Watchtower vs Portwing
Watchtower is an automated container updater — it polls registries and restarts containers when new images are available. It is a local container updater, not a remote access agent — an adjacent product, not a direct general-purpose agent peer — and its upstream repository is now archived. Portwing is a remote access agent — it gives the Drydock controller a secure authenticated foothold on a Docker host. These tools solve different problems; Drydock can handle centralized update workflows with Portwing as the agent on each host.
Feature Comparison
Here's how we compare on the features that matter most.
| Feature | Watchtower | Portwing |
|---|---|---|
| Auto-update containers | Yes (pull + restart on schedule) | No (Drydock handles updates; Portwing is the access agent) |
| Remote Docker API proxy | No (local/scheduled, no remote protocol) | Yes (full Docker API proxy with auth) |
| Auth for remote access | No (local only) | Yes (Ed25519 per-request signing) |
| Structured audit log | No | Yes (JSON, built-in) |
| Runtime image signature verification | Basic cosign support (newer builds) | No (controller or admission-control responsibility) |
| Published release evidence | Archived upstream project | Cosign signatures + CycloneDX SBOM + SLSA provenance |
| Default-deny socket filter | No | Yes (with sockguard) |
| Prometheus metrics | No | Yes |
| MCP server (AI-native, read-only) | No | Yes |
| Edge / NAT outbound tunnel | No | Yes (Drydock v1.6.0-rc.11+) |
| Single lightweight Go binary | Yes | Yes (~10 MB) |
| License | Apache-2.0 | AGPL-3.0 |
Key Differentiators
What we built that Watchtower doesn't cover.
Remote Auth (Ed25519)
Watchtower runs locally and has no remote access model. Portwing exposes the Docker API over authenticated HTTP, using Ed25519 per-request signing so each client has its own revocable key pair.
Default-Deny Socket Filter
Portwing pairs with sockguard to filter Docker API calls at the socket level. Even if Portwing is compromised, the sockguard allowlist constrains what can be called. Watchtower mounts the socket unfiltered.
Structured Audit Log
Portwing logs every Docker API call it proxies as structured JSON for export to immutable storage. Watchtower has no audit trail.
Maintained Signed Releases
Watchtower's upstream repository is archived. Portwing remains actively maintained and every release ships per-archive CycloneDX SBOMs, an image SBOM attestation, cosign image signatures, and SLSA build provenance. This verifies Portwing itself; it is not workload image-signature enforcement.
Prometheus Metrics
Portwing exposes agent health, request counts, and latency histograms. Watchtower has no metrics endpoint.
MCP Server (AI-Native)
Portwing ships five read-only MCP tools for container and host inspection. Watchtower has no documented MCP support.
Using Watchtower today?
If you want centralized update management across multiple hosts, Drydock orchestrates image updates and Portwing gives it the agent foothold on each host. You can run both — Watchtower for local hosts where Drydock doesn't need remote access, and Portwing where you need the full remote management API.
$ docker run -d \
--name portwing \
--read-only --cap-drop=ALL \
--security-opt no-new-privileges:true \
-v /var/run/docker.sock:/var/run/docker.sock:ro \
-e TOKEN_HASH="$PORTWING_TOKEN_HASH" \
-p 3000:3000 \
ghcr.io/codeswhat/portwing:latestReady to try Portwing?
Security-first, AGPL-3.0, no SaaS required. Drop a secure foothold on any Docker host in minutes.