Watchtower vs Portwing

Watchtower is an automated container updater — it polls registries and restarts containers when new images are available. Portwing is a remote access agent — it gives the Drydock controller a secure authenticated foothold on a Docker host. These tools solve different problems; Drydock can handle the update automation that Watchtower provides, with Portwing as the agent on each host.

Watchtower — ActivePortwing — Alpha

Feature Comparison

Here's how we compare on the features that matter most.

Feature	Watchtower	Portwing
Auto-update containers	Yes (pull + restart on schedule)	No (Drydock handles updates; Portwing is the access agent)
Remote Docker API proxy	No (local/scheduled, no remote protocol)	Yes (full Docker API proxy with auth)
Auth for remote access	No (local only)	Yes (Ed25519 per-request signing)
Structured audit log	No	Yes (JSON, built-in)
Runtime image signature verification	Basic cosign support (newer builds)	No
Default-deny socket filter	No	Yes (with sockguard)
Prometheus metrics	No	Yes
MCP server (AI-native, read-only)	No	Yes
Edge / NAT outbound tunnel	No	Yes (Drydock v1.6.0-rc.11+)
Single lightweight Go binary	Yes	Yes (~10 MB)
License	Apache-2.0	AGPL-3.0

Key Differentiators

What we built that Watchtower doesn't cover.

Remote Auth (Ed25519)

Watchtower runs locally and has no remote access model. Portwing exposes the Docker API over authenticated HTTP, using Ed25519 per-request signing so each client has its own revocable key pair.

Default-Deny Socket Filter

Portwing pairs with sockguard to filter Docker API calls at the socket level. Even if Portwing is compromised, the sockguard allowlist constrains what can be called. Watchtower mounts the socket unfiltered.

Structured Audit Log

Portwing logs every Docker API call it proxies as structured JSON for export to immutable storage. Watchtower has no audit trail.

Supply-Chain Artifacts

Every Portwing release ships per-archive CycloneDX SBOMs, an image SBOM attestation, cosign image signatures, and SLSA build provenance. Watchtower publishes no supply-chain artifacts.

Prometheus Metrics

Portwing exposes agent health, request counts, and latency histograms. Watchtower has no metrics endpoint.

MCP Server (AI-Native)

Portwing ships a read-only MCP server so AI tools can inspect containers and events. Watchtower has no MCP support.

Using Watchtower today?

If you want centralized update management across multiple hosts, Drydock orchestrates image updates and Portwing gives it the agent foothold on each host. You can run both — Watchtower for local hosts where Drydock doesn't need remote access, and Portwing where you need the full remote management API.

Quick start

$ docker run -d \
  --name portwing \
  --read-only --cap-drop=ALL \
  --security-opt no-new-privileges:true \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -e TOKEN_HASH="$PORTWING_TOKEN_HASH" \
  -p 3000:3000 \
  ghcr.io/codeswhat/portwing:latest

Ready to try Portwing?

Security-first, AGPL-3.0, no SaaS required. Drop a secure foothold on any Docker host in minutes.

View on GitHub Read the docs