Competitive Landscape
An evidence-backed comparison of Portwing with current remote Docker agents, including explicit pre-v1 decisions and non-goals.
This review is a snapshot from August 29, 2026, with Arcane re-checked on September 2, 2026. Competitor behavior changes independently of Portwing. The canonical matrix, decision record, and primary-source links live in COMPETITIVE-LANDSCAPE.md.
Portwing is the host agent in a three-layer system:
- Portwing authenticates the controller, mediates Docker operations, and produces audit and metrics data.
- Drydock owns users, RBAC, fleet workflows, UI, GitOps, schedules, update policy, alerts, and vulnerability workflows.
- Sockguard enforces the final Docker API path-and-method allowlist.
That boundary matters. Portainer, Komodo, Arcane, and Dockhand combine their agents with broader controllers. A controller feature is not automatically a missing Portwing feature.
Direct peers reviewed
| Product | Release reviewed | Relevant agent model |
|---|---|---|
| Portainer Agent / Edge Agent | 2.39.5 | Classic inbound agent, outbound Edge Agent, and Async Edge fleet operation |
| Komodo Periphery | v2.3.2 | Public-key authenticated bidirectional WebSocket; Periphery can dial Core |
| Arcane Agent | v2.10.1 | Direct or outbound edge mode over gRPC/WebSocket, plus polling transport and optional mTLS, post-quantum since v2.10.0 |
| Hawser | v0.2.46 | Small Go Docker API proxy for Dockhand with inbound and outbound modes |
Docker's native SSH/TLS access and local socket proxies are security baselines. Distr, Docker Surgeon, Beszel, Diun, and Watchtower are adjacent products rather than direct general-purpose agent peers.
High-signal comparison
| Capability | Portwing | Market finding |
|---|---|---|
| Inbound and outbound edge modes | Supported | All four direct peers now cover both directions. This is required parity, not a unique claim. It describes direction support only, not equal robustness; see the outbound-implementation caveats below. |
| Transparent Docker API | Supported | Portainer and Hawser also proxy Docker's API. Komodo and Arcane expose controller-specific operations. |
| Per-request signed HTTP | Ed25519 signature binds method, exact request target, body hash, timestamp, and nonce | No reviewed peer documents an equivalent per-request replay-resistant HTTP scheme. Komodo uses a public-key channel handshake; Arcane offers mTLS; Portainer uses claim/Edge credentials; Hawser uses a token. |
| Edge authentication | Ed25519-signed hello over TLS, classical signatures with no post-quantum option | Komodo has automatic key rotation; Arcane has automated mTLS enrollment and renewal, and since v2.10.0 a freshly generated edge CA issues ML-DSA-87 (FIPS 204 post-quantum) certificates; Portainer has a mature Edge key and optional Business mTLS. |
| Least-privilege Docker socket | Recommended Sockguard path/method policy | Arcane documents an optional Tecnativa category-level proxy. Other reviewed default deployments mount the Docker socket directly. |
| Agent audit and metrics | Structured audit export plus Prometheus scrape endpoint | Competing controllers record activity and collect metrics, but the reviewed agents do not document the same mediation-point audit/export and scrape surfaces. |
| Polling edge transport | Not supported | Arcane and Portainer cover intermittently connected fleets. Defer until a Drydock deployment requires it. |
| Controller-managed agent upgrades | Not shipped | Portainer and Arcane provide fleet upgrade workflows. This belongs in Drydock plus Portwing packaging, not in an unaudited self-update endpoint. |
| Builds behind the hardened socket profile | Denied by default, opt-in via preset | The base and compose presets deny builds; portwing-with-build.yaml allows classic POST /build, and portwing-with-mediated-build.yaml allows a stock BuildKit docker compose build by inspecting the /session and /grpc traffic in Sockguard. |
| Host shell, file browser, and Swarm | Not supported | Intentional agent non-goals even though broader competitors provide them. |
| Verifiable release artifacts | Cosign signatures, CycloneDX SBOM, and SLSA Build L2 provenance | Arcane ships Cosign-verifiable artifacts and images. Portainer and Komodo were not evaluated for this. Hawser publishes checksummed releases with no equivalent set documented. |
| Credential rotation | Multiple keys; file update plus SIGHUP; manual operational flow | Portainer has a revolving Edge password and Edge key lifecycle. Komodo automatically rotates Periphery keys. Arcane automatically renews certificates and can regenerate its environment token. Hawser requires manual token replacement. |
What changed since the older comparison
- Komodo fully replaced its passkey-only auth. Komodo v2.0.0 shipped outbound Periphery connections and public-key authentication together: Core and Periphery now authenticate with automatically generated public/private key pairs, exchanged over a Noise-protocol handshake, with automatic key rotation.
- Arcane is now a direct peer. It offers direct and edge agents, polling, automated mTLS, optional socket-proxy hardening, signed artifacts, Swarm, and controller-managed upgrades.
- Arcane signs post-quantum as of v2.10.0. Sessions, OIDC, passkeys, and edge mTLS moved to ML-DSA-87. Edge mTLS is still opt-in, the agent token still bootstraps the first enrollment, and an existing ECDSA P-384 CA keeps issuing P-384 certificates, so only a freshly generated CA is ML-DSA-87. Portwing's Ed25519 is not weaker against any attacker that exists today, but it is classical and Portwing has no post-quantum option on any surface.
- Hawser is the closest scope match. Both Hawser and Portwing are small Go binaries with transparent Docker proxying, Compose, metrics collection, and outbound WebSocket transport.
Portwing's differentiators should therefore be stated precisely: per-request replay protection, signed edge enrollment without a reusable bearer credential on the agent, Sockguard's narrow policy boundary, agent-level structured audit, a native Prometheus endpoint, read-only MCP, and deliberately low dependency count.
Known caveats in reviewed outbound/edge implementations
Every direct peer now supports both inbound and outbound connection modes. That's required parity, not a unique claim, and it describes direction support only, not equal robustness. Two of the reviewed outbound implementations have maintainer-confirmed gaps:
- Hawser's edge mode is not fully outbound-only. It starts an HTTP server
on port 2376 (serving
/_hawser/healthand/_hawser/info) bound to all interfaces unless the operator setsBIND_ADDRESS=127.0.0.1(maintainer-confirmed: hawser#71). Portwing's edge mode also runs a local health listener, but it defaults to loopback and the config loader refuses a non-loopback bind unless the operator setsALLOW_UNAUTHENTICATED_REMOTE=true. - Komodo's outbound leg has two open gaps. It ignores
https_proxy/HTTPS_PROXYfor the outbound connection (open since 2026-06-09: komodo#1473), and a hardcoded 2-second handshake timeout can stall reconnection indefinitely (open since 2026-07-08: komodo#1518).
Pre-v1 decisions
The review found no missing lifecycle, streaming, Compose, observability, or authentication primitive that requires new Portwing code before v1.0. The remaining gates are operational:
- Validate tagged Portwing, Drydock, and Sockguard artifacts together across the complete standard/edge and allow/deny matrix.
- Exercise enrollment, overlapping-key rotation, revocation, SIGHUP reload, clock-skew failure, and recovery against a real controller.
- Keep the OpenAPI contract, compatibility matrix, Sockguard presets, and competitive claims synchronized.
- Keep the base and compose presets build-denied by default; the
portwing-with-build.yamlandportwing-with-mediated-build.yamlpresets are the opt-in paths for classic and BuildKit builds respectively.
Deliberate non-goals
Portwing will not add arbitrary host shell access, host-file browsing, volume backup, Swarm/Kubernetes orchestration, a UI, RBAC database, GitOps engine, scheduler, scanner, notification system, or secrets vault for feature-table parity. Those capabilities belong in Drydock or a specialized service.
Primary evidence
- Docker daemon access security
- Portainer agent security and Edge architecture
- Komodo server onboarding and v2 changes
- Arcane remote environments, edge mTLS, and socket proxy
- Arcane ML-DSA-87 migration: v2.10.0 release notes, PR #3785, and v2.10.1 release notes
- Hawser repository and edge-mode bind-address issue
- Komodo outbound-leg issues: proxy env vars ignored and hardcoded handshake timeout
Verifying Releases
How to verify the authenticity and integrity of Portwing container images and binary releases using cosign, GitHub attestations, SBOM, and checksums.
Migrating from Watchtower
Replace an archived Watchtower installation with Drydock + Portwing — including architecture differences, label mapping, and a step-by-step cutover.