Dependencies

This page is a quick tour of what the Datadog Agent depends on: build tags, Go modules, language ecosystems, and external systems. The authoritative sources are linked.

Build tags

The Agent uses Go build tags to control which files compile into which binaries. The full computation happens in tasks/build_tags.py; this is where you go when you need the canonical tag set for a binary.

Some commonly seen tags:

Tag	Effect
linux_bpf	eBPF-aware code paths (Linux only)
kubeapiserver	Kubernetes API server plumbing
kubelet	Kubelet client
kubelet_v2	Newer kubelet client
containerd	containerd integration
docker	Docker integration
cri	Generic CRI integration
python	Python check runtime
python3	CPython 3 specifically
jmx	JMXFetch bridge
serverless	Serverless flavor build (strips most subsystems)
iot	IoT Agent build (also strips heavily)
clusterchecks	Cluster check dispatcher logic
secrets	Secret backend
ec2, gce, azure, cloudfoundry, oraclecloud	Cloud provider integrations
process	Process Agent core checks
windows, linux, darwin	OS-specific (use //go:build constraints)
fips	FIPS-compliant Go toolchain
dovecot	Dovecot DBM integration
oracle	Oracle DBM integration
npm	NPM in process-agent context
embedded_python_path	Inject the embedded Python path

When you write a new file with platform- or feature-specific code, set the right //go:build constraint at the top. Mismatched tags between source and tests are a common source of "works on my machine."

Go modules

The repo is a multi-module Go workspace. Major modules:

• The root module (go.mod) — the bulk of the agent code.
• pkg/metrics — metric primitives, exposed for external consumers.
• pkg/trace — trace agent core, also a Go library.
• pkg/network — NPM/USM core.
• pkg/security/secl — the SECL parser/evaluator, exposed so third parties can validate rules.
• pkg/opentelemetry-mapping-go — Datadog↔OTel attribute mapping.
• pkg/dyninst/... and others — newer modules that may move to standalone repos.
• Several tasks/<x> and tools/<x> modules — dev-only tooling.

The full inventory lives in modules.yml. The repo uses go.work to drive the multi-module workspace; dda inv tidy keeps everything coherent.

The root go.mod is one of the largest in the open-source Go ecosystem (93 KB). LICENSE-3rdparty.csv (800 KB) lists every direct and indirect dependency.

Notable Go dependencies

A non-exhaustive list of dependencies the Agent leans on heavily:

• go.uber.org/fx — the dependency-injection framework underpinning comp/.
• github.com/spf13/cobra + viper — CLI and config loading.
• github.com/cilium/ebpf — Go eBPF library (with Datadog's ebpf-manager on top).
• github.com/DataDog/sketches-go — DDSketch for distribution metrics.
• gopkg.in/DataDog/dd-trace-go.v2 — APM SDK (the Agent traces and profiles itself).
• go.opentelemetry.io/collector — the OTel Collector engine for the OTel Agent flavor.
• github.com/DataDog/zstd — zstd compression for payloads.
• google.golang.org/grpc + protobuf — gRPC for inter-process and Cluster Agent APIs.
• github.com/coreos/go-systemd — journald integration.
• github.com/docker/docker, github.com/containerd/containerd — container runtime SDKs.
• k8s.io/client-go + the Kubernetes API libraries — Cluster Agent, autodiscovery, admission controller.
• github.com/aws/aws-sdk-go-v2 — AWS metadata, ECS, Lambda integration.
• github.com/Microsoft/hcsshim — Windows container support.
• github.com/itchyny/gojq — jq-style queries used in some debug paths.
• github.com/mattn/go-sqlite3 — embedded SQLite for some local stores.

Language ecosystems

The Agent is polyglot. Each language is responsible for a different layer:

Language	Role
Go (~10,500 source files)	Primary implementation language.
Python (~520 source files)	Invoke build tasks, Python check runtime, and a handful of dev-time scripts.
C / eBPF (~70 source files)	eBPF programs (kernel side) and rtloader's C ABI.
C++ (in rtloader/)	The CPython embedding shim.
Rust (~90 source files)	Auxiliary crates under rust/ and pkg/dyninst/.
Ruby	Legacy Omnibus build system in omnibus/.
Bazel Starlark	The new build system (bazel/rules/, BUILD.bazel).
Java	jmxfetch.jar ships alongside the Agent (built from a separate repo) for JMX checks.
TypeScript / JS	Bits and pieces in cmd/agent/dist/ for the embedded GUI.

External systems

Beyond compile-time dependencies, the Agent talks to many external systems at runtime:

• Datadog intake — over HTTPS at *.datadoghq.com (or other sites).
• Container runtimes — Docker daemon socket, containerd gRPC, CRI-O, podman.
• Kubernetes — Kubelet API, Kubernetes API server, admission webhook.
• Cloud metadata services — AWS IMDS, GCE metadata server, Azure IMDS.
• systemd-journald — for journald log collection.
• Linux kernel — eBPF, netlink, LSM.
• Windows kernel — ETW, WFP driver.
• JMX — when JMX checks are enabled.
• SNMP — when network device monitoring is enabled.
• NetFlow — when NetFlow ingestion is enabled.
• Database servers — for Database Monitoring (Postgres, MySQL, Oracle, SQL Server, …).

Each integration brings its own dependency footprint into the Go module graph.

Renovate, dependabot, and supply-chain bots

renovate.json configures Renovate Bot to keep dependencies current. About 8% of the last 90 days of commits were authored by bots — most of them dependency bumps.

The repo also runs:

• A Go module update commenter (go-update-commenter.yml).
• A cargo-bazel-tidy.yml workflow for Rust dependencies.
• A cws-btfhub-sync.yml workflow that syncs BTF data for older kernels.
• A markdown-lint-check.yml workflow for documentation links.

Manual dependency bumps still happen — particularly for security advisories that the bots haven't picked up yet — but most of the day-to-day churn is automated.

Tracking license compliance

Every direct and indirect dependency must be in LICENSE-3rdparty.csv with an approved license. tasks/licenses.py validates this; CI fails if a new dependency lands without its row. The list of approved licenses is in .wwhrd.yml.

Related pages

• How to contribute: Tooling — dda inv tidy and Bazel.
• Configuration — runtime configuration.
• Background — why the Bazel migration is happening.