::ContainerTrackingReference m_containerEvents;
 
     static std::vector<std::string> PrepareNerdctlCreateCommand(
         const WSLA_CONTAINER_OPTIONS& options, std::vector<std::string>&& inputOptions, std::vector<VolumeMountInfo>& volumes);
@@ -115,6 +120,8 @@ class DECLSPEC_UUID("B1F1C4E3-C225-4CAE-AD8A-34C004DE1AE4") WSLAContainer
     IFACEMETHOD(GetState)(_Out_ WSLA_CONTAINER_STATE* State) override;
     IFACEMETHOD(GetInitProcess)(_Out_ IWSLAProcess** process) override;
     IFACEMETHOD(Exec)(_In_ const WSLA_PROCESS_OPTIONS* Options, _Out_ IWSLAProcess** Process, _Out_ int* Errno) override;
+    IFACEMETHOD(Start)() override;
+    IFACEMETHOD(Inspect)(_Out_ LPSTR* Output) override;
 
     void Disconnect() noexcept;
 
diff --git a/src/windows/wslaservice/exe/WSLAContainerProcess.cpp b/src/windows/wslaservice/exe/WSLAContainerProcess.cpp
new file mode 100644
index 000000000..3e09d2e1a
--- /dev/null
+++ b/src/windows/wslaservice/exe/WSLAContainerProcess.cpp
@@ -0,0 +1,237 @@
+#include "precomp.h"
+#include "WSLAContainerProcess.h"
+
+using wsl::windows::service::wsla::WSLAContainerProcess;
+
+WSLAContainerProcess::WSLAContainerProcess(
+    const std::string& Id, bool Tty, DockerHTTPClient& client, const std::optional<std::string>& ParentContainerId, ContainerEventTracker& tracker) :
+    m_id(Id), m_dockerClient(client), m_tty(Tty), m_exec(ParentContainerId.has_value())
+{
+    // Register for exit events.
+    if (m_exec)
+    {
+        m_trackingReference = tracker.RegisterExecStateUpdates(
+            ParentContainerId.value(), Id, std::bind(&WSLAContainerProcess::OnExecEvent, this, std::placeholders::_1, std::placeholders::_2));
+    }
+}
+
+WSLAContainerProcess::~WSLAContainerProcess()
+{
+    // TODO: consider moving this to a different class.
+    if (m_relayThread.has_value())
+    {
+        m_exitRelayEvent.SetEvent();
+
+        m_relayThread->join();
+    }
+}
+
+void WSLAContainerProcess::AssignIoStream(wil::unique_handle&& IoStream)
+{
+    m_ioStream = std::move(IoStream);
+}
+
+void WSLAContainerProcess::OnExecEvent(ContainerEvent Event, std::optional<int> ExitCode)
+{
+    if (Event == ContainerEvent::ExecDied)
+    {
+        THROW_HR_IF(E_UNEXPECTED, !ExitCode.has_value());
+        OnExited(ExitCode.value());
+    }
+}
+
+HRESULT WSLAContainerProcess::Signal(_In_ int Signal)
+try
+{
+    THROW_WIN32_IF(ERROR_NOT_SUPPORTED, m_exec);
+
+    try
+    {
+        m_dockerClient.SignalContainer(m_id, Signal);
+    }
+    catch (const DockerHTTPException& e)
+    {
+        THROW_HR_MSG(E_FAIL, "Failed to signal container process %hs with signal %d: %hs", m_id.c_str(), Signal, e.what());
+    }
+
+    return S_OK;
+}
+CATCH_RETURN();
+
+HRESULT WSLAContainerProcess::GetExitEvent(_Out_ ULONG* Event)
+try
+{
+    *Event = HandleToUlong(common::wslutil::DuplicateHandleToCallingProcess(m_exitEvent.get()));
+
+    return S_OK;
+}
+CATCH_RETURN();
+
+HRESULT WSLAContainerProcess::GetStdHandle(_In_ ULONG Index, _Out_ ULONG* Handle)
+try
+{
+    std::lock_guard lock{m_mutex};
+
+    auto& handle = GetStdHandle(Index);
+    RETURN_HR_IF(HRESULT_FROM_WIN32(ERROR_INVALID_STATE), !handle.is_valid());
+
+    *Handle = HandleToUlong(common::wslutil::DuplicateHandleToCallingProcess(handle.get()));
+    WSL_LOG(
+        "GetStdHandle",
+        TraceLoggingValue(Index, "fd"),
+        TraceLoggingValue(handle.get(), "handle"),
+        TraceLoggingValue(*Handle, "remoteHandle"));
+
+    handle.reset();
+    return S_OK;
+
+    return E_NOTIMPL;
+}
+CATCH_RETURN();
+
+HRESULT WSLAContainerProcess::GetPid(_Out_ int* Pid)
+{
+    return E_NOTIMPL;
+}
+
+HRESULT WSLAContainerProcess::GetState(_Out_ WSLA_PROCESS_STATE* CurrentState, _Out_ int* Code)
+try
+{
+    std::tie(*CurrentState, *Code) = State();
+
+    return S_OK;
+}
+CATCH_RETURN();
+
+std::pair<WSLA_PROCESS_STATE, int> WSLAContainerProcess::State() const
+{
+    if (m_exitEvent.is_signaled())
+    {
+        // TODO: Handle signals.
+        return {WSLA_PROCESS_STATE::WslaProcessStateExited, m_exitedCode};
+    }
+    else
+    {
+        return {WSLA_PROCESS_STATE::WslaProcessStateRunning, -1};
+    }
+}
+
+HRESULT WSLAContainerProcess::ResizeTty(_In_ ULONG Rows, _In_ ULONG Columns)
+try
+{
+    std::lock_guard lock{m_mutex};
+    RETURN_HR_IF(E_INVALIDARG, !m_tty);
+
+    try
+    {
+        if (m_exec)
+        {
+            m_dockerClient.ResizeExecTty(m_id, Rows, Columns);
+        }
+        else
+        {
+            m_dockerClient.ResizeContainerTty(m_id, Rows, Columns);
+        }
+    }
+    catch (const DockerHTTPException& e)
+    {
+        THROW_HR_MSG(E_FAIL, "Failed to resize tty for process %hs: %hs", m_id.c_str(), e.what());
+    }
+
+    return S_OK;
+}
+CATCH_RETURN();
+
+wil::unique_handle& WSLAContainerProcess::GetStdHandle(int Index)
+{
+    std::lock_guard lock{m_mutex};
+
+    if (m_tty)
+    {
+        THROW_HR_IF_MSG(E_INVALIDARG, Index != 0, "Invalid fd index for tty process: %i", Index);
+
+        return m_ioStream;
+    }
+    else
+    {
+        if (!m_relayedHandles.has_value())
+        {
+            StartIORelay();
+        }
+
+        THROW_HR_IF_MSG(E_INVALIDARG, Index > m_relayedHandles->size(), "Invalid fd index for non-tty process: %i", Index);
+
+        return m_relayedHandles->at(Index);
+    }
+
+    if (Index == 0 && m_tty)
+    {
+        return m_ioStream;
+    }
+
+    return m_ioStream; // TODO: fix
+}
+
+void WSLAContainerProcess::RunIORelay(HANDLE exitEvent, wil::unique_hfile&& stdinPipe, wil::unique_hfile&& stdoutPipe, wil::unique_hfile&& stderrPipe)
+try
+{
+    common::relay::MultiHandleWait io;
+
+    // This is required for docker to know when stdin is closed.
+    auto onInputComplete = [&]() {
+        LOG_LAST_ERROR_IF(shutdown(reinterpret_cast<SOCKET>(m_ioStream.get()), SD_SEND) == SOCKET_ERROR);
+    };
+
+    io.AddHandle(std::make_unique<common::relay::RelayHandle>(
+        common::relay::HandleWrapper{std::move(stdinPipe), std::move(onInputComplete)}, m_ioStream.get()));
+
+    io.AddHandle(std::make_unique<common::relay::EventHandle>(exitEvent, [&]() { io.Cancel(); }));
+    io.AddHandle(std::make_unique<common::relay::DockerIORelayHandle>(m_ioStream.get(), std::move(stdoutPipe), std::move(stderrPipe)));
+
+    io.Run({});
+
+    // IO relay is done, check the process exit status.
+}
+CATCH_LOG();
+
+void WSLAContainerProcess::StartIORelay()
+{
+    std::lock_guard lock{m_mutex};
+
+    WI_ASSERT(!m_relayThread.has_value());
+    WI_ASSERT(!m_exitRelayEvent);
+    WI_ASSERT(!m_relayedHandles.has_value());
+
+    m_exitRelayEvent.create(wil::EventOptions::ManualReset);
+    m_relayedHandles.emplace();
+
+    auto createPipe = []() {
+        std::pair<wil::unique_handle, wil::unique_handle> pipe;
+        THROW_IF_WIN32_BOOL_FALSE(CreatePipe(&pipe.first, &pipe.second, nullptr, 0));
+        return pipe;
+    };
+
+    auto stdinPipe = common::wslutil::OpenAnonymousPipe(LX_RELAY_BUFFER_SIZE, true, true);
+    auto stdoutPipe = common::wslutil::OpenAnonymousPipe(LX_RELAY_BUFFER_SIZE, true, true);
+    auto stderrPipe = common::wslutil::OpenAnonymousPipe(LX_RELAY_BUFFER_SIZE, true, true);
+
+    m_relayedHandles->emplace_back(stdinPipe.second.release());
+    m_relayedHandles->emplace_back(stdoutPipe.first.release());
+    m_relayedHandles->emplace_back(stderrPipe.first.release());
+
+    m_relayThread.emplace([this,
+                           event = m_exitRelayEvent.get(),
+                           stdinPipe = std::move(stdinPipe.first),
+                           stdoutPipe = std::move(stdoutPipe.second),
+                           stderrPipe = std::move(stderrPipe.second)]() mutable {
+        RunIORelay(event, std::move(stdinPipe), std::move(stdoutPipe), std::move(stderrPipe));
+    });
+}
+
+void WSLAContainerProcess::OnExited(int Code)
+{
+    WI_ASSERT(!m_exitEvent.is_signaled());
+
+    m_exitedCode = Code;
+    m_exitEvent.SetEvent();
+}
\ No newline at end of file
diff --git a/src/windows/wslaservice/exe/WSLAContainerProcess.h b/src/windows/wslaservice/exe/WSLAContainerProcess.h
new file mode 100644
index 000000000..fc629552c
--- /dev/null
+++ b/src/windows/wslaservice/exe/WSLAContainerProcess.h
@@ -0,0 +1,48 @@
+#pragma once
+
+#include "DockerHTTPClient.h"
+#include "wslaservice.h"
+#include "ContainerEventTracker.h"
+
+namespace wsl::windows::service::wsla {
+
+class DECLSPEC_UUID("3A5DB29D-6D1D-4619-B89D-578EB34C8E52") WSLAContainerProcess
+    : public Microsoft::WRL::RuntimeClass<Microsoft::WRL::RuntimeClassFlags<Microsoft::WRL::ClassicCom>, IWSLAProcess, IFastRundown>
+{
+public:
+    WSLAContainerProcess(const std::string& Id, bool Tty, DockerHTTPClient& Client, const std::optional<std::string>& ParentContainerId, ContainerEventTracker& tracker);
+    ~WSLAContainerProcess();
+
+    IFACEMETHOD(Signal)(_In_ int Signal) override;
+    IFACEMETHOD(GetExitEvent)(_Out_ ULONG* Event) override;
+    IFACEMETHOD(GetStdHandle)(_In_ ULONG Index, _Out_ ULONG* Handle) override;
+    IFACEMETHOD(GetPid)(_Out_ int* Pid) override;
+    IFACEMETHOD(GetState)(_Out_ WSLA_PROCESS_STATE* State, _Out_ int* Code) override;
+    IFACEMETHOD(ResizeTty)(_In_ ULONG Rows, _In_ ULONG Columns) override;
+
+    std::pair<WSLA_PROCESS_STATE, int> State() const;
+
+    void OnExited(int Code);
+    void AssignIoStream(wil::unique_handle&& IoStream); // TODO: rework.
+
+private:
+    wil::unique_handle& GetStdHandle(int Index);
+    void StartIORelay();
+    void RunIORelay(HANDLE exitEvent, wil::unique_hfile&& stdinPipe, wil::unique_hfile&& stdoutPipe, wil::unique_hfile&& stderrPipe);
+    void OnExecEvent(ContainerEvent Event, std::optional<int> ExitCode);
+
+    wil::unique_handle m_ioStream;
+    DockerHTTPClient& m_dockerClient;
+    bool m_tty = false;
+    bool m_exec = false;
+    ContainerEventTracker::ContainerTrackingReference m_trackingReference;
+    wil::unique_event m_exitEvent{wil::EventOptions::ManualReset};
+    int m_exitedCode = -1;
+    std::string m_id;
+    std::optional<std::thread> m_relayThread;
+    wil::unique_event m_exitRelayEvent;
+    std::optional<std::vector<wil::unique_handle>> m_relayedHandles;
+    std::recursive_mutex m_mutex;
+};
+
+} // namespace wsl::windows::service::wsla
\ No newline at end of file
diff --git a/src/windows/wslaservice/exe/WSLAProcess.cpp b/src/windows/wslaservice/exe/WSLAProcess.cpp
index 95269a36f..48f6ad0a8 100644
--- a/src/windows/wslaservice/exe/WSLAProcess.cpp
+++ b/src/windows/wslaservice/exe/WSLAProcess.cpp
@@ -131,6 +131,11 @@ try
 }
 CATCH_RETURN();
 
+HRESULT WSLAProcess::ResizeTty(ULONG Rows, ULONG Columns)
+{
+    return E_NOTIMPL;
+}
+
 void WSLAProcess::OnTerminated(bool Signalled, int Code)
 {
     WI_ASSERT(m_virtualMachine != nullptr);
diff --git a/src/windows/wslaservice/exe/WSLAProcess.h b/src/windows/wslaservice/exe/WSLAProcess.h
index c8639ac07..cd06dc187 100644
--- a/src/windows/wslaservice/exe/WSLAProcess.h
+++ b/src/windows/wslaservice/exe/WSLAProcess.h
@@ -33,6 +33,7 @@ class DECLSPEC_UUID("AFBEA6D6-D8A4-4F81-8FED-F947EB74B33B") WSLAProcess
     IFACEMETHOD(GetStdHandle)(_In_ ULONG Index, _Out_ ULONG* Handle) override;
     IFACEMETHOD(GetPid)(_Out_ int* Pid) override;
     IFACEMETHOD(GetState)(_Out_ WSLA_PROCESS_STATE* State, _Out_ int* Code) override;
+    IFACEMETHOD(ResizeTty)(_In_ ULONG Rows, _In_ ULONG Columns) override;
 
     void OnTerminated(bool Signalled, int Code);
     void OnVmTerminated();
diff --git a/src/windows/wslaservice/exe/WSLASession.cpp b/src/windows/wslaservice/exe/WSLASession.cpp
index c2000e0a8..fed792f86 100644
--- a/src/windows/wslaservice/exe/WSLASession.cpp
+++ b/src/windows/wslaservice/exe/WSLASession.cpp
@@ -23,7 +23,19 @@ using namespace wsl::windows::common;
 using wsl::windows::service::wsla::WSLASession;
 using wsl::windows::service::wsla::WSLAVirtualMachine;
 
-constexpr auto c_containerdStorage = "/var/lib/containerd";
+constexpr auto c_containerdStorage = "/var/lib/docker";
+
+namespace {
+
+std::pair<std::string, std::string> ParseImage(const std::string& Input)
+{
+    std::string image{Input};
+    size_t separator = image.find(':');
+    THROW_HR_IF_MSG(E_INVALIDARG, separator == std::string::npos || separator >= Input.size() - 1, "Invalid image: %hs", Input.c_str());
+
+    return {image.substr(0, separator), image.substr(separator + 1)};
+}
+} // namespace
 
 WSLASession::WSLASession(ULONG id, const WSLA_SESSION_SETTINGS& Settings, WSLAUserSessionImpl& userSessionImpl) :
 
@@ -55,8 +67,8 @@ WSLASession::WSLASession(ULONG id, const WSLA_SESSION_SETTINGS& Settings, WSLAUs
     // Launch containerd
     // TODO: Rework the daemon logic so we can have only one thread watching all daemons.
     ServiceProcessLauncher launcher{
-        "/usr/bin/containerd",
-        {"/usr/bin/containerd"},
+        "/usr/bin/dockerd",
+        {"/usr/bin/dockerd"},
         {{"PATH=/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/sbin"}},
         common::ProcessFlags::Stdout | common::ProcessFlags::Stderr};
     m_containerdThread = std::thread(&WSLASession::MonitorContainerd, this, launcher.Launch(*m_virtualMachine.Get()));
@@ -65,8 +77,12 @@ WSLASession::WSLASession(ULONG id, const WSLA_SESSION_SETTINGS& Settings, WSLAUs
     // TODO: Configurable timeout.
     THROW_WIN32_IF_MSG(ERROR_TIMEOUT, !m_containerdReadyEvent.wait(10 * 1000), "Timed out waiting for containerd to start");
 
-    // Start the event tracker.
-    m_eventTracker.emplace(*m_virtualMachine.Get());
+    auto [_, __, channel] = m_virtualMachine->Fork(WSLA_FORK::Thread);
+
+    m_dockerClient.emplace(std::move(channel), m_virtualMachine->ExitingEvent(), m_virtualMachine->VmId(), 10 * 1000);
+
+    //  Start the event tracker.
+    m_eventTracker.emplace(m_dockerClient.value());
 
     errorCleanup.release();
 }
@@ -239,22 +255,16 @@ try
         return;
     }
 
-    constexpr auto c_containerdReadyLogLine = "containerd successfully booted";
+    constexpr auto c_containerdReadyLogLine = "API listen on /var/run/docker.sock";
 
     std::string entry = {buffer.begin(), buffer.end()};
     WSL_LOG("ContainerdLog", TraceLoggingValue(entry.c_str(), "Content"), TraceLoggingValue(m_displayName.c_str(), "Name"));
 
-    auto parsed = nlohmann::json::parse(entry);
-
     if (!m_containerdReadyEvent.is_signaled())
     {
-        auto it = parsed.find("msg");
-        if (it != parsed.end())
+        if (entry.find(c_containerdReadyLogLine) != std::string::npos)
         {
-            if (it->get<std::string>().starts_with(c_containerdReadyLogLine))
-            {
-                m_containerdReadyEvent.SetEvent();
-            }
+            m_containerdReadyEvent.SetEvent();
         }
     }
 }
@@ -286,7 +296,7 @@ try
     else
     {
         // Otherwise, the session is shutting down; terminate containerd before exiting.
-        process.Get().Signal(15); // SIGTERM
+        process.Get().Signal(9); // SIGKILL
 
         process.Wait(30 * 1000); // TODO: Configurable timeout.
     }
@@ -301,81 +311,149 @@ try
 
     RETURN_HR_IF_NULL(E_POINTER, ImageUri);
 
+    auto [repo, tag] = ParseImage(ImageUri);
+
     std::lock_guard lock{m_lock};
 
-    ServiceProcessLauncher launcher{nerdctlPath, {nerdctlPath, "pull", ImageUri}};
-    auto result = launcher.Launch(*m_virtualMachine.Get()).WaitAndCaptureOutput();
+    auto callback = [&](const std::string& content) {
+        WSL_LOG("ImagePullProgress", TraceLoggingValue(ImageUri, "Image"), TraceLoggingValue(content.c_str(), "Content"));
+    };
 
-    RETURN_HR_IF_MSG(E_FAIL, result.Code != 0, "Pull image failed: %hs", launcher.FormatResult(result).c_str());
+    auto code = m_dockerClient->PullImage(repo.c_str(), tag.c_str(), callback);
+
+    THROW_HR_IF_MSG(E_FAIL, code != 200, "Failed to pull image: %hs", ImageUri);
 
     return S_OK;
 }
 CATCH_RETURN();
 
-HRESULT WSLASession::LoadImage(ULONG ImageHandle, IProgressCallback* ProgressCallback)
+HRESULT WSLASession::LoadImage(ULONG ImageHandle, IProgressCallback* ProgressCallback, ULONGLONG ContentSize)
 try
 {
     UNREFERENCED_PARAMETER(ProgressCallback);
 
-    wil::unique_handle imageFileHandle{wsl::windows::common::wslutil::DuplicateHandleFromCallingProcess(ULongToHandle(ImageHandle))};
-    RETURN_HR_IF(E_INVALIDARG, INVALID_HANDLE_VALUE == imageFileHandle.get());
-
     std::lock_guard lock{m_lock};
 
-    // Directly invoking "nerdctl load" will immediately return with failure
-    // "stdin is empty and input flag is not specified".
-    // TODO: Change the workaround when nerdctl has a fix.
-    ServiceProcessLauncher launcher{
-        "/bin/sh", {"/bin/sh", "-c", "cat | /usr/bin/nerdctl load"}, {}, ProcessFlags::Stdin | ProcessFlags::Stdout | ProcessFlags::Stderr};
-    auto loadProcess = launcher.Launch(*m_virtualMachine.Get());
-
-    auto loadProcessStdin = loadProcess.GetStdHandle(0);
-    // TODO: Create a new OverlappedIOHandle that relays a handle to process's stdin.
-    wsl::windows::common::relay::InterruptableRelay(
-        imageFileHandle.get(), loadProcessStdin.get(), m_sessionTerminatingEvent.get(), 4 * 1024 * 1024 /* 4MB buffer */);
-    loadProcessStdin.reset();
+    THROW_HR_IF(HRESULT_FROM_WIN32(ERROR_INVALID_STATE), !m_dockerClient.has_value());
 
-    auto result = loadProcess.WaitAndCaptureOutput();
-
-    RETURN_HR_IF_MSG(E_FAIL, result.Code != 0, "Load image failed: %hs", launcher.FormatResult(result).c_str());
+    auto requestContext = m_dockerClient->LoadImage(ContentSize);
 
+    ImportImageImpl(*requestContext, ImageHandle);
     return S_OK;
 }
 CATCH_RETURN();
 
-HRESULT WSLASession::ImportImage(ULONG ImageHandle, LPCSTR ImageName, IProgressCallback* ProgressCallback)
+HRESULT WSLASession::ImportImage(ULONG ImageHandle, LPCSTR ImageName, IProgressCallback* ProgressCallback, ULONGLONG ContentSize)
 try
 {
     UNREFERENCED_PARAMETER(ProgressCallback);
-
-    wil::unique_handle imageFileHandle{wsl::windows::common::wslutil::DuplicateHandleFromCallingProcess(ULongToHandle(ImageHandle))};
-    RETURN_HR_IF(E_INVALIDARG, INVALID_HANDLE_VALUE == imageFileHandle.get());
     RETURN_HR_IF_NULL(E_POINTER, ImageName);
 
-    std::lock_guard lock{m_lock};
-
-    ServiceProcessLauncher launcher{
-        nerdctlPath, {nerdctlPath, "import", "-", ImageName}, {}, ProcessFlags::Stdin | ProcessFlags::Stdout | ProcessFlags::Stderr};
-    auto importProcess = launcher.Launch(*m_virtualMachine.Get());
+    auto [repo, tag] = ParseImage(ImageName);
 
-    auto importProcessStdin = importProcess.GetStdHandle(0);
-    // TODO: Create a new OverlappedIOHandle that relays a handle to process's stdin.
-    wsl::windows::common::relay::InterruptableRelay(
-        imageFileHandle.get(), importProcessStdin.get(), m_sessionTerminatingEvent.get(), 4 * 1024 * 1024 /* 4MB buffer */);
-    importProcessStdin.reset();
+    std::lock_guard lock{m_lock};
 
-    auto result = importProcess.WaitAndCaptureOutput();
+    THROW_HR_IF(HRESULT_FROM_WIN32(ERROR_INVALID_STATE), !m_dockerClient.has_value());
 
-    RETURN_HR_IF_MSG(E_FAIL, result.Code != 0, "Import image failed: %hs", launcher.FormatResult(result).c_str());
+    auto requestContext = m_dockerClient->ImportImage(repo, tag, ContentSize);
 
+    ImportImageImpl(*requestContext, ImageHandle);
     return S_OK;
 }
 CATCH_RETURN();
 
+void WSLASession::ImportImageImpl(DockerHTTPClient::HTTPRequestContext& Request, ULONG InputHandle)
+{
+    wil::unique_handle imageFileHandle{wsl::windows::common::wslutil::DuplicateHandleFromCallingProcess(ULongToHandle(InputHandle))};
+
+    THROW_HR_IF(HRESULT_FROM_WIN32(ERROR_INVALID_STATE), !m_dockerClient.has_value());
+
+    relay::MultiHandleWait io;
+
+    std::optional<boost::beast::http::status> importResult;
+
+    auto onHttpResponse = [&](const boost::beast::http::message<false, boost::beast::http::buffer_body>& response) {
+        WSL_LOG("ImageImportHttpResponse", TraceLoggingValue(static_cast<int>(response.result()), "StatusCode"));
+
+        importResult = response.result();
+    };
+
+    std::string errorJson;
+    auto onProgress = [&](const gsl::span<char>& buffer) {
+        WI_ASSERT(importResult.has_value());
+
+        if (importResult.value() != boost::beast::http::status::ok)
+        {
+            // If the import failed, accumulate the error message.
+            errorJson.append(buffer.data(), buffer.size());
+        }
+        else
+        {
+            // TODO: report progress to caller.
+            std::string entry = {buffer.begin(), buffer.end()};
+            WSL_LOG("ImageImportProgress", TraceLoggingValue(entry.c_str(), "Content"));
+        }
+    };
+
+    auto onCompleted = [&]() { io.Cancel(); };
+
+    io.AddHandle(std::make_unique<relay::RelayHandle>(
+        common::relay::HandleWrapper{std::move(imageFileHandle)}, common::relay::HandleWrapper{Request.stream.native_handle()}));
+
+    io.AddHandle(std::make_unique<relay::EventHandle>(m_sessionTerminatingEvent.get(), [&]() { THROW_HR(E_ABORT); }));
+
+    io.AddHandle(std::make_unique<DockerHTTPClient::DockerHttpResponseHandle>(
+        Request, std::move(onHttpResponse), std::move(onProgress), std::move(onCompleted)));
+
+    io.Run({});
+
+    THROW_HR_IF(E_UNEXPECTED, !importResult.has_value());
+
+    if (importResult.value() != boost::beast::http::status::ok)
+    {
+        // Import failed, parse the error message.
+        auto error = wsl::shared::FromJson<docker_schema::ErrorResponse>(errorJson.c_str());
+
+        // TODO: Return error message to client.
+        THROW_HR_MSG(E_FAIL, "Image import failed: %hs", error.message.c_str());
+    }
+}
+
 HRESULT WSLASession::ListImages(WSLA_IMAGE_INFORMATION** Images, ULONG* Count)
+try
 {
-    return E_NOTIMPL;
+    *Count = 0;
+    *Images = nullptr;
+
+    std::lock_guard lock{m_lock};
+
+    THROW_HR_IF(HRESULT_FROM_WIN32(ERROR_INVALID_STATE), !m_dockerClient.has_value());
+
+    auto images = m_dockerClient->ListImages();
+
+    auto output = wil::make_unique_cotaskmem<WSLA_IMAGE_INFORMATION[]>(images.size());
+
+    size_t index = 0;
+    for (const auto& e : images)
+    {
+        // TODO: Find a better way to encode tags;
+        // TODO: download_timestamp
+        if (!e.RepoTags.empty())
+        {
+            THROW_HR_IF(E_UNEXPECTED, strcpy_s(output[index].Image, e.RepoTags[0].c_str()) != 0);
+        }
+
+        THROW_HR_IF(E_UNEXPECTED, strcpy_s(output[index].Hash, e.Id.c_str()) != 0);
+        output[index].Size = e.Size;
+
+        index++;
+    }
+
+    *Count = static_cast<ULONG>(images.size());
+    *Images = output.release();
+    return S_OK;
 }
+CATCH_RETURN();
 
 HRESULT WSLASession::DeleteImage(LPCWSTR Image)
 {
@@ -406,10 +484,13 @@ try
     auto [container, inserted] = m_containers.emplace(
         containerOptions->Name,
         WSLAContainerImpl::Create(
-            *containerOptions, *m_virtualMachine.Get(), *m_eventTracker, std::bind(&WSLASession::OnContainerDeleted, this, std::placeholders::_1)));
-    WI_ASSERT(inserted);
+            *containerOptions,
+            *m_virtualMachine.Get(),
+            std::bind(&WSLASession::OnContainerDeleted, this, std::placeholders::_1),
+            m_eventTracker.value(),
+            m_dockerClient.value()));
 
-    container->second->Start(*containerOptions);
+    WI_ASSERT(inserted);
 
     THROW_IF_FAILED(container->second->ComWrapper().QueryInterface(__uuidof(IWSLAContainer), (void**)Container));
 
@@ -511,6 +592,10 @@ CATCH_RETURN();
 
 void WSLASession::OnUserSessionTerminating()
 {
+    // m_sessionTerminatingEvent is always valid, so it can be signalled with the lock.
+    // This allows a sesssion to be unblocked if a stuck operation is holding the lock.
+    m_sessionTerminatingEvent.SetEvent();
+
     std::lock_guard lock{m_lock};
     WI_ASSERT(m_userSession != nullptr);
 
diff --git a/src/windows/wslaservice/exe/WSLASession.h b/src/windows/wslaservice/exe/WSLASession.h
index df58a9fde..e9dba0610 100644
--- a/src/windows/wslaservice/exe/WSLASession.h
+++ b/src/windows/wslaservice/exe/WSLASession.h
@@ -18,6 +18,7 @@ Module Name:
 #include "WSLAVirtualMachine.h"
 #include "WSLAContainer.h"
 #include "ContainerEventTracker.h"
+#include "DockerHTTPClient.h"
 
 namespace wsl::windows::service::wsla {
 
@@ -40,8 +41,8 @@ class DECLSPEC_UUID("4877FEFC-4977-4929-A958-9F36AA1892A4") WSLASession
         _In_ LPCSTR ImageUri,
         _In_ const WSLA_REGISTRY_AUTHENTICATION_INFORMATION* RegistryAuthenticationInformation,
         _In_ IProgressCallback* ProgressCallback) override;
-    IFACEMETHOD(LoadImage)(_In_ ULONG ImageHandle, _In_ IProgressCallback* ProgressCallback) override;
-    IFACEMETHOD(ImportImage)(_In_ ULONG ImageHandle, _In_ LPCSTR ImageName, _In_ IProgressCallback* ProgressCallback) override;
+    IFACEMETHOD(LoadImage)(_In_ ULONG ImageHandle, _In_ IProgressCallback* ProgressCallback, _In_ ULONGLONG ContentLength) override;
+    IFACEMETHOD(ImportImage)(_In_ ULONG ImageHandle, _In_ LPCSTR ImageName, _In_ IProgressCallback* ProgressCallback, _In_ ULONGLONG ContentLength) override;
     IFACEMETHOD(ListImages)(_Out_ WSLA_IMAGE_INFORMATION** Images, _Out_ ULONG* Count) override;
     IFACEMETHOD(DeleteImage)(_In_ LPCWSTR Image) override;
 
@@ -71,8 +72,10 @@ class DECLSPEC_UUID("4877FEFC-4977-4929-A958-9F36AA1892A4") WSLASession
     void OnContainerDeleted(const WSLAContainerImpl* Container);
     void OnContainerdLog(const gsl::span<char>& Data);
     void MonitorContainerd(ServiceRunningProcess&& process);
+    void ImportImageImpl(DockerHTTPClient::HTTPRequestContext& Request, ULONG InputHandle);
 
     WSLA_SESSION_SETTINGS m_sessionSettings; // TODO: Revisit to see if we should have session settings as a member or not
+    std::optional<DockerHTTPClient> m_dockerClient;
     WSLAUserSessionImpl* m_userSession = nullptr;
     Microsoft::WRL::ComPtr<WSLAVirtualMachine> m_virtualMachine;
     std::optional<ContainerEventTracker> m_eventTracker;
diff --git a/src/windows/wslaservice/exe/WSLAVirtualMachine.cpp b/src/windows/wslaservice/exe/WSLAVirtualMachine.cpp
index 5f8c90f22..a458325ad 100644
--- a/src/windows/wslaservice/exe/WSLAVirtualMachine.cpp
+++ b/src/windows/wslaservice/exe/WSLAVirtualMachine.cpp
@@ -387,7 +387,27 @@ void WSLAVirtualMachine::ConfigureMounts()
     Mount(m_initChannel, nullptr, "/sys", "sysfs", "", 0);
     Mount(m_initChannel, nullptr, "/proc", "proc", "", 0);
     Mount(m_initChannel, nullptr, "/dev/pts", "devpts", "noatime,nosuid,noexec,gid=5,mode=620", 0);
-    Mount(m_initChannel, nullptr, "/sys/fs/cgroup", "cgroup2", "", 0);
+    Mount(m_initChannel, nullptr, "/sys/fs/cgroup", "tmpfs", "uid=0,gid=0,mode=0755", 0);
+
+    std::vector<const char*> cgroups = {
+        "cpuset",
+        "cpu",
+        "cpuacct",
+        "blkio",
+        "memory",
+        "devices",
+        "freezer",
+        "net_cls",
+        "perf_event",
+        "net_prio",
+        "hugetlb",
+        "pids",
+        "rdma"};
+
+    for (const auto* e : cgroups)
+    {
+        Mount(m_initChannel, nullptr, std::format("/sys/fs/cgroup/{}", e).c_str(), "cgroup", e, 0);
+    }
 
     if (FeatureEnabled(WslaFeatureFlagsGPU)) // TODO: re-think how GPU settings should work at the session level API.
     {
@@ -1523,4 +1543,18 @@ void WSLAVirtualMachine::ReleasePorts(const std::set<uint16_t>& Ports)
 
         WI_VERIFY(m_allocatedPorts.erase(port) == 1);
     }
+}
+
+wil::unique_socket WSLAVirtualMachine::ConnectUnixSocket(const char* Path)
+{
+    auto [_, __, channel] = Fork(WSLA_FORK::Thread);
+
+    shared::MessageWriter<WSLA_UNIX_CONNECT> message;
+    message.WriteString(message->PathOffset, Path);
+
+    auto result = channel.Transaction<WSLA_UNIX_CONNECT>(message.Span());
+
+    THROW_HR_IF_MSG(E_FAIL, result.Result < 0, "Failed to connect to unix socket: '%hs', %i", Path, result.Result);
+
+    return channel.Release();
 }
\ No newline at end of file
diff --git a/src/windows/wslaservice/exe/WSLAVirtualMachine.h b/src/windows/wslaservice/exe/WSLAVirtualMachine.h
index b28a64a03..6de6ab569 100644
--- a/src/windows/wslaservice/exe/WSLAVirtualMachine.h
+++ b/src/windows/wslaservice/exe/WSLAVirtualMachine.h
@@ -97,6 +97,17 @@ class DECLSPEC_UUID("0CFC5DC1-B6A7-45FC-8034-3FA9ED73CE30") WSLAVirtualMachine
     void Mount(_In_ LPCSTR Source, _In_ LPCSTR Target, _In_ LPCSTR Type, _In_ LPCSTR Options, _In_ ULONG Flags);
 
     const wil::unique_event& TerminatingEvent();
+    wil::unique_socket ConnectUnixSocket(_In_ const char* Path);
+    std::tuple<int32_t, int32_t, wsl::shared::SocketChannel> Fork(enum WSLA_FORK::ForkType Type);
+    HANDLE ExitingEvent() const
+    {
+        return m_vmTerminatingEvent.get();
+    }
+
+    GUID VmId() const
+    {
+        return m_vmId;
+    }
 
 private:
     static void Mount(wsl::shared::SocketChannel& Channel, LPCSTR Source, _In_ LPCSTR Target, _In_ LPCSTR Type, _In_ LPCSTR Options, _In_ ULONG Flags);
@@ -111,7 +122,6 @@ class DECLSPEC_UUID("0CFC5DC1-B6A7-45FC-8034-3FA9ED73CE30") WSLAVirtualMachine
     void OnCrash(_In_ const HCS_EVENT* Event);
     bool FeatureEnabled(WSLAFeatureFlags Flag) const;
 
-    std::tuple<int32_t, int32_t, wsl::shared::SocketChannel> Fork(enum WSLA_FORK::ForkType Type);
     std::tuple<int32_t, int32_t, wsl::shared::SocketChannel> Fork(
         wsl::shared::SocketChannel& Channel, enum WSLA_FORK::ForkType Type, ULONG TtyRows = 0, ULONG TtyColumns = 0);
     int32_t ExpectClosedChannelOrError(wsl::shared::SocketChannel& Channel);
diff --git a/src/windows/wslaservice/inc/wslaservice.idl b/src/windows/wslaservice/inc/wslaservice.idl
index e89a8fc1b..3fb32770f 100644
--- a/src/windows/wslaservice/inc/wslaservice.idl
+++ b/src/windows/wslaservice/inc/wslaservice.idl
@@ -103,7 +103,7 @@ struct WSLA_REGISTRY_AUTHENTICATION_INFORMATION
 struct WSLA_IMAGE_INFORMATION
 {
     char Image[WSLA_MAX_IMAGE_NAME_LENGTH + 1];
-    LPWSTR Hash;
+    char Hash[256];
     ULONGLONG Size;
     ULONGLONG DownloadTimestamp;
 };
@@ -211,6 +211,7 @@ interface IWSLAProcess : IUnknown
     HRESULT GetStdHandle([in] ULONG Index, [out] ULONG* Handle);
     HRESULT GetPid([out] int* Pid);
     HRESULT GetState([out] enum WSLA_PROCESS_STATE* State, [out] int* Code);
+    HRESULT ResizeTty([in] ULONG Rows, [in] ULONG Columns);
 
     // Note: the SDK can offer a convenience Wait() method, but that doesn't need to be part of the service API.
 }
@@ -276,10 +277,12 @@ struct WSLA_SESSION_SETTINGS {
 interface IWSLAContainer : IUnknown
 {
     HRESULT Stop([in] int Signal, [in] ULONG TimeoutMs);
+    HRESULT Start();
     HRESULT Delete(); // TODO: Look into lifetime logic.
     HRESULT GetState([out] enum WSLA_CONTAINER_STATE* State);
     HRESULT GetInitProcess([out] IWSLAProcess** Process);
     HRESULT Exec([in] const struct WSLA_PROCESS_OPTIONS* Options, [out] IWSLAProcess** Process, [out] int* Errno);
+    HRESULT Inspect([out] LPSTR* Output);
 
     // Anonymous host port allocation (P1).
     //HRESULT AllocateHostPort([in] LPCSTR Name, [in] USHORT ContainerPort, [out] USHORT* AllocatedHostPort);
@@ -295,8 +298,8 @@ interface IWSLASession : IUnknown
 {
     // Image management.
     HRESULT PullImage([in] LPCSTR ImageUri, [in, unique] const struct WSLA_REGISTRY_AUTHENTICATION_INFORMATION* RegistryAuthenticationInformation, [in, unique] IProgressCallback* ProgressCallback);
-    HRESULT LoadImage([in] ULONG ImageHandle, [in, unique] IProgressCallback* ProgressCallback);
-    HRESULT ImportImage([in] ULONG ImageHandle, [in] LPCSTR ImageName, [in, unique] IProgressCallback* ProgressCallback);
+    HRESULT LoadImage([in] ULONG ImageHandle, [in, unique] IProgressCallback* ProgressCallback, [in] ULONGLONG ContentLength);
+    HRESULT ImportImage([in] ULONG ImageHandle, [in] LPCSTR ImageName, [in, unique] IProgressCallback* ProgressCallback, [in] ULONGLONG ContentLength);
     HRESULT ListImages([out, size_is(, *Count)] struct WSLA_IMAGE_INFORMATION** Images, [out] ULONG* Count);
     HRESULT DeleteImage([in] LPCWSTR Image);
 
diff --git a/test/windows/WSLATests.cpp b/test/windows/WSLATests.cpp
index 38dfbc395..d46f226d9 100644
--- a/test/windows/WSLATests.cpp
+++ b/test/windows/WSLATests.cpp
@@ -52,6 +52,9 @@ class WSLATests
         testVhd = std::filesystem::path{vhdPath} / "ext4.vhdx";
         storagePath = std::filesystem::current_path() / "test-storage";
 
+        auto session = CreateSession();
+        VERIFY_SUCCEEDED(session->PullImage("debian:latest", nullptr, nullptr));
+        VERIFY_SUCCEEDED(session->PullImage("python:3.12-alpine", nullptr, nullptr));
         WslShutdown();
         return true;
     }
@@ -80,6 +83,7 @@ class WSLATests
         settings.BootTimeoutMs = 30 * 1000;
         settings.StoragePath = storagePath.c_str();
         settings.MaximumStorageSizeMb = 1000; // 1GB.
+        settings.NetworkingMode = WSLANetworkingModeNAT;
 
         return settings;
     }
@@ -271,6 +275,20 @@ class WSLATests
         VERIFY_ARE_EQUAL(hr, HRESULT_FROM_WIN32(ERROR_NOT_FOUND));
     }
 
+    void ExpectImagePresent(IWSLASession& Session, const char* Image)
+    {
+        wil::unique_cotaskmem_array_ptr<WSLA_IMAGE_INFORMATION> images;
+        THROW_IF_FAILED(Session.ListImages(images.addressof(), images.size_address<ULONG>()));
+
+        std::vector<std::string> tags;
+        for (const auto& e : images)
+        {
+            tags.push_back(e.Image);
+        }
+
+        VERIFY_IS_TRUE(std::ranges::find(tags, Image) != tags.end());
+    }
+
     TEST_METHOD(PullImage)
     {
         WSL2_TEST_ONLY();
@@ -281,15 +299,15 @@ class WSLATests
 
         auto session = CreateSession(settings);
 
-        VERIFY_SUCCEEDED(session->PullImage("hello-world", nullptr, nullptr));
+        VERIFY_SUCCEEDED(session->PullImage("hello-world:latest", nullptr, nullptr));
 
         // Verify that the image is in the list of images.
-        WSLAProcessLauncher launcher("/usr/bin/nerdctl", {"/usr/bin/nerdctl", "images"});
-        auto listImagesResult = launcher.Launch(*session).WaitAndCaptureOutput();
-        VERIFY_ARE_EQUAL(0, listImagesResult.Code);
-        VERIFY_IS_TRUE(listImagesResult.Output[1].find("hello-world") != std::string::npos);
+        ExpectImagePresent(*session, "hello-world:latest");
+
+        // TODO: Check that the image can actually be used to start a container.
     }
 
+    // TODO: Test that invalid tars are correctly handled.
     TEST_METHOD(LoadImage)
     {
         WSL2_TEST_ONLY();
@@ -304,15 +322,23 @@ class WSLATests
             CreateFileW(imageTar.c_str(), GENERIC_READ, FILE_SHARE_READ, nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr)};
         VERIFY_IS_FALSE(INVALID_HANDLE_VALUE == imageTarFileHandle.get());
 
-        VERIFY_SUCCEEDED(session->LoadImage(HandleToULong(imageTarFileHandle.get()), nullptr));
+        LARGE_INTEGER fileSize{};
+        VERIFY_IS_TRUE(GetFileSizeEx(imageTarFileHandle.get(), &fileSize));
+
+        VERIFY_SUCCEEDED(session->LoadImage(HandleToULong(imageTarFileHandle.get()), nullptr, fileSize.QuadPart));
 
         // Verify that the image is in the list of images.
-        WSLAProcessLauncher launcher("/usr/bin/nerdctl", {"/usr/bin/nerdctl", "images"});
-        auto listImagesResult = launcher.Launch(*session).WaitAndCaptureOutput();
-        VERIFY_ARE_EQUAL(0, listImagesResult.Code);
-        VERIFY_IS_TRUE(listImagesResult.Output[1].find("hello-world") != std::string::npos);
+        ExpectImagePresent(*session, "hello-world:latest");
+        WSLAContainerLauncher launcher("hello-world:latest", "wsla-import-image-container");
+
+        auto container = launcher.Launch(*session);
+        auto result = container.GetInitProcess().WaitAndCaptureOutput();
+
+        VERIFY_ARE_EQUAL(0, result.Code);
+        VERIFY_IS_TRUE(result.Output[1].find("Hello from Docker!") != std::string::npos);
     }
 
+    // TODO: Test that invalid tars are correctly handled.
     TEST_METHOD(ImportImage)
     {
         WSL2_TEST_ONLY();
@@ -327,13 +353,21 @@ class WSLATests
             CreateFileW(imageTar.c_str(), GENERIC_READ, FILE_SHARE_READ, nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr)};
         VERIFY_IS_FALSE(INVALID_HANDLE_VALUE == imageTarFileHandle.get());
 
-        VERIFY_SUCCEEDED(session->ImportImage(HandleToULong(imageTarFileHandle.get()), "my-hello-world:test", nullptr));
+        LARGE_INTEGER fileSize{};
+        VERIFY_IS_TRUE(GetFileSizeEx(imageTarFileHandle.get(), &fileSize));
 
-        // Verify that the image is in the list of images.
-        WSLAProcessLauncher launcher("/usr/bin/nerdctl", {"/usr/bin/nerdctl", "images"});
-        auto listImagesResult = launcher.Launch(*session).WaitAndCaptureOutput();
-        VERIFY_ARE_EQUAL(0, listImagesResult.Code);
-        VERIFY_IS_TRUE(listImagesResult.Output[1].find("my-hello-world") != std::string::npos);
+        VERIFY_SUCCEEDED(session->ImportImage(HandleToULong(imageTarFileHandle.get()), "my-hello-world:test", nullptr, fileSize.QuadPart));
+
+        ExpectImagePresent(*session, "my-hello-world:test");
+
+        // Validate that containers can be started from the imported image.
+        WSLAContainerLauncher launcher("my-hello-world:test", "wsla-import-image-container", "/hello");
+
+        auto container = launcher.Launch(*session);
+        auto result = container.GetInitProcess().WaitAndCaptureOutput();
+
+        VERIFY_ARE_EQUAL(0, result.Code);
+        VERIFY_IS_TRUE(result.Output[1].find("Hello from Docker!") != std::string::npos);
     }
 
     TEST_METHOD(CustomDmesgOutput)
@@ -1215,6 +1249,16 @@ class WSLATests
             ValidateProcessOutput(process, {{1, "testvalue\n"}});
         }
 
+        // Validate that exit codes are correctly wired.
+        {
+            WSLAContainerLauncher launcher("debian:latest", "test-exit-code", "/bin/sh", {"-c", "exit 12"});
+            auto container = launcher.Launch(*session);
+            auto process = container.GetInitProcess();
+
+            ValidateProcessOutput(process, {}, 12);
+        }
+
+        // Validate that stdin is correctly wired
         {
             WSLAContainerLauncher launcher(
                 "debian:latest",
@@ -1225,13 +1269,8 @@ class WSLATests
                 WSLA_CONTAINER_NETWORK_TYPE::WSLA_CONTAINER_NETWORK_HOST,
                 ProcessFlags::Stdin | ProcessFlags::Stdout | ProcessFlags::Stderr);
 
-            // For now, validate that trying to use stdin without a tty returns the appropriate error.
-            auto result = wil::ResultFromException([&]() { auto container = launcher.Launch(*session); });
-            VERIFY_ARE_EQUAL(result, HRESULT_FROM_WIN32(ERROR_NOT_SUPPORTED));
+            auto container = launcher.Launch(*session);
 
-            // TODO: nerdctl hangs if stdin is closed without writing to it.
-            // Add test coverage for that usecase once the hang is fixed.
-            /*
             auto process = container.GetInitProcess();
             auto input = process.GetStdHandle(0);
 
@@ -1247,19 +1286,17 @@ class WSLATests
 
             VERIFY_ARE_EQUAL(result.Output[2], "");
             VERIFY_ARE_EQUAL(result.Output[1], "foo");
-            */
         }
 
-        // Validate that stdin is empty if ProcessFlags::Stdin is not passed.
-        // TODO: This fails because nerdctl start always seems to hang on stdin.
-        /*
+        // Validate that stdin behaves correctly if closed without any input.
         {
             WSLAContainerLauncher launcher("debian:latest", "test-stdin", "/bin/cat");
             auto container = launcher.Launch(*session);
             auto process = container.GetInitProcess();
+            process.GetStdHandle(0); // Close stdin;
 
             ValidateProcessOutput(process, {{1, ""}});
-        }*/
+        }
 
         // Validate error paths
         {
@@ -1348,8 +1385,7 @@ class WSLATests
             }
 
             // Create a stuck container.
-            WSLAContainerLauncher launcher(
-                "debian:latest", "test-container-1", "sleep", {"sleep", "99999"}, {}, WSLA_CONTAINER_NETWORK_TYPE::WSLA_CONTAINER_NETWORK_HOST);
+            WSLAContainerLauncher launcher("debian:latest", "test-container-1", {}, {"sleep", "99999"});
 
             auto container = launcher.Launch(*session);
 
@@ -1361,7 +1397,7 @@ class WSLATests
 
             // Kill the container init process and expect it to be in exited state.
             auto initProcess = container.GetInitProcess();
-            initProcess.Get().Signal(9);
+            VERIFY_SUCCEEDED(initProcess.Get().Signal(9));
 
             // Wait for the process to actually exit.
             wsl::shared::retry::RetryWithTimeout<void>(
@@ -1487,6 +1523,30 @@ class WSLATests
             VERIFY_ARE_EQUAL(result.Code, 0);
         }
 
+        // Validate that creating and starting a container separately behaves as expected
+
+        {
+            WSLAContainerLauncher launcher("debian:latest", "test-create", "sleep", {"99999"}, {});
+            auto [result, container] = launcher.CreateNoThrow(*session);
+            VERIFY_SUCCEEDED(result);
+
+            VERIFY_ARE_EQUAL(container->State(), WslaContainerStateCreated);
+            VERIFY_SUCCEEDED(container->Get().Start());
+
+            // Verify that Start() can't be called again on a running container.
+            VERIFY_ARE_EQUAL(container->Get().Start(), HRESULT_FROM_WIN32(ERROR_INVALID_STATE));
+
+            VERIFY_ARE_EQUAL(container->State(), WslaContainerStateRunning);
+
+            VERIFY_SUCCEEDED(container->Get().Stop(9, 0));
+            VERIFY_ARE_EQUAL(container->State(), WslaContainerStateExited);
+
+            VERIFY_SUCCEEDED(container->Get().Delete());
+
+            WSLA_CONTAINER_STATE state{};
+            VERIFY_ARE_EQUAL(container->Get().GetState(&state), RPC_E_DISCONNECTED);
+        }
+
         // Validate that containers behave correctly if they outlive their session.
         {
             WSLAContainerLauncher launcher("debian:latest", "test-dangling-ref", "sleep", {"99999"}, {});
@@ -1544,11 +1604,9 @@ class WSLATests
 
             auto container = launcher.Launch(*session);
             VERIFY_ARE_EQUAL(container.State(), WslaContainerStateRunning);
-            auto result = ExpectCommandResult(
-                session.get(),
-                {"/usr/bin/nerdctl", "inspect", "-f", "'{{ index .Config.Labels \"nerdctl/networks\" }}'", "test-network"},
-                0);
-            VERIFY_ARE_EQUAL(result.Output[1], "'[\"host\"]'\n");
+
+            auto details = container.Inspect();
+            VERIFY_ARE_EQUAL(details.HostConfig.NetworkMode, "host");
 
             VERIFY_SUCCEEDED(container.Get().Stop(15, 0));
 
@@ -1575,11 +1633,8 @@ class WSLATests
 
             auto container = launcher.Launch(*session);
             VERIFY_ARE_EQUAL(container.State(), WslaContainerStateRunning);
-            auto result = ExpectCommandResult(
-                session.get(),
-                {"/usr/bin/nerdctl", "inspect", "-f", "'{{ index .Config.Labels \"nerdctl/networks\" }}'", "test-network"},
-                0);
-            VERIFY_ARE_EQUAL(result.Output[1], "'[\"none\"]'\n");
+
+            VERIFY_ARE_EQUAL(container.Inspect().HostConfig.NetworkMode, "none");
 
             VERIFY_SUCCEEDED(container.Get().Stop(15, 0));
 
@@ -1608,7 +1663,6 @@ class WSLATests
             VERIFY_ARE_EQUAL(retVal.first, E_INVALIDARG);
         }
 
-        // Test bridge when ready
         {
             WSLAContainerLauncher launcher(
                 "debian:latest",
@@ -1621,11 +1675,7 @@ class WSLATests
 
             auto container = launcher.Launch(*session);
             VERIFY_ARE_EQUAL(container.State(), WslaContainerStateRunning);
-            auto result = ExpectCommandResult(
-                session.get(),
-                {"/usr/bin/nerdctl", "inspect", "-f", "'{{ index .Config.Labels \"nerdctl/networks\" }}'", "test-network"},
-                0);
-            VERIFY_ARE_EQUAL(result.Output[1], "'[\"bridge\"]'\n");
+            VERIFY_ARE_EQUAL(container.Inspect().HostConfig.NetworkMode, "bridge");
 
             VERIFY_SUCCEEDED(container.Get().Stop(15, 0));
 
@@ -1770,17 +1820,14 @@ class WSLATests
 
         auto session = CreateSession(settings);
 
-        auto expectBoundPorts = [&](const char* Name, const std::vector<std::string>& expectedBoundPorts) {
-            auto result = ExpectCommandResult(session.get(), {"/usr/bin/nerdctl", "inspect", Name}, 0);
-
-            auto parsed = nlohmann::json::parse(result.Output[1]);
-            auto ports = parsed[0]["HostConfig"]["PortBindings"];
+        auto expectBoundPorts = [&](RunningWSLAContainer& Container, const std::vector<std::string>& expectedBoundPorts) {
+            auto ports = Container.Inspect().HostConfig.PortBindings;
 
             std::vector<std::string> boundPorts;
 
-            for (const auto& e : ports.items())
+            for (const auto& e : ports)
             {
-                boundPorts.emplace_back(e.key());
+                boundPorts.emplace_back(e.first);
             }
 
             if (!std::ranges::equal(boundPorts, expectedBoundPorts))
@@ -1809,7 +1856,7 @@ class WSLATests
             // Wait for the container bind() to be completed.
             WaitForOutput(stdoutHandle.get(), "Serving HTTP on 0.0.0.0 port 8000");
 
-            expectBoundPorts("test-ports", {"8000/tcp"});
+            expectBoundPorts(container, {"8000/tcp"});
 
             ExpectHttpResponse(L"http://127.0.0.1:1234", 200);
             ExpectHttpResponse(L"http://[::1]:1234", {});
@@ -1841,7 +1888,7 @@ class WSLATests
                 // Wait for the container bind() to be completed.
                 WaitForOutput(stdoutHandle.get(), "Serving HTTP on 0.0.0.0 port 8000");
 
-                expectBoundPorts("test-ports-3", {"8000/tcp"});
+                expectBoundPorts(container, {"8000/tcp"});
                 ExpectHttpResponse(L"http://127.0.0.1:1234", 200);
 
                 VERIFY_SUCCEEDED(container.Get().Stop(9, 0));