Komodo vs Portwing

Komodo v2.3.2 is a full build, deployment, automation, and Swarm platform. Its Periphery agent now supports outbound WebSockets, public-key authentication, and automatic key rotation. Portwing v0.9.19 is narrower and pairs with Drydock, emphasizing per-request verification, transparent Docker compatibility, Sockguard containment, and agent-level audit export. Komodo is production-mature; Portwing v0.9.x is a supported pre-v1 release. Reviewed August 29, 2026.

Komodo — ActivePortwing — Supported pre-v1

Feature Comparison

Here's how we compare on the features that matter most.

Feature	Komodo	Portwing
Remote container control	Yes (Periphery)	Yes
Connection modes	Core-to-Periphery or outbound Periphery WebSocket	Standard HTTP/S or outbound edge WebSocket (Drydock v1.6.0-rc.11+)
Agent authentication	Public-key handshake; automatic per-server key rotation	Ed25519 per-request HTTP signatures; signed edge hello; manual trust-root rotation
Transparent Docker API	No (Komodo resource/command API)	Yes
Structured audit	Full controller audit trail	Agent-level API/auth/Compose/exec audit with cursor export
Host metrics	Collected for dashboards and alerts	Prometheus scrape endpoint plus edge metrics
Docker socket policy	Documented deployment mounts the raw socket	Recommended Sockguard path-and-method policy
Supply-chain evidence	Not published	Cosign signatures + archive/image CycloneDX SBOMs + SLSA provenance
Host shell, builds, automation, and Swarm	Yes	Host shell and Swarm are non-goals; Drydock owns fleet workflows
MCP server (read-only)	Not documented	Yes
License	GPL-3.0	AGPL-3.0

Key Differentiators

What we built that Komodo doesn't cover.

Komodo v2 Closed the Auth Gap

Komodo v2 replaced the old passkey-only model with public-key handshakes, onboarding keys, and automatic Periphery key rotation. Portwing's remaining distinction is signature and replay verification on each standard-mode HTTP request.

Both Support Outbound Agents

Periphery can now dial Komodo Core over a bidirectional WebSocket. Portwing dials Drydock over its stable edge wire protocol. Outbound/NAT mode is parity, not a Portwing-only feature. Komodo's outbound leg has two open, maintainer-confirmed gaps: it ignores https_proxy/HTTPS_PROXY (moghtech/komodo#1473, open since 2026-06-09), and a hardcoded 2-second handshake timeout can stall reconnection indefinitely (moghtech/komodo#1518, open since 2026-07-08).

Last-Mile Socket Policy

Portwing's hardened path places Sockguard between the agent and Docker with method-and-path rules. Komodo's documented Periphery container mounts the Docker socket directly.

Audit at Different Layers

Komodo records a full controller audit trail. Portwing emits structured records at the Docker mediation point and offers cursor-based NDJSON export. Drydock owns user-level audit context.

Komodo Is the Broader Platform

Komodo includes host terminals, builds, automation, schedules, configuration, and Swarm. Those are real strengths, but most belong in Drydock rather than in a privileged Portwing agent.

Transparent API and MCP

Portwing preserves Docker Engine formats and exposes five read-only MCP inspection tools. Komodo exposes a strong documented platform API, but not a transparent Docker proxy or documented MCP server.

Coming from Komodo Periphery?

Treat this as a controller migration, not an agent image swap. Inventory Komodo builds, procedures, host terminals, Swarm resources, secrets, and Git-backed stacks; map controller responsibilities to Drydock first. Then deploy Portwing with Ed25519 keys and the narrowest Sockguard preset that covers the required Docker operations.

Quick start

$ docker run -d \
  --name portwing \
  --read-only --cap-drop=ALL \
  --security-opt no-new-privileges:true \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -e TOKEN_HASH="$PORTWING_TOKEN_HASH" \
  -p 3000:3000 \
  ghcr.io/codeswhat/portwing:latest

Ready to try Portwing?

Security-first, AGPL-3.0, no SaaS required. Drop a secure foothold on any Docker host in minutes.

View on GitHub Read the docs