Diun vs Portwing
Diun (Docker Image Update Notifier) polls container registries for new tags and fires notifications to 20+ channels. Portwing is a remote access agent — it gives the Drydock controller a secure authenticated foothold on a Docker host. These tools are complementary: run Diun for registry monitoring and Portwing for remote Docker control from Drydock.
Feature Comparison
Here's how we compare on the features that matter most.
| Feature | Diun | Portwing |
|---|---|---|
| Image update notifications | Yes (multi-registry polling + 20+ notifiers) | No (Drydock notifies; Portwing is the access agent) |
| Remote Docker API proxy | No (monitoring only, no remote control) | Yes (full Docker API proxy with auth) |
| Auth for remote access | No (local only) | Yes (Ed25519 per-request signing) |
| Structured audit log | No | Yes (JSON, built-in) |
| Signed release artifacts | No | Yes (cosign + archive/image SBOMs + SLSA) |
| Default-deny socket filter | No | Yes (with sockguard) |
| Prometheus metrics | Yes | Yes |
| MCP server (AI-native, read-only) | No | Yes |
| Edge / NAT outbound tunnel | No | Yes (Drydock v1.6.0-rc.11+) |
| Single lightweight Go binary | Yes | Yes (~10 MB) |
| License | MIT | AGPL-3.0 |
Key Differentiators
What we built that Diun doesn't cover.
Remote Auth (Ed25519)
Diun has no remote access model — it runs locally and pushes notifications outward. Portwing exposes the Docker API over authenticated HTTP with Ed25519 per-request signing so each client gets a revocable key pair.
Default-Deny Socket Filter
Portwing pairs with sockguard to constrain Docker API calls at the socket level. Diun mounts the raw socket and has no filtering layer.
Structured Audit Log
Portwing logs every Docker API call it proxies as structured JSON for export to immutable storage. Diun has no audit trail beyond its own notification records.
Signed Release Artifacts
Portwing publishes cosign signatures, CycloneDX SBOMs, and SLSA build provenance for its own releases. Diun detects new tags but does not publish an equivalent signed release bundle.
MCP Server (AI-Native)
Portwing ships a read-only MCP server so AI tools can inspect containers, images, and events. Diun has no MCP support.
Complementary, Not Competing
Diun and Portwing solve different problems and run happily side-by-side. Diun monitors registries and notifies; Portwing gives Drydock secure remote control. You likely want both.
Using Diun today?
Diun and Portwing are designed to coexist. Deploy Portwing on any host where you want Drydock to have remote access; keep Diun running alongside it for registry polling and notifications. They mount the same Docker socket independently and don't conflict.
$ docker run -d \
--name portwing \
--read-only --cap-drop=ALL \
--security-opt no-new-privileges:true \
-v /var/run/docker.sock:/var/run/docker.sock:ro \
-e TOKEN_HASH="$PORTWING_TOKEN_HASH" \
-p 3000:3000 \
ghcr.io/codeswhat/portwing:latestReady to try Portwing?
Security-first, AGPL-3.0, no SaaS required. Drop a secure foothold on any Docker host in minutes.