Linux, containers or Windows? Where SQL Server belongs

/* PSG Stack · SQL Server on Linux and Docker · Query 1   What does this instance use that is missing on Linux or needs rework?   Meant for your existing instance, before you decide on a move to Linux or into a   container. Result: one row per check, hits first.    !!! WARNING — please read before running !!!   - Read-only. The query changes no data and no setting; it only creates three     temporary tables in tempdb.   - Permissions: simplest as sysadmin. Otherwise VIEW SERVER STATE, VIEW ANY DEFINITION,     read access in msdb (db_datareader) and access to the databases. Without VIEW ANY     DEFINITION, SQL Server hides other logins, endpoints and linked servers; the note     column reports this, as well as anything that could not be read.   - MAXDOP 1: every part of the query runs serially.   - It goes through every database that is online and that you can access. With a very     large number of databases, run it outside peak hours.   - Basis: Microsoft's list of features not available on Linux for SQL Server 2022 and     2025 (read on Nov 11 and 12, 2026). No substitute for testing the application; it does     not check MSDTC, managed backup, Analysis Services or Reporting Services.   - SQL Server 2017 and later. Tested in the PSG lab on 2017, 2019, 2022 and 2025 in Linux     containers, with test objects as far as Linux allows creating them (Nov 12, 2026). Not     tested on Windows, where it will run before a move; it only reads catalog views that     exist there as well.*/SET NOCOUNT ON;SET QUOTED_IDENTIFIER ON;   -- sqlcmd starts without it; the XML methods below need it IF OBJECT_ID(N'tempdb..#checks') IS NOT NULL DROP TABLE #checks;IF OBJECT_ID(N'tempdb..#hits')   IS NOT NULL DROP TABLE #hits;IF OBJECT_ID(N'tempdb..#db')     IS NOT NULL DROP TABLE #db;CREATE TABLE #checks (nr int PRIMARY KEY, area nvarchar(30), check_name nvarchar(120), classification nvarchar(30), note nvarchar(200) NULL);CREATE TABLE #hits   (nr int, object_name nvarchar(300));CREATE TABLE #db     (name sysname, checked bit); INSERT #checks (nr, area, check_name, classification) VALUES ( 1, N'Instance',    N'Named instance (Linux: one default instance per host)',           N'with effort'), ( 2, N'Instance',    N'xp_cmdshell enabled',                                             N'missing on Linux'), ( 3, N'Instance',    N'Custom extended stored procedures',                               N'missing on Linux'), ( 4, N'Instance',    N'Buffer pool extension active',                                    N'missing on Linux'), ( 5, N'Instance',    N'Linked servers to sources other than SQL Server',                 N'missing on Linux'), ( 6, N'Instance',    N'Ad Hoc Distributed Queries enabled',                              N'check'), ( 7, N'Security',    N'Windows logins and groups',                                       N'with effort'), ( 8, N'Security',    N'Endpoints with Windows authentication',                           N'with effort'), ( 9, N'Security',    N'EKM providers (Linux: Azure Key Vault only, 2022 CU12 and later)', N'check'), (10, N'HA',          N'Database mirroring',                                              N'missing on Linux'), (11, N'Agent',       N'Job steps CmdExec, PowerShell, SSIS, SSAS, Queue Reader',         N'missing on Linux'), (12, N'Agent',       N'Alerts',                                                          N'missing on Linux'), (13, N'Agent',       N'Maintenance plans',                                               N'missing on Linux'), (14, N'Services',    N'SSIS catalog (SSISDB) present',                                   N'check'), (15, N'Databases',   N'Merge replication (published)',                                   N'missing on Linux'), (16, N'Databases',   N'Stretch Database',                                                N'missing on Linux'), (17, N'Databases',   N'FILESTREAM filegroups',                                           N'missing on Linux'), (18, N'Databases',   N'FileTables',                                                      N'missing on Linux'), (19, N'Databases',   N'CLR assemblies with EXTERNAL_ACCESS or UNSAFE',                   N'missing on Linux'), (20, N'Databases',   N'Always Encrypted with secure enclaves',                           N'missing on Linux'); /* Without VIEW ANY DEFINITION the catalog views show only part of the objects */IF HAS_PERMS_BY_NAME(NULL, NULL, 'VIEW ANY DEFINITION') = 0  UPDATE #checks SET note = N'incomplete: only partly visible without VIEW ANY DEFINITION' WHERE nr IN (3, 5, 7, 8, 9, 19); /* 1 · Instance and security */INSERT #hits SELECT 1, CONVERT(nvarchar(300), SERVERPROPERTY('InstanceName')) WHERE SERVERPROPERTY('InstanceName') IS NOT NULL;INSERT #hits SELECT 2, N'xp_cmdshell = 1' FROM sys.configurations WHERE name = N'xp_cmdshell' AND CONVERT(int, value_in_use) = 1 OPTION (MAXDOP 1);INSERT #hits SELECT 3, name FROM master.sys.extended_procedures WHERE is_ms_shipped = 0 OPTION (MAXDOP 1);BEGIN TRY  INSERT #hits SELECT 4, path FROM sys.dm_os_buffer_pool_extension_configuration WHERE state <> 0 OPTION (MAXDOP 1);END TRY BEGIN CATCH UPDATE #checks SET note = N'not readable: ' + ERROR_MESSAGE() WHERE nr = 4; END CATCH;INSERT #hits SELECT 5, name + N' (' + provider + N')' FROM sys.servers WHERE is_linked = 1 AND NOT (product = N'SQL Server' OR provider LIKE N'SQLNCLI%' OR provider LIKE N'MSOLEDBSQL%' OR provider = N'SQLOLEDB') OPTION (MAXDOP 1);INSERT #hits SELECT 6, N'Ad Hoc Distributed Queries = 1' FROM sys.configurations WHERE name = N'Ad Hoc Distributed Queries' AND CONVERT(int, value_in_use) = 1 OPTION (MAXDOP 1);INSERT #hits SELECT 7, name FROM sys.server_principals WHERE type IN ('U', 'G') AND name NOT LIKE N'NT SERVICE\%' AND name NOT LIKE N'NT AUTHORITY\%' AND name NOT LIKE N'BUILTIN\%' OPTION (MAXDOP 1);INSERT #hits SELECT 8, name + N' (' + connection_auth_desc + N')' FROM sys.database_mirroring_endpoints WHERE connection_auth_desc LIKE N'%NTLM%' OR connection_auth_desc LIKE N'%KERBEROS%' OR connection_auth_desc LIKE N'%NEGOTIATE%' OPTION (MAXDOP 1);INSERT #hits SELECT 9, name FROM sys.cryptographic_providers OPTION (MAXDOP 1);INSERT #hits SELECT 10, DB_NAME(database_id) FROM sys.database_mirroring WHERE mirroring_guid IS NOT NULL OPTION (MAXDOP 1);INSERT #hits SELECT 14, name FROM sys.databases WHERE name = N'SSISDB' OPTION (MAXDOP 1);INSERT #hits SELECT 15, name FROM sys.databases WHERE is_merge_published = 1 OPTION (MAXDOP 1);IF EXISTS (SELECT 1 FROM sys.all_columns WHERE object_id = OBJECT_ID(N'sys.databases') AND name = N'is_remote_data_archive_enabled')  EXEC (N'INSERT #hits SELECT 16, name FROM sys.databases WHERE is_remote_data_archive_enabled = 1 OPTION (MAXDOP 1);'); /* 2 · SQL Server Agent and maintenance plans in msdb */BEGIN TRY  INSERT #hits SELECT 11, j.name + N' / ' + s.step_name + N' (' + s.subsystem + N')'  FROM msdb.dbo.sysjobsteps AS s JOIN msdb.dbo.sysjobs AS j ON j.job_id = s.job_id  WHERE s.subsystem IN (N'CmdExec', N'PowerShell', N'SSIS', N'ANALYSISQUERY', N'ANALYSISCOMMAND', N'QueueReader')  OPTION (MAXDOP 1);END TRY BEGIN CATCH UPDATE #checks SET note = N'not readable: ' + ERROR_MESSAGE() WHERE nr = 11; END CATCH;BEGIN TRY  INSERT #hits SELECT 12, name FROM msdb.dbo.sysalerts OPTION (MAXDOP 1);END TRY BEGIN CATCH UPDATE #checks SET note = N'not readable: ' + ERROR_MESSAGE() WHERE nr = 12; END CATCH;BEGIN TRY  INSERT #hits SELECT 13, name FROM msdb.dbo.sysmaintplan_plans OPTION (MAXDOP 1);END TRY BEGIN CATCH UPDATE #checks SET note = N'not readable: ' + ERROR_MESSAGE() WHERE nr = 13; END CATCH; /* 3 · Per database: FILESTREAM, FileTables, CLR, secure enclaves */DECLARE @db sysname, @sql nvarchar(max),        @enclave bit = CASE WHEN EXISTS (SELECT 1 FROM sys.all_columns WHERE object_id = OBJECT_ID(N'sys.column_master_keys')                                         AND name = N'allow_enclave_computations') THEN 1 ELSE 0 END;INSERT #db SELECT name, 0 FROM sys.databases WHERE database_id <> 2 OPTION (MAXDOP 1);DECLARE dbs CURSOR LOCAL FAST_FORWARD FOR  SELECT name FROM sys.databases WHERE database_id <> 2 AND state = 0 AND HAS_DBACCESS(name) = 1;OPEN dbs; FETCH NEXT FROM dbs INTO @db;WHILE @@FETCH_STATUS = 0BEGIN  SET @sql = N'USE ' + QUOTENAME(@db) + N';    INSERT #hits SELECT 17, DB_NAME() + N'': '' + name FROM sys.database_files WHERE type = 2 OPTION (MAXDOP 1);    INSERT #hits SELECT 18, DB_NAME() + N'': '' + name FROM sys.tables WHERE is_filetable = 1 OPTION (MAXDOP 1);    INSERT #hits SELECT 19, DB_NAME() + N'': '' + name + N'' ('' + permission_set_desc + N'')''      FROM sys.assemblies WHERE is_user_defined = 1 AND permission_set > 1 OPTION (MAXDOP 1);'    + CASE WHEN @enclave = 1 THEN N'    INSERT #hits SELECT 20, DB_NAME() + N'': '' + name FROM sys.column_master_keys WHERE allow_enclave_computations = 1 OPTION (MAXDOP 1);' ELSE N'' END;  BEGIN TRY    EXEC sys.sp_executesql @sql;    UPDATE #db SET checked = 1 WHERE name = @db;  END TRY BEGIN CATCH END CATCH;  FETCH NEXT FROM dbs INTO @db;END;CLOSE dbs; DEALLOCATE dbs;UPDATE #checks SET note = ISNULL(note + N'; ', N'') + CONVERT(nvarchar(10), (SELECT COUNT(*) FROM #db WHERE checked = 1)) + N' databases checked'  + ISNULL(N', not checked (offline or no access): ' + STUFF((SELECT N', ' + name FROM #db WHERE checked = 0 FOR XML PATH(''), TYPE).value('.', 'nvarchar(max)'), 1, 2, N''), N'')WHERE nr BETWEEN 17 AND 20; /* Result: hits first, at most five examples per check */SELECT c.nr, c.area, c.check_name,       COUNT(h.object_name) AS hits,       CASE WHEN COUNT(h.object_name) = 0 THEN N'-' ELSE c.classification END AS classification,       ISNULL(STUFF((SELECT TOP (5) N', ' + h2.object_name FROM #hits AS h2 WHERE h2.nr = c.nr ORDER BY h2.object_name              FOR XML PATH(''), TYPE).value('.', 'nvarchar(max)'), 1, 2, N''), N'') AS examples,       ISNULL(c.note, N'') AS noteFROM #checks AS c LEFT JOIN #hits AS h ON h.nr = c.nrGROUP BY c.nr, c.area, c.check_name, c.classification, c.noteORDER BY CASE WHEN COUNT(h.object_name) > 0 THEN 0 ELSE 1 END, c.nrOPTION (MAXDOP 1);

nr  area       check_name                                               hits  classification    examples
--  ---------  -------------------------------------------------------  ----  ----------------  ------------------------------------------------
6   Instance   Ad Hoc Distributed Queries enabled                       1     check             Ad Hoc Distributed Queries = 1
8   Security   Endpoints with Windows authentication                    1     with effort       lx_hadr (NEGOTIATE)
11  Agent      Job steps CmdExec, PowerShell, SSIS, SSAS, Queue Reader  2     missing on Linux  lx_job / cmd (CmdExec), lx_job / ps (PowerShell)
12  Agent      Alerts                                                   1     missing on Linux  lx_alert
20  Databases  Always Encrypted with secure enclaves                    1     missing on Linux  lx_app: lx_cmk
1   Instance   Named instance (Linux: one default instance per host)    0     -
2   Instance   xp_cmdshell enabled                                      0     -
3   Instance   Custom extended stored procedures                        0     -
…