Legacy packages overview

A walkthrough of the major directories under pkg/. Most data-plane code still lives here, with comp/ wrappers around it for the Fx-aware binaries.

pkg/ has roughly 60 top-level subdirectories. This page covers the ones you are most likely to need.

Data plane

Package	Purpose
pkg/aggregator	DogStatsD aggregation, sampler workers, demultiplexer flavors.
pkg/collector	Check abstraction, scheduler, runner, core checks, Python loader, JMX bridge.
pkg/metrics	MetricSample, Series, SketchSeries, Event, ServiceCheck types. Has its own go.mod.
pkg/serializer	Series/sketch/event/service-check serialization.
pkg/logs	Logs collection pipeline, tailers, processors, sender.
pkg/trace	The Trace Agent's full pipeline. Has its own go.mod.
pkg/network	NPM and USM (eBPF-driven). Has its own go.mod.
pkg/security	Cloud Workload Security. SECL, probes, resolvers, reporter.
pkg/process	Process Agent core (process, container, connections checks).
pkg/jmxfetch	Bridge to the JMX-Fetch Java subprocess.

Configuration and core utilities

Package	Purpose
pkg/config	Configuration schema, defaults, parsing for datadog.yaml. The new home is comp/core/config/, but legacy code still talks to pkg/config.
pkg/api	Agent HTTP IPC API helpers (mostly migrated to comp/api/).
pkg/util	Grab-bag utility code: log, scrubber, containers, kubelet, cloudproviders, fxutil, hostname, pidfile, networking, etc.
pkg/version	Build-time version metadata.
pkg/template	Template helpers used by AD and config rendering.
pkg/proto	Shared protobuf definitions used across binaries.
pkg/errors	Error helpers.
pkg/redact	Secret-scrubbing utilities used by the flare and logs pipeline.

Cluster Agent + Kubernetes

Package	Purpose
pkg/clusteragent	Cluster Agent core: autoscaling, admission, language detection, orchestrator, cluster checks.
pkg/orchestrator	Orchestrator data collection (Kubernetes resource manifests).
pkg/kubestatemetrics	KSM-based metric collection.
pkg/cloudfoundry	CloudFoundry helpers.
pkg/languagedetection	Workload language detection (shared with the Cluster Agent).

eBPF and system probe

Package	Purpose
pkg/ebpf	eBPF infrastructure: loader, manager, BTF, runtime compilation.
pkg/system-probe	System Probe utilities.
pkg/dyninst	Dynamic instrumentation (live debugger).
pkg/gpu	GPU monitoring eBPF programs and helpers.
pkg/discovery	Service discovery (used by the system probe).
pkg/eventmonitor	Generic kernel event monitor.
pkg/runtime	Runtime helpers (cgroup discovery, etc.).

SNMP, NetFlow, NDM

Package	Purpose
pkg/snmp	SNMP monitoring core.
pkg/networkdevice	Network device monitoring shared code.
pkg/networkpath	Network path / traceroute core.
pkg/networkconfigmanagement	Network configuration management.

Cloud, container, and metadata

Package	Purpose
pkg/containerlifecycle	Container start/stop event collection.
pkg/inventory, pkg/hosttags, pkg/gohai	Host metadata.
pkg/sbom	Software Bill-of-Materials extraction.
pkg/compliance	CSPM benchmarks and runner.
pkg/diagnose	Diagnose suites for agent diagnose.
pkg/flare	Flare contributors.
pkg/status	Status providers.
pkg/version	Build version helpers.

Database monitoring, OTel, serverless

Package	Purpose
pkg/databasemonitoring	Database Monitoring (DBM) helpers.
pkg/serverless	Serverless flavor primitives.
pkg/opentelemetry-mapping-go	Datadog↔OTel attribute mapping. Has its own go.mod.
pkg/obfuscate	SQL/JSON/URL/etc. obfuscation library used by APM and DBM.

Fleet, installer, remote config

Package	Purpose
pkg/fleet	Datadog Installer logic (separate from the Agent's installer.go hook).
pkg/remoteconfig	Remote Config client.
pkg/persistentcache	Local persistent KV store used by RC and others.

Smaller specialized packages

Package	Purpose
pkg/cli	CLI utility helpers.
pkg/fips	FIPS-mode plumbing.
pkg/privileged-logs	Privileged log file access.
pkg/privateactionrunner	Private action runner.
pkg/pidfile	PID file helpers.
pkg/procmgr	Subprocess manager.
pkg/ssi	Single-step instrumentation helpers.
pkg/tagger, pkg/tagset	Tagger primitives (largely now under comp/core/tagger/).
pkg/windowsdriver	Windows kernel driver wrappers.

Things to know

• Many pkg/ packages now have a corresponding comp/<x>/<y>/ wrapper. When in doubt, prefer using the component framework.
• A few pkg/ directories have their own go.mod and can be consumed externally: pkg/metrics, pkg/trace, pkg/network, pkg/security/secl, pkg/opentelemetry-mapping-go, etc. Bumping their internal version requires care.
• The line between pkg/ and comp/ is migration-driven, not principled. Don't read deeper meaning into "this is in pkg/ and that is in comp/."

Related pages

• Components overview — the migration target.
• Systems: Components framework.
• Reference: Dependencies.