Portainer vs Portwing
Portainer is the most widely-deployed Docker management platform, and its agent bridges remote hosts. Portwing is narrowly scoped — a secure foothold agent without the management overhead — and ships Ed25519 auth, audit logging, and Prometheus metrics in the free AGPL-3.0 build without requiring a Business-tier upgrade. Portwing v0.9.x is a supported pre-v1 release; Portainer is production-mature.
Feature Comparison
Here's how we compare on the features that matter most.
| Feature | Portainer | Portwing |
|---|---|---|
| Remote container control | Yes (via Portainer Agent) | Yes |
| Full management UI | Yes (Portainer UI; RBAC requires Business) | No (Drydock controller only) |
| Auth model | Shared secret / Edge key | Ed25519 per-request signing |
| Structured audit log | Business tier only ($) | Yes (built-in, free, AGPL-3.0) |
| Signed images + SBOMs + provenance | No | Yes (cosign + archive/image SBOMs + SLSA provenance) |
| Default-deny socket filter | No | Yes (with sockguard) |
| Prometheus metrics | Business tier only ($) | Yes |
| MCP server (AI-native, read-only) | No | Yes |
| Edge / NAT outbound tunnel | Yes (Edge Agent, mature) | Yes (Drydock v1.6.0-rc.11+) |
| Single lightweight binary | No (~300 MB node image) | Yes (~10 MB Go binary) |
| License | Zlib (core) / proprietary (Business) | AGPL-3.0 |
Key Differentiators
What we built that Portainer doesn't cover.
Ed25519 Per-Request Auth
Portainer agents authenticate with a shared secret or Edge key. Portwing uses Ed25519 asymmetric signing on every request — no secret on the wire, and each client gets its own key pair.
Structured Audit Log (Free)
Portainer locks audit logging to its Business tier. Portwing ships structured JSON audit logging in every build under AGPL-3.0 — no paid upgrade required. Export to immutable storage for tamper evidence.
Signed Images + SBOMs
Portwing's build pipeline generates per-archive CycloneDX SBOMs, an image SBOM attestation, cosign image signatures, and SLSA build provenance on every release. Portainer has no supply-chain artifacts.
Prometheus Metrics (Free)
Portainer exposes metrics only in its Business tier. Portwing includes a Prometheus metrics endpoint in the base build, covering agent health, request counts, and latency.
MCP Server (AI-Native)
Portwing ships a read-only MCP server so AI tools can inspect containers, images, and events without a browser. Portainer has no MCP integration.
Narrow Scope by Design
Portainer is a full management platform. Portwing is a security-first foothold agent — no bundled UI, no extra attack surface, just the Docker API behind auth and a sockguard socket filter.
Coming from Portainer Agent?
If you're switching to Drydock as your controller, deploy Portwing on each host in place of the Portainer Agent. Generate a token hash, set TOKEN_HASH, and point Drydock at the agent URL. Add sockguard alongside for default-deny socket filtering, and enable Ed25519 key pairs when you're ready for the strongest auth posture.
$ docker run -d \
--name portwing \
--read-only --cap-drop=ALL \
--security-opt no-new-privileges:true \
-v /var/run/docker.sock:/var/run/docker.sock:ro \
-e TOKEN_HASH="$PORTWING_TOKEN_HASH" \
-p 3000:3000 \
ghcr.io/codeswhat/portwing:latestReady to try Portwing?
Security-first, AGPL-3.0, no SaaS required. Drop a secure foothold on any Docker host in minutes.