Watchtower vs Portwing
Watchtower is an automated container updater — it polls registries and restarts containers when new images are available. It can update local or remote Docker daemons. It is an updater client rather than a general-purpose access agent, and its upstream repository is archived. Portwing is a remote access agent — it gives the Drydock controller a secure authenticated foothold on a Docker host. These tools solve different problems; Drydock can handle centralized update workflows with Portwing as the agent on each host. The archived containrrr project's maintained successor is nicholas-fedor/watchtower (v1.23.2, 2026-10-22); this comparison covers the archived v1.7.1 release, reviewed October 26, 2026.
Feature Comparison
Here's how we compare on the features that matter most.
| Feature | Watchtower | Portwing |
|---|---|---|
| Auto-update containers | Stronger: Yes (pull + restart on schedule) | Weaker: No (Drydock handles updates; Portwing is the access agent) |
| Remote Docker API proxy | Weaker: No, an updater client for local or remote Docker | Stronger: Yes (full Docker API proxy with auth) |
| Provides an authenticated Docker management endpoint | Weaker: No; remote Docker client connections support TLS | Stronger: Yes, with Ed25519 signing or configured shared secret |
| Management request audit | On par: Updater logs; no management proxy | On par: Structured request records and cursor export |
| Workload image signature enforcement | On par: Not documented in upstream v1.7.1 | On par: Controller or admission-policy responsibility |
| Published release evidence | On par: Not established by this review; upstream is archived | On par: Cosign signatures + CycloneDX SBOM + SLSA provenance |
| Default-deny socket filter | Not available: No | Stronger: Yes (with sockguard) |
| Prometheus metrics | On par: Yes (opt-in, experimental) | On par: Yes |
| Documented read-only MCP endpoint | Weaker: Not documented | Stronger: Yes |
| Edge / NAT outbound tunnel | Not available: No | Stronger: Yes (Drydock v1.6.0-rc.11+) |
| Single lightweight Go binary | On par: Yes | On par: Yes |
| License | On par: Apache-2.0 | On par: MIT |
Comparison Details
Authentication, socket policy, telemetry, release evidence, and controller scope.
Remote Auth (Ed25519)
Watchtower can update a local or remote Docker daemon, including over TLS. It is an updater client. Portwing exposes an authenticated management proxy, with request-bound Ed25519 signing and revocable client keys when that authentication path is configured.
Default-Deny Socket Filter
Portwing pairs with sockguard to filter Docker API calls at the socket level. Even if Portwing is compromised, the sockguard allowlist constrains what can be called. Watchtower can use a socket or a remote Docker endpoint; access restrictions depend on that deployment.
Structured Audit Log
Portwing emits structured request audit records with cursor-based NDJSON export. Watchtower logs its update activity; that is a different surface from a management-proxy audit API.
Maintained Signed Releases
Watchtower's upstream repository is archived. Portwing remains actively maintained and every release ships per-archive CycloneDX SBOMs, an image SBOM attestation, cosign image signatures, and SLSA build provenance. This verifies Portwing itself; it is not workload image-signature enforcement.
Prometheus Metrics
Both expose Prometheus metrics. Watchtower's is an opt-in, experimental /v1/metrics endpoint behind its HTTP API token. Portwing's covers agent health, request counts, and latency histograms.
MCP Server (AI-Native)
Portwing ships five read-only MCP tools for container and host inspection. Watchtower has no documented MCP support.
Using Watchtower today?
For centralized update management, Drydock can own update decisions while Portwing provides access to each host. Decide which component executes updates on each host when migrating from Watchtower; the access agent itself does not schedule updates.
$ docker run -d \
--name portwing \
--read-only --cap-drop=ALL \
--security-opt no-new-privileges:true \
-v /var/run/docker.sock:/var/run/docker.sock:ro \
-e TOKEN_HASH="$PORTWING_TOKEN_HASH" \
-p 3000:3000 \
ghcr.io/codeswhat/portwing:1.1.0Needs TOKEN_HASH: an Argon2id hash from portwing hash-token. For per-client keys, run portwing keygen and set AUTHORIZED_KEYS instead.
Ready to try Portwing?
Security-first, MIT-licensed, no SaaS required. Drop a secure foothold on any Docker host in minutes.