Diun vs Portwing
Diun v4.33.1 (Docker Image Update Notifier) polls container registries for new tags and fires notifications through 17 backends, including Apprise. It is a monitoring/notification agent, not a remote Docker control agent — an adjacent product, not a direct general-purpose agent peer. Portwing is a remote access agent — it gives the Drydock controller a secure authenticated foothold on a Docker host. These tools are complementary: run Diun for registry monitoring and Portwing for remote Docker control from Drydock. Reviewed October 26, 2026.
Feature Comparison
Here's how we compare on the features that matter most.
| Feature | Diun | Portwing |
|---|---|---|
| Image update notifications | Stronger: Yes (multi-registry polling + 17 notification backends, including Apprise) | Weaker: No (Drydock notifies; Portwing is the access agent) |
| Remote Docker API proxy | Weaker: No, an image-discovery and notification client | Stronger: Yes (full Docker API proxy with auth) |
| Provides an authenticated Docker management endpoint | Weaker: No; Docker provider supports remote endpoints and TLS | Stronger: Yes, with Ed25519 signing or configured shared secret |
| Management request audit | On par: Notification records; no management proxy | On par: Structured request records and cursor export |
| Release artifact verification | On par: SPDX SBOMs and SLSA provenance statements; verified GitHub release attestation | On par: Cosign signatures + CycloneDX SBOM + SLSA provenance |
| Default-deny socket filter | Not available: No | Stronger: Yes (with sockguard) |
| Prometheus metrics | On par: Yes (opt-in) | On par: Yes |
| Documented read-only MCP endpoint | Weaker: Not documented | Stronger: Yes |
| Edge / NAT outbound tunnel | Not available: No | Stronger: Yes (Drydock v1.6.0-rc.11+) |
| Single lightweight Go binary | On par: Yes | On par: Yes |
| License | On par: MIT | On par: MIT |
Comparison Details
Authentication, socket policy, telemetry, release evidence, and controller scope.
Remote Auth (Ed25519)
Diun discovers images through providers, including a configurable remote Docker endpoint with TLS settings. It does not expose a management proxy. Portwing provides that proxy with request-bound Ed25519 signing and revocable client keys when configured.
Default-Deny Socket Filter
Portwing pairs with Sockguard to constrain Docker API calls at the socket layer. Diun can discover images through several providers, so its exact Docker socket exposure depends on deployment.
Structured Audit Log
Portwing emits structured request audit records with cursor-based NDJSON export. Diun records discovery and notification activity, a different surface from management request auditing.
Both Publish Release Evidence
Diun v4.33.1 publishes SPDX SBOMs and SLSA provenance statements for archives and images, and its GitHub immutable-release attestation verified successfully. Portwing publishes Cosign signatures, CycloneDX SBOMs, and SLSA Build L2 provenance. A release attestation is a release/digest binding, not a build assurance level.
MCP Server (AI-Native)
Portwing ships five read-only MCP tools for container and host inspection. Diun has no documented MCP support.
Complementary, Not Competing
Diun and Portwing solve different problems and run happily side-by-side. Diun monitors registries and notifies; Portwing gives Drydock secure remote control. You likely want both.
Using Diun today?
Use Diun for registry polling and notifications and Portwing for Drydock's remote Docker access. Diun's connection depends on its provider; Portwing's recommended path goes through Sockguard. Configure and test the access each deployment needs.
$ docker run -d \
--name portwing \
--read-only --cap-drop=ALL \
--security-opt no-new-privileges:true \
-v /var/run/docker.sock:/var/run/docker.sock:ro \
-e TOKEN_HASH="$PORTWING_TOKEN_HASH" \
-p 3000:3000 \
ghcr.io/codeswhat/portwing:1.1.0Needs TOKEN_HASH: an Argon2id hash from portwing hash-token. For per-client keys, run portwing keygen and set AUTHORIZED_KEYS instead.
Ready to try Portwing?
Security-first, MIT-licensed, no SaaS required. Drop a secure foothold on any Docker host in minutes.