Arcane vs Portwing
Arcane v2.5 is a broad Docker management platform with direct and edge agents, polling, automated mTLS, RBAC, GitOps, scanning, and Swarm. Portwing v0.9.2 is a narrower access agent for Drydock, focused on replay-resistant signed requests, transparent Docker compatibility, Sockguard policy, and mediation-point audit. Reviewed July 28, 2026.
Feature Comparison
Here's how we compare on the features that matter most.
| Feature | Arcane | Portwing |
|---|---|---|
| Remote Docker control | Yes (Arcane Agent) | Yes (Portwing agent) |
| Connection modes | Direct; edge over gRPC/WebSocket; polling option | Standard HTTP/S; persistent edge WebSocket |
| Agent authentication | Environment token; optional or required auto-enrolled mTLS | Ed25519 per-request HTTP signatures; signed edge hello |
| Transparent Docker API | No (Arcane-specific API) | Yes |
| Docker socket hardening | Optional Tecnativa category-level proxy | Recommended Sockguard path-and-method policy |
| Audit location | Controller activities and security audit events | Structured records at the agent mediation point |
| Release verification | Cosign-verifiable artifacts and images | Cosign + CycloneDX SBOM + SLSA provenance |
| Fleet UI, RBAC, GitOps, scans, and Swarm | Yes | Owned by Drydock; Swarm is an agent non-goal |
| Prometheus agent scrape endpoint | Not documented | Yes |
| MCP server (read-only) | Not documented | Yes |
| License | BSD-3-Clause | AGPL-3.0 |
Key Differentiators
What we built that Arcane doesn't cover.
Different Strong Auth Models
Arcane can automatically enroll and renew mTLS certificates. Portwing signs each standard-mode HTTP request and the edge hello with Ed25519. Both are strong, but they solve credential lifecycle differently.
Narrower Socket Policy
Arcane documents an optional Tecnativa proxy using broad Docker API categories. Portwing's hardened deployment uses Sockguard rules scoped by HTTP method and path.
Transparent Docker Compatibility
Portwing preserves Docker Engine request and response formats for compatible clients. Arcane exposes its own controller API and UI workflows.
Mediation-Point Audit
Portwing records API, authentication, enrollment, Compose, and exec activity at the host agent and supports cursor-based export. Arcane records controller activities and security events.
Both Publish Verifiable Artifacts
Arcane documents Cosign verification for release artifacts and images. Portwing adds a CycloneDX SBOM and SLSA provenance to its signed release set.
Read-Only MCP
Portwing exposes five read-only host and container inspection tools over MCP. Arcane does not document an MCP endpoint in the reviewed v2.5 material.
Evaluating Arcane Agent?
Choose the controller first. Arcane Agent belongs to Arcane's integrated UI and fleet model; Portwing belongs to Drydock and can also expose a generic REST or transparent Docker API. If moving to Portwing, use the matching Sockguard preset and Ed25519 keys, then validate every required Arcane workflow against Drydock rather than assuming controller-level parity.
$ docker run -d \
--name portwing \
--read-only --cap-drop=ALL \
--security-opt no-new-privileges:true \
-v /var/run/docker.sock:/var/run/docker.sock:ro \
-e TOKEN_HASH="$PORTWING_TOKEN_HASH" \
-p 3000:3000 \
ghcr.io/codeswhat/portwing:latestReady to try Portwing?
Security-first, AGPL-3.0, no SaaS required. Drop a secure foothold on any Docker host in minutes.