Komodo vs Portwing
Komodo (formerly Mogh) is a self-hosted Git-integrated orchestration platform with Periphery as its remote agent. Portwing is purpose-built for Drydock's remote access use case — narrower in scope but stronger on auth (Ed25519), audit logging, supply-chain artifacts, and sockguard socket filtering. Komodo is production-mature; Portwing v0.9.x is a supported pre-v1 release.
Feature Comparison
Here's how we compare on the features that matter most.
| Feature | Komodo | Portwing |
|---|---|---|
| Remote container control | Yes (via Periphery agent) | Yes |
| Full orchestration UI | Yes (Git-integrated stacks, builds, deploys) | No (Drydock + Portwing only) |
| Auth model | Time-based passkey (server-synced) | Ed25519 per-request signing |
| Structured audit log | No | Yes (JSON, built-in) |
| Signed images + SBOMs + provenance | No | Yes (cosign + archive/image SBOMs + SLSA) |
| Default-deny socket filter | No | Yes (with sockguard) |
| Prometheus metrics | Partial (some system metrics) | Yes (agent request + health metrics) |
| MCP server (AI-native, read-only) | No | Yes |
| Edge / NAT outbound tunnel | No | Yes (Drydock v1.6.0-rc.11+) |
| Single lightweight Go binary | Yes | Yes (~10 MB) |
| License | GPL-3.0 | AGPL-3.0 |
Key Differentiators
What we built that Komodo doesn't cover.
Ed25519 Per-Request Auth
Komodo Periphery uses a time-based passkey that must stay in sync with the server clock. Portwing signs every request with a per-client Ed25519 key, a bounded timestamp, and a one-time nonce — no shared secret on the wire.
Default-Deny Socket Filter
Portwing pairs with sockguard so the agent never touches the raw Docker socket directly. Even a compromised Portwing instance is constrained to the explicit API allowlist in sockguard.yaml. Komodo Periphery mounts the socket unfiltered.
Structured Audit Log
Portwing writes structured JSON for every proxied Docker API call; immutable external storage provides tamper evidence. Komodo has no built-in agent-level audit trail.
Signed Images + SBOMs
Every Portwing release ships per-archive CycloneDX SBOMs, an image SBOM attestation, cosign image signatures, and SLSA build provenance. Komodo Periphery publishes none of these supply-chain artifacts.
Prometheus Metrics
Portwing exposes a Prometheus metrics endpoint covering agent health, request counts, and latency. Komodo's metrics are limited to system-level data from Periphery.
MCP Server (AI-Native)
Portwing ships a read-only MCP server for AI tool integration. Komodo has no MCP endpoint.
Coming from Komodo Periphery?
If you're moving to Drydock as your controller, deploy Portwing on each host. Set TOKEN_HASH with a token you generate, and point Drydock at the agent URL. Portwing's Go binary is a similar size to Periphery — no runtime dependency changes. Add sockguard for default-deny socket filtering and enable Ed25519 key pairs for the strongest auth.
$ docker run -d \
--name portwing \
--read-only --cap-drop=ALL \
--security-opt no-new-privileges:true \
-v /var/run/docker.sock:/var/run/docker.sock:ro \
-e TOKEN_HASH="$PORTWING_TOKEN_HASH" \
-p 3000:3000 \
ghcr.io/codeswhat/portwing:latestReady to try Portwing?
Security-first, AGPL-3.0, no SaaS required. Drop a secure foothold on any Docker host in minutes.