Skip to content

Hawser vs Portwing

Hawser v0.2.46 is Dockhand's remote Docker agent and the closest Portwing peer in scope. Both are lightweight Go binaries with transparent Docker proxying, Compose, metrics, and outbound edge transport. Portwing v0.9.19 adds signed-key authentication, Sockguard containment, structured audit export, Prometheus, and read-only MCP. Hawser ships today as a more mature option; Portwing v0.9.x is a supported pre-v1 release. Reviewed August 29, 2026.

Hawser — ActivePortwing — Supported pre-v1

Feature Comparison

Here's how we compare on the features that matter most.

FeatureHawserPortwing
Remote Docker API proxyYesYes
Connection modesInbound HTTP/S and outbound Dockhand WebSocketInbound HTTP/S and outbound Drydock WebSocket (Drydock v1.6.0-rc.11+)
Container, image, network, volume, logs, and execYesYes
Compose lifecycleYesYes
Agent authenticationBearer token; optional server TLS / WSSEd25519 per-request signatures or token in standard mode; signed edge hello
Edge listener bind addressHealth/info HTTP server on port 2376 binds all interfaces unless BIND_ADDRESS=127.0.0.1 is set (Finsys/hawser#71)Defaults to loopback; config loader refuses a non-loopback bind unless ALLOW_UNAUTHENTICATED_REMOTE=true is set
Docker socket policyDocumented deployment mounts the raw socketRecommended Sockguard path-and-method policy
Host metricsForwarded to Dockhand every 30 seconds in edge modePrometheus scrape endpoint and edge metrics
Request auditDebug request loggingStructured audit records with cursor export
Supply-chain evidenceChecksummed release assetsCosign signatures + archive/image CycloneDX SBOMs + SLSA provenance
MCP server (read-only)Not documentedYes
LicenseMITAGPL-3.0

Key Differentiators

What we built that Hawser doesn't cover.

The Closest Scope Match

Hawser and Portwing are both small Go agents, transparent Docker proxies, Compose runners, metrics collectors, and outbound WebSocket clients. Neither product should pretend the topology itself is unique.

No Reusable Edge Token

Hawser authenticates with a bearer token over WSS. Portwing signs the edge hello with an Ed25519 private key and signs individual standard-mode requests with timestamp bounds and nonce replay checks.

Default-Deny Socket Boundary

Hawser's documented deployment mounts the Docker socket directly. Portwing's production path uses a separate Sockguard process with method-and-path allowlist rules. Hawser's edge mode also runs a health/info HTTP server on port 2376 bound to all interfaces unless the operator sets BIND_ADDRESS=127.0.0.1 (maintainer-confirmed, Finsys/hawser#71); Portwing's edge health listener defaults to loopback and its config loader refuses a non-loopback bind without an explicit opt-out.

Structured Agent Audit

Hawser can log Docker requests at debug level. Portwing emits stable structured events for API access, auth failures, enrollment, Compose, and exec, with cursor-based NDJSON export.

Different Metrics Surfaces

Hawser sends host metrics to Dockhand in edge mode. Portwing supports controller metrics and a Prometheus endpoint that can be scraped independently.

Read-Only MCP

Portwing exposes list_containers, inspect_container, container_logs, host_metrics, and container_stats. Hawser does not document an MCP endpoint.

Coming from Hawser?

The agent capabilities map closely, but the wire controllers do not. Move the environment to Drydock, deploy Portwing with Ed25519 keys, choose the smallest Sockguard preset that covers the Dockhand workflows you used, and test Compose paths and streaming behavior against tagged artifacts.

Quick start
$ docker run -d \
  --name portwing \
  --read-only --cap-drop=ALL \
  --security-opt no-new-privileges:true \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -e TOKEN_HASH="$PORTWING_TOKEN_HASH" \
  -p 3000:3000 \
  ghcr.io/codeswhat/portwing:latest

Ready to try Portwing?

Security-first, AGPL-3.0, no SaaS required. Drop a secure foothold on any Docker host in minutes.