Arcane vs Portwing
Arcane v2.17.1 is a broad Docker management platform with direct and edge agents, poll-managed tunnels, RBAC, GitOps, scanning, Swarm, and opt-in edge mTLS that issues ML-DSA-87 post-quantum certificates from a freshly generated CA. An existing ECDSA P-384 CA keeps issuing P-384 client certificates. Portwing v1.1.0 is a narrower access agent for Drydock, focused on replay-resistant signed requests, transparent Docker compatibility, Sockguard policy, and mediation-point audit. Reviewed October 26, 2026.
Feature Comparison
Here's how we compare on the features that matter most.
| Feature | Arcane | Portwing |
|---|---|---|
| Remote Docker control | On par: Yes (Arcane Agent) | On par: Yes (Portwing agent) |
| Connection modes | Stronger: Direct; persistent edge; poll-managed on-demand tunnel | Weaker: Standard HTTP/S; persistent edge WebSocket |
| Agent authentication | On par: Environment credential; optional auto-enrolled mTLS with ML-DSA-87 certificates from new edge CAs | On par: Request-bound Ed25519 HTTP signatures or configured shared secret; signed edge hello; classical signatures |
| Transparent Docker API | Weaker: No (Arcane-specific API) | Stronger: Yes |
| Docker socket hardening | On par: Recommended wollomatic method/path proxy for the manager; raw-socket remote-agent examples | On par: Recommended Sockguard method/path presets for the agent |
| Audit location | On par: Agent/controller events; OTLP logs and traces | On par: Structured agent request audit with cursor-based NDJSON export |
| Release verification | On par: Verified Cosign images/checksums; SPDX SBOMs and build provenance | On par: Cosign + CycloneDX SBOM + SLSA Build L2 provenance |
| Fleet UI, RBAC, GitOps, scans, and Swarm | Stronger: Yes | Weaker: Owned by Drydock; Swarm is an agent non-goal |
| Prometheus agent scrape endpoint | On par: Yes, opt-in exporter; also OTLP | On par: Yes |
| Documented read-only MCP endpoint | Weaker: Not documented | Stronger: Yes |
| License | On par: BSD-3-Clause | On par: MIT |
Comparison Details
Authentication, socket policy, telemetry, release evidence, and controller scope.
Different Authentication Options
Arcane offers opt-in edge mTLS with ML-DSA-87 certificates from newly generated CAs. Existing P-384 CAs remain classical, and the environment credential remains part of the edge flow. This does not establish post-quantum key exchange. Portwing uses classical Ed25519 for request-bound HTTP signatures and its signed edge hello; standard mode can also use configured shared-secret authentication.
Compare the Actual Socket Policy
Arcane recommends a wollomatic method/path allowlist for its manager, including builds and Swarm. Its remote-agent examples mount the raw socket. Portwing recommends Sockguard presets scoped to the agent's needs, with builds denied by default and explicit opt-in build presets.
Transparent Docker Compatibility
Portwing preserves Docker Engine request and response formats for compatible clients. Arcane exposes its own controller API and UI workflows.
Mediation-Point Audit
Portwing records API, authentication, enrollment, Compose, and exec activity at the host agent and supports cursor-based export. Arcane persists agent and controller events and can export logs and traces through OTLP.
Both Publish Verifiable Artifacts
Arcane image signatures and signed checksums verified successfully; its images also carry SPDX SBOMs and BuildKit/GitHub provenance statements. Portwing publishes Cosign signatures, CycloneDX SBOMs, and SLSA Build L2 provenance. SBOM format is a difference, not evidence that Arcane lacks provenance.
Read-Only MCP
Portwing exposes five read-only host and container inspection tools over MCP. Arcane does not document an MCP endpoint in the reviewed v2.17.1 material.
Evaluating Arcane Agent?
Choose the controller first. Arcane Agent belongs to Arcane's integrated UI and fleet model; Portwing belongs to Drydock and can also expose a generic REST or transparent Docker API. If moving to Portwing, use the matching Sockguard preset and Ed25519 keys, then validate every required Arcane workflow against Drydock rather than assuming controller-level parity.
$ docker run -d \
--name portwing \
--read-only --cap-drop=ALL \
--security-opt no-new-privileges:true \
-v /var/run/docker.sock:/var/run/docker.sock:ro \
-e TOKEN_HASH="$PORTWING_TOKEN_HASH" \
-p 3000:3000 \
ghcr.io/codeswhat/portwing:1.1.0Needs TOKEN_HASH: an Argon2id hash from portwing hash-token. For per-client keys, run portwing keygen and set AUTHORIZED_KEYS instead.
Ready to try Portwing?
Security-first, MIT-licensed, no SaaS required. Drop a secure foothold on any Docker host in minutes.