Hawser vs Portwing
Hawser v0.2.46 is Dockhand's remote Docker agent and the closest Portwing peer in scope. Both are lightweight Go binaries with transparent Docker proxying, Compose, metrics, and outbound edge transport. Portwing v0.9.19 adds signed-key authentication, Sockguard containment, structured audit export, Prometheus, and read-only MCP. Hawser ships today as a more mature option; Portwing v0.9.x is a supported pre-v1 release. Reviewed August 29, 2026.
Feature Comparison
Here's how we compare on the features that matter most.
| Feature | Hawser | Portwing |
|---|---|---|
| Remote Docker API proxy | Yes | Yes |
| Connection modes | Inbound HTTP/S and outbound Dockhand WebSocket | Inbound HTTP/S and outbound Drydock WebSocket (Drydock v1.6.0-rc.11+) |
| Container, image, network, volume, logs, and exec | Yes | Yes |
| Compose lifecycle | Yes | Yes |
| Agent authentication | Bearer token; optional server TLS / WSS | Ed25519 per-request signatures or token in standard mode; signed edge hello |
| Edge listener bind address | Health/info HTTP server on port 2376 binds all interfaces unless BIND_ADDRESS=127.0.0.1 is set (Finsys/hawser#71) | Defaults to loopback; config loader refuses a non-loopback bind unless ALLOW_UNAUTHENTICATED_REMOTE=true is set |
| Docker socket policy | Documented deployment mounts the raw socket | Recommended Sockguard path-and-method policy |
| Host metrics | Forwarded to Dockhand every 30 seconds in edge mode | Prometheus scrape endpoint and edge metrics |
| Request audit | Debug request logging | Structured audit records with cursor export |
| Supply-chain evidence | Checksummed release assets | Cosign signatures + archive/image CycloneDX SBOMs + SLSA provenance |
| MCP server (read-only) | Not documented | Yes |
| License | MIT | AGPL-3.0 |
Key Differentiators
What we built that Hawser doesn't cover.
The Closest Scope Match
Hawser and Portwing are both small Go agents, transparent Docker proxies, Compose runners, metrics collectors, and outbound WebSocket clients. Neither product should pretend the topology itself is unique.
No Reusable Edge Token
Hawser authenticates with a bearer token over WSS. Portwing signs the edge hello with an Ed25519 private key and signs individual standard-mode requests with timestamp bounds and nonce replay checks.
Default-Deny Socket Boundary
Hawser's documented deployment mounts the Docker socket directly. Portwing's production path uses a separate Sockguard process with method-and-path allowlist rules. Hawser's edge mode also runs a health/info HTTP server on port 2376 bound to all interfaces unless the operator sets BIND_ADDRESS=127.0.0.1 (maintainer-confirmed, Finsys/hawser#71); Portwing's edge health listener defaults to loopback and its config loader refuses a non-loopback bind without an explicit opt-out.
Structured Agent Audit
Hawser can log Docker requests at debug level. Portwing emits stable structured events for API access, auth failures, enrollment, Compose, and exec, with cursor-based NDJSON export.
Different Metrics Surfaces
Hawser sends host metrics to Dockhand in edge mode. Portwing supports controller metrics and a Prometheus endpoint that can be scraped independently.
Read-Only MCP
Portwing exposes list_containers, inspect_container, container_logs, host_metrics, and container_stats. Hawser does not document an MCP endpoint.
Coming from Hawser?
The agent capabilities map closely, but the wire controllers do not. Move the environment to Drydock, deploy Portwing with Ed25519 keys, choose the smallest Sockguard preset that covers the Dockhand workflows you used, and test Compose paths and streaming behavior against tagged artifacts.
$ docker run -d \
--name portwing \
--read-only --cap-drop=ALL \
--security-opt no-new-privileges:true \
-v /var/run/docker.sock:/var/run/docker.sock:ro \
-e TOKEN_HASH="$PORTWING_TOKEN_HASH" \
-p 3000:3000 \
ghcr.io/codeswhat/portwing:latestReady to try Portwing?
Security-first, AGPL-3.0, no SaaS required. Drop a secure foothold on any Docker host in minutes.