Komodo vs Portwing
Komodo v2.3.4 is a full build, deployment, automation, and Swarm platform. Its Periphery agent now supports outbound WebSockets, public-key authentication, and automatic key rotation. Portwing v1.1.0 is narrower and pairs with Drydock, emphasizing per-request verification, transparent Docker compatibility, Sockguard containment, and agent-level audit export. Komodo owns the broader controller workflows; Portwing keeps the access-agent boundary. Reviewed October 26, 2026.
Feature Comparison
Here's how we compare on the features that matter most.
| Feature | Komodo | Portwing |
|---|---|---|
| Remote container control | On par: Yes (Periphery) | On par: Yes |
| Connection modes | On par: Core-to-Periphery or outbound Periphery WebSocket | On par: Standard HTTP/S or outbound edge WebSocket (Drydock v1.6.0-rc.11+) |
| Agent authentication | On par: Public-key handshake; Core-managed rotation for connected eligible servers; legacy inbound passkeys remain supported | On par: Ed25519 per-request HTTP signatures; signed edge hello; opt-in controller-assisted rotation with Drydock v1.8.0-rc.1+ |
| Transparent Docker API | Weaker: No (Komodo resource/command API) | Stronger: Yes |
| Structured audit | On par: Controller audit; Periphery JSON logs and OTLP traces | On par: Agent-level API/auth/Compose/exec audit with cursor export |
| Host metrics | On par: Collected for dashboards and alerts | On par: Prometheus scrape endpoint plus edge metrics |
| Docker socket policy | Weaker: Documented deployment mounts the raw socket | Stronger: Recommended Sockguard path-and-method policy |
| Supply-chain evidence | Weaker: v2.3.3 has bare release binaries; Periphery images have BuildKit SLSA v1 provenance; no SBOM or Cosign signature found in checked discovery paths; v2.3.4 is a dependency-only release and its release assets still carry no attestation | Stronger: Cosign signatures + archive/image CycloneDX SBOMs + SLSA provenance |
| Host shell, builds, automation, and Swarm | Stronger: Yes | Weaker: Host shell and Swarm are non-goals; Drydock owns fleet workflows |
| Documented read-only MCP endpoint | Weaker: Not documented | Stronger: Yes |
| License | On par: GPL-3.0 | On par: MIT |
Comparison Details
Authentication, socket policy, telemetry, release evidence, and controller scope.
Public-Key Authentication and Rotation
Komodo v2 added preferred public-key handshakes and deprecated legacy passkeys, which remain supported on configured inbound connections. Fresh installs create a daily Core rotation procedure for connected eligible servers. Portwing's configured Ed25519 HTTP path binds and verifies each request, with timestamp and nonce replay checks.
Both Support Outbound Agents
Periphery can now dial Komodo Core over a bidirectional WebSocket. Portwing dials Drydock over its stable edge wire protocol. Outbound/NAT mode is parity, not a Portwing-only feature. Two open user reports concern outbound behavior. The current connector does not implement HTTP proxy environment handling (#1473). A v2.2.0 user reported reconnect stalls on unstable Tailscale links (#1518); the current release retains a two-second login-message timeout, but that stall has not been independently reproduced here.
Last-Mile Socket Policy
Portwing's hardened path places Sockguard between the agent and Docker with method-and-path rules. Komodo's documented Periphery container mounts the Docker socket directly.
Audit at Different Layers
Komodo records controller activity; Periphery also supports JSON logs and OTLP traces. Portwing emits structured records at the Docker mediation point and offers cursor-based NDJSON export. Drydock owns user-level audit context.
Komodo Is the Broader Platform
Komodo includes host terminals, builds, automation, schedules, configuration, and Swarm. Those are real strengths, but most belong in Drydock rather than in a privileged Portwing agent.
Transparent API and MCP
Portwing preserves Docker Engine formats and exposes five read-only MCP inspection tools. Komodo exposes a strong documented platform API, but not a transparent Docker proxy or documented MCP server.
Coming from Komodo Periphery?
Treat this as a controller migration, not an agent image swap. Inventory Komodo builds, procedures, host terminals, Swarm resources, secrets, and Git-backed stacks; map controller responsibilities to Drydock first. Then deploy Portwing with Ed25519 keys and the narrowest Sockguard preset that covers the required Docker operations.
$ docker run -d \
--name portwing \
--read-only --cap-drop=ALL \
--security-opt no-new-privileges:true \
-v /var/run/docker.sock:/var/run/docker.sock:ro \
-e TOKEN_HASH="$PORTWING_TOKEN_HASH" \
-p 3000:3000 \
ghcr.io/codeswhat/portwing:1.1.0Needs TOKEN_HASH: an Argon2id hash from portwing hash-token. For per-client keys, run portwing keygen and set AUTHORIZED_KEYS instead.
Ready to try Portwing?
Security-first, MIT-licensed, no SaaS required. Drop a secure foothold on any Docker host in minutes.