Apps

The repository builds 24 separate binaries from cmd/. Most users meet the "Datadog Agent" as the core agent process, but the same source tree produces an entire fleet of cooperating processes.

Map of binaries

Binary	Purpose	Wiki page
agent	Core Datadog Agent: hosts checks, DogStatsD (when colocated), the IPC API, and ships metrics/logs/events to Datadog.	Agent
cluster-agent	Kubernetes-aware companion: cluster checks, External Metrics Provider, admission controller.	Cluster Agent
cluster-agent-cloudfoundry	The CloudFoundry flavor of the Cluster Agent.	(covered briefly in Cluster Agent)
dogstatsd	Standalone StatsD/DogStatsD server.	DogStatsD
trace-agent	Receives APM traces, samples them, computes RED stats, forwards them.	Trace Agent
system-probe	Privileged process that runs eBPF programs (NPM, USM, kernel checks).	System Probe
security-agent	Runs Cloud Workload Security and CSPM.	Security Agent
process-agent	Collects process and container metadata, drives some live process features.	Process Agent
installer	Datadog's remote-controlled Agent installer/upgrader.	Installer
serverless-init	Lambda extension and similar serverless flavors.	Serverless init
otel-agent	Datadog's OpenTelemetry Collector flavor.	OTel Agent
iot-agent	Stripped-down core Agent build (build tag iot).	(a build flavor of agent)
host-profiler	Continuous host-level profiler.	(covered briefly in Agent)
cws-instrumentation	Helper binary the Security Agent injects into containers for CWS.	(covered in Security Agent)
sbomgen	Generates Software Bill-of-Materials reports.	(specialized tool)
secret-generic-connector, secrethelper	Secret backend executors.	(covered in Reference: secrets)
systray	Windows system-tray icon.	(Windows-only)
loader	Windows process loader.	(Windows-only)
ai_prompt_logger	AI prompt logging utility used in dyninst tooling.	(specialized tool)
config-stream-client	CLI for the configstream gRPC API.	(specialized tool)
privateactionrunner	Executes Private Action Runner workflows.	(specialized tool)
internal/runcmd, internal/...	Shared cmd/internal/ packages, not built independently.	(internal helpers)
testdata	Fixture binaries for tests.	(test-only)

Shared scaffolding

Every Cobra-based binary in cmd/ follows the same shape:

cmd/<binary>/
├── main.go               # Sets the flavor, wires the root command, runs cobra
├── command/command.go    # Builds the root cobra.Command and registers subcommands
├── subcommands/          # One subdirectory per subcommand
│   ├── subcommands.go    # Returns the slice of *cobra.Command
│   └── <subcommand>/...
├── windows*.go           # Windows-specific entrypoint variants
├── windows_resources/    # Windows resource files (icons, manifest)
└── BUILD.bazel

Each binary that runs a long-lived process has a subcommands/run/ subcommand that uses Fx to assemble its component bundle list. That file (e.g., cmd/agent/subcommands/run/command.go) is the most reliable place to learn what components a particular flavor uses.

Cross-binary communication

Most binaries can run independently, but the rich feature set comes from cooperation:

graph LR
    AGENT[core agent] -. tagger gRPC .-> TRACE[trace-agent]
    AGENT -. tagger gRPC .-> PROC[process-agent]
    AGENT -. workloadmeta gRPC .-> PROC
    AGENT -. system-probe HTTP .-> SYSP[system-probe]
    SEC[security-agent] -. system-probe HTTP .-> SYSP
    DSD[standalone dogstatsd] -- intake HTTP --> INTAKE
    AGENT -- intake HTTP --> INTAKE
    TRACE -- intake HTTP --> INTAKE
    SEC -- intake HTTP --> INTAKE
    PROC -- intake HTTP --> INTAKE

Inter-process communication channels:

• Tagger gRPC: the core Agent exposes an authoritative tagger; other binaries connect to it for tag resolution. See comp/core/tagger/ and comp/api/grpcserver/.
• Workloadmeta gRPC: similar for container/pod metadata. comp/core/workloadmeta/.
• System Probe HTTP socket: the system probe exposes its modules over a UNIX socket; the core Agent and Security Agent are clients. See cmd/system-probe/api/.
• Datadog intake: every binary that produces telemetry has its own forwarder to the Datadog backend.

Picking the right page

If you are working on… you probably want to read…

• the check runtime, autodiscovery, integrations registry → Agent, Systems: Check runtime, Systems: Autodiscovery.
• DogStatsD packet handling, capture/replay, mapping → DogStatsD, Features: Metrics pipeline.
• APM sampling, the concentrator, OTLP ingest → Trace Agent, Features: APM tracing.
• eBPF, NPM, USM, GPU monitoring → System Probe, Features: eBPF / system probe.
• CWS rules, SECL, CSPM → Security Agent, Features: Cloud Workload Security.
• Kubernetes admission, External Metrics, cluster checks → Cluster Agent.
• Lambda, Cloud Run, App Service flavor → Serverless init.
• The OpenTelemetry Collector flavor → OTel Agent.