Sounds like a loop hole to run WSL and let compliance only check the host OS and not the WSL OS

I have been thinking about it until I realize that nginx still can have zero days vulnerabilities that could be even in the tls layer or so and decided to actually close the port completely in the Firewall and just run Wireguard on devices. And as fallback I have external program that have a webbserver with qr code with link and ip query encrypted so when i scan it on smartphone i have to follow the link to internal server that i only can access with Wireguard so then only that public ip is then added to my Firewall rules temporary.

I recent noticed my drive is dying but it cost about the same as I bought it for, 12 years ago.