Azure IoT Edge, AWS Greengrass, Balena and lightweight Kubernetes were each designed well for the context they came from, and none of those contexts is an air-gapped plant or an unstaffed substation. This page sets out where each one holds up against OT constraints and where it stops.
The distinction that matters is not the feature list; it is whether the governance model assumes an uplink. A platform that routes deployment and update workflows through a cloud control plane is structurally unable to govern an air-gapped site, and no amount of feature parity changes that, so the comparison starts with the operating model rather than the capability matrix.
Designed for managed device fleets with reliable uplinks to a cloud control plane, where deployment and update workflows depend on cloud connectivity.
Designed for environments where connectivity cannot be assumed, so an async edge agent operates independently, buffers instructions, and syncs when connectivity allows.
These are structural observations rather than value judgments, because each platform was designed for a different operating context and performs well inside it.
Deploys containerized modules to edge devices and manages them through the Azure IoT Hub control plane, with strong Azure ecosystem integration, device twin state management, and cloud-native telemetry pipelines. The governance model is fundamentally cloud-dependent, since deployments, updates and monitoring all flow through Azure connectivity.
Extends AWS Lambda and container execution to edge devices, with device management and deployment orchestrated through AWS IoT Core, which suits organizations deeply invested in the AWS toolchain. Governance, fleet management and audit all route through AWS.
Provides container-based device fleet management through a SaaS control plane, with a strong focus on developer experience, delta updates and device lifecycle, which suits connected IoT product companies. The SaaS delivery model creates data residency and connectivity constraints that are difficult to accommodate in regulated OT environments.
Lightweight distributions reduce the hardware requirement for running Kubernetes at the edge, which solves the resource constraint but not the governance problem; running k3s on 50 factory nodes produces 50 independent Kubernetes clusters to manage, update, audit and govern individually.
Many OT and industrial IT teams already operate configuration management tooling and extend it to container workloads, which works for simple, uniform deployments; it does not provide centralized container governance, RBAC, GitOps-based deployment standardization, or real-time operational visibility.
Governs Docker, Podman and Kubernetes at the edge from a single self-hosted control plane, with the async edge agent operating independently at each site, buffering pending instructions, and syncing when connectivity allows.
Scroll horizontally on smaller screens. Entries marked as not confirmed are ones we have been unable to verify from vendor documentation, and they are left unresolved rather than assumed.
| Capability | Portainer Edge | Azure IoT Edge | AWS Greengrass | Balena | k3s / MicroK8s |
|---|---|---|---|---|---|
| Connectivity and air-gap | |||||
| Air-gapped and fully offline operation | Native async agent | Not supported | Not supported | Not supported (SaaS) | Possible, no management plane |
| Intermittent connectivity resilience | Buffers and syncs on reconnect | Limited, queued commands | Partial | Partial, local agent caching | Workloads run, no management sync |
| ISA-95 OT network zone compatible | No inbound rules required | Requires outbound to Azure | Requires outbound to AWS | Requires outbound to cloud | Workloads only, no governance |
| Offline registry and image distribution | Built-in registry mirroring | Partial, manual setup | Partial | Delta updates, cloud-routed | Manual, additional tooling |
| Self-hosted, no cloud vendor dependency | Always self-hosted | Requires Azure | Requires AWS | Self-hosted option, limited | Yes |
| Governance, identity, and audit | |||||
| Centralized RBAC across all sites | Full fleet RBAC | Entra ID-bound, limited fleet RBAC | IAM-bound, per-device scoping | No enterprise RBAC | Per-cluster only, manual |
| AD, LDAP and OIDC single sign-on | Native integration | Via Entra ID only | Via AWS IAM only | Not available | Custom integration required |
| Audit log of who changed what and when | Full action audit, all sites | Azure Monitor, partial | CloudWatch, partial | Limited | Custom build required |
| Fleet-wide policy propagation | Centralized policy enforcement | Deployment manifests only | Component recipes only | Not available | Per-cluster, manual |
| FIPS-140-3 compliant mode | Native | Not confirmed | Not confirmed | Not available | Not available |
| Deployment and operations | |||||
| Staged rollout, site by site | Built-in staged groups | Deployment rings, limited | Deployment groups, limited | Release pins, limited | Manual, no native staged rollout |
| GitOps-based deployment | Centralized GitOps execution | Via Azure DevOps integration | Via AWS CodePipeline | Not natively | Cluster-local, Flux or Argo |
| Docker and Podman support | Native, full lifecycle | Docker modules | Docker containers | Docker-based | Not designed for Docker |
| Lightweight Kubernetes at the edge | k3s and KubeSolo; KubeSolo also accepts Compose via embedded D2K | AKS Edge Essentials, limited | EKS Anywhere, heavy | No Kubernetes support | Full Kubernetes API |
| Requires specialist Kubernetes skills | No, operable by OT and IT generalists | Cloud skills required | AWS skills required | Moderate, developer-oriented | Yes, Kubernetes expertise required |
| Cost and deployment model | |||||
| Free tier available | Yes, up to 3 nodes | Limited free messages per month | Limited free tier | Free up to limited devices | Open source, free |
| Pricing model clarity | Transparent per-node | Complex, message and operation based | Complex, message, device and data | Per-device SaaS | No licensing cost |
| Data residency control | Full control, self-hosted | Azure region-dependent | AWS region-dependent | Cloud-routed | Full control |
For enterprise IT teams evaluating Kubernetes management platforms the comparison set is different, and that comparison lives on portainer.io alongside the enterprise Kubernetes governance material.
Start free with up to 3 nodes, or talk to our industrial team about your OT deployment.