Hawser vs Portwing
Hawser v0.2.52 is Dockhand's remote Docker agent and the closest Portwing peer in scope. Both are lightweight Go binaries with transparent Docker proxying, Compose, metrics, and outbound edge transport. Portwing v1.1.0 emphasizes signed-key authentication, Sockguard containment, structured audit export, Prometheus, and read-only MCP. Hawser integrates with Dockhand; Portwing integrates with Drydock. Reviewed October 26, 2026.
Feature Comparison
Here's how we compare on the features that matter most.
| Feature | Hawser | Portwing |
|---|---|---|
| Remote Docker API proxy | On par: Yes | On par: Yes |
| Connection modes | On par: Inbound HTTP/S and outbound Dockhand WebSocket | On par: Inbound HTTP/S and outbound Drydock WebSocket (Drydock v1.6.0-rc.11+) |
| Container, image, network, volume, logs, and exec | On par: Yes | On par: Yes |
| Compose lifecycle | On par: Yes | On par: Yes |
| Agent authentication | Weaker: Bearer token; optional server TLS / WSS | Stronger: Ed25519 per-request signatures or token in standard mode; signed edge hello |
| Edge listener bind address | Weaker: Health-only HTTP listener defaults to 0.0.0.0:2376; BIND_ADDRESS=127.0.0.1 restricts it to loopback | Stronger: Defaults to loopback; config loader refuses a non-loopback bind unless ALLOW_UNAUTHENTICATED_REMOTE=true is set |
| Docker socket policy | Weaker: Documented deployment mounts the raw socket | Stronger: Recommended Sockguard path-and-method policy |
| Host metrics | On par: Forwarded to Dockhand every 30 seconds in edge mode | On par: Prometheus scrape endpoint and edge metrics |
| Request audit | Weaker: Debug request logging | Stronger: Structured audit records with cursor export |
| Supply-chain evidence | Weaker: Checksums and verified GitHub immutable-release attestation; image SBOM/build provenance not found in inspected evidence | Stronger: Cosign signatures + archive/image CycloneDX SBOMs + SLSA provenance |
| Documented read-only MCP endpoint | Weaker: Not documented | Stronger: Yes |
| License | On par: MIT | On par: MIT |
Comparison Details
Authentication, socket policy, telemetry, release evidence, and controller scope.
The Closest Scope Match
Hawser and Portwing are both small Go agents, transparent Docker proxies, Compose runners, metrics collectors, and outbound WebSocket clients. Neither product should pretend the topology itself is unique.
Signed Edge Authentication
Hawser authenticates with a bearer token over WSS. Portwing signs the edge hello with an Ed25519 private key and signs individual standard-mode requests with timestamp bounds and nonce replay checks.
Default-Deny Socket Boundary
Hawser's documented deployment mounts the Docker socket directly. Portwing's production path uses a separate Sockguard process with method-and-path allowlist rules. Hawser also starts an unauthenticated health-only listener, defaulting to 0.0.0.0:2376; BIND_ADDRESS=127.0.0.1 restricts it to loopback. That container listener is not necessarily published on the host, and management still connects outbound. Portwing's edge health listener defaults to loopback and requires an explicit opt-out for a non-loopback bind.
Structured Agent Audit
Hawser can log Docker requests at debug level. Portwing emits stable structured events for API access, auth failures, enrollment, Compose, and exec, with cursor-based NDJSON export.
Different Metrics Surfaces
Hawser sends host metrics to Dockhand in edge mode. Portwing supports controller metrics and a Prometheus endpoint that can be scraped independently.
Read-Only MCP
Portwing exposes list_containers, inspect_container, container_logs, host_metrics, and container_stats. Hawser does not document an MCP endpoint.
Coming from Hawser?
The agent capabilities map closely, but the wire controllers do not. Move the environment to Drydock, deploy Portwing with Ed25519 keys, choose the smallest Sockguard preset that covers the Dockhand workflows you used, and test Compose paths and streaming behavior against tagged artifacts.
$ docker run -d \
--name portwing \
--read-only --cap-drop=ALL \
--security-opt no-new-privileges:true \
-v /var/run/docker.sock:/var/run/docker.sock:ro \
-e TOKEN_HASH="$PORTWING_TOKEN_HASH" \
-p 3000:3000 \
ghcr.io/codeswhat/portwing:1.1.0Needs TOKEN_HASH: an Argon2id hash from portwing hash-token. For per-client keys, run portwing keygen and set AUTHORIZED_KEYS instead.
Ready to try Portwing?
Security-first, MIT-licensed, no SaaS required. Drop a secure foothold on any Docker host in minutes.