Hawser vs Portwing

Hawser is the remote Docker agent for the Dockhand controller — the closest peer to Portwing in scope. Both are lightweight Go binaries, both support an outbound edge tunnel for NAT/firewalled hosts. Portwing adds Ed25519 per-request signing, sockguard integration, structured audit logging, and an MCP server. Hawser ships today as a more mature option; Portwing v0.9.x is a supported pre-v1 release.

Hawser — ActivePortwing — Alpha

Feature Comparison

Here's how we compare on the features that matter most.

Feature	Hawser	Portwing
Remote container control	Yes (Dockhand agent)	Yes (Drydock agent)
Compatible controller	Dockhand only	Drydock (+ standalone mode)
Auth model	Shared secret	Ed25519 per-request signing
Structured audit log	No	Yes (JSON, built-in)
Signed images + SBOMs + provenance	No	Yes (cosign + archive/image SBOMs + SLSA)
Default-deny socket filter	No	Yes (with sockguard)
Prometheus metrics	No	Yes
MCP server (AI-native, read-only)	No	Yes
Edge / NAT outbound tunnel	Yes (Dockhand edge)	Yes (Drydock v1.6.0-rc.11+)
Single lightweight Go binary	Yes	Yes (~10 MB)
License	MIT	AGPL-3.0

Key Differentiators

What we built that Hawser doesn't cover.

Ed25519 Per-Request Auth

Hawser uses a shared secret passed per-request. Portwing uses Ed25519 asymmetric signing — no secret on the wire, revocable per-client keys, timestamp bounds, and nonce replay protection.

Standalone Mode

Portwing runs in standalone mode without a Drydock controller, exposing Docker API endpoints for any compatible client. Hawser requires the Dockhand controller.

Structured Audit Log

Portwing writes structured JSON for every proxied Docker API call; immutable external storage provides tamper evidence. Hawser has no built-in audit trail.

Signed Images + SBOMs

Every Portwing release ships per-archive CycloneDX SBOMs, an image SBOM attestation, cosign image signatures, and SLSA build provenance. Hawser publishes no supply-chain artifacts.

Prometheus Metrics

Portwing exposes agent health, request counts, and latency histograms. Hawser has no metrics endpoint.

MCP Server (AI-Native)

Portwing ships a read-only MCP server for AI tool integration. Hawser has no MCP support.

Coming from Hawser?

Hawser and Portwing are near-peers in scope. Map your Hawser shared secret to Portwing's TOKEN_HASH, swap the image, and point Drydock at the agent URL. Add sockguard alongside for default-deny socket filtering, then upgrade to Ed25519 key pairs at your own pace for the strongest auth posture.

Quick start

$ docker run -d \
  --name portwing \
  --read-only --cap-drop=ALL \
  --security-opt no-new-privileges:true \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -e TOKEN_HASH="$PORTWING_TOKEN_HASH" \
  -p 3000:3000 \
  ghcr.io/codeswhat/portwing:latest

Ready to try Portwing?

Security-first, AGPL-3.0, no SaaS required. Drop a secure foothold on any Docker host in minutes.

View on GitHub Read the docs