Merge remote-tracking branch 'origin/main' into dd/vuln-92045-external-metric-namespace-20260729

Author: hmahmood

.agents/skills/injector-dev/SKILL.md

@@ -6,3 +6,4 @@
 # inside of arm64 Linux containers.
 bazel-datadog-agent/
 bazel-testlogs/
+hard-coded-generation/

.bazelignore

@@ -98,6 +98,11 @@ common:cache:frontend --remote_cache=grpcs://buildbarn-frontend-datadog-agent.us
 common:cache --config=cache:frontend
 common:cache --noremote_upload_local_results
 
+# Explicit local-only config: disable the remote cache while keeping the
+# wrapper-injected --disk_cache. Use `--config=no-remote-cache` (or
+# DD_BAZEL_REMOTE_CACHE=off) to opt out of tools/bazel auto-selection.
+common:no-remote-cache --remote_cache=
+
 # CI config ------------------------------------------------------------------------------------------------------------
 common:ci --config=adms
 common:ci --config=lint

.bazelrc

@@ -3,7 +3,6 @@
 from typing import TYPE_CHECKING
 
 import click
-
 from dda.cli.base import dynamic_command, pass_app
 
 if TYPE_CHECKING:
@@ -19,9 +18,9 @@ def cmd(app: Application, *, check: bool) -> None:
     """
     from dda.utils.fs import Path
     from dda.utils.process import EnvVars
-
     from utils.docs.constants import SOURCE_DATE_EPOCH
     from utils.docs.deps import DEPENDENCIES
+    from utils.docs.links import check_links
 
     group_dir = Path(__file__).parent.parent
     venv_path = app.config.storage.join("venvs", group_dir.id).data
@@ -38,5 +37,7 @@ def cmd(app: Application, *, check: bool) -> None:
             cache_marker.parent.mkdir(parents=True, exist_ok=True)
             cache_marker.touch()
 
-        if check:
-            app.subprocess.exit_with(["lychee", "--config", ".lychee.toml", "site"], env=env_vars)
+    # CI runs `dda run docs check-links` as a step of its own instead, so that a rotted link on
+    # somebody else's site is reported separately from documentation that fails to build.
+    if check:
+        check_links(app)

.dda/extend/commands/run/docs/build/__init__.py

@@ -0,0 +1,19 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from dda.cli.base import dynamic_command, pass_app
+
+if TYPE_CHECKING:
+    from dda.cli.application import Application
+
+
+@dynamic_command(short_help="Check documentation links")
+@pass_app
+def cmd(app: Application) -> None:
+    """
+    Check the links of the built documentation.
+    """
+    from utils.docs.links import check_links
+
+    check_links(app)

.dda/extend/commands/run/docs/check_links/__init__.py

@@ -3,7 +3,6 @@
 from typing import TYPE_CHECKING
 
 import click
-
 from dda.cli.base import dynamic_command, pass_app
 
 if TYPE_CHECKING:
@@ -20,7 +19,6 @@ def cmd(app: Application, *, port: int, launch: bool) -> None:
     """
     from dda.utils.fs import Path
     from dda.utils.process import EnvVars
-
     from utils.docs.constants import SOURCE_DATE_EPOCH
     from utils.docs.deps import DEPENDENCIES
 

.dda/extend/commands/run/docs/serve/__init__.py

@@ -4,6 +4,8 @@
     "zensical~=0.0.50",
     # Fetching data
     "httpx",
-    # Validation
-    "lychee-bin~=0.24.2",
 )
+
+# Kept out of the build's dependencies so that a local build or serve never unpacks a checker it
+# does not use.
+LINK_CHECKER = "lychee-bin~=0.24.2"

.dda/extend/pythonpath/utils/docs/deps.py

@@ -0,0 +1,17 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+
+def check_links(app) -> None:
+    """Resolve every link of the built documentation, exiting with the checker's status."""
+    from utils.docs.deps import LINK_CHECKER
+
+    site_dir = Path("site")
+    if not site_dir.is_dir():
+        app.abort(f"No documentation to check at `{site_dir}`, run `dda run docs build` first")
+
+    # Isolated so that the checker never enters the environment the documentation is built with, and
+    # never resolves to a `lychee` that happens to be installed elsewhere.
+    lychee_command = ["lychee", "--config", ".lychee.toml", str(site_dir)]
+    app.tools.uv.exit_with(["tool", "run", "--isolated", "--from", LINK_CHECKER, *lychee_command])

.dda/extend/pythonpath/utils/docs/links.py

@@ -1,5 +1,26 @@
 // This devcontainer directs workspaces to use a pre-built image. To make
 // configuration changes, edit prebuild-devcontainer.json in this folder instead
 {
-    "image": "registry.ddbuild.io/workspaces/prebuilt/datadog/datadog-agent@sha256:23a853a5e181b86b01bb82f55c2b1fd35f3b614a52e2b1d5db27e2f057ec7948"
+  "image": "registry.ddbuild.io/workspaces/prebuilt/datadog/datadog-agent@sha256:5d8bf28b3e932c6e5e25cccc32f283a6cff9ddb475346f132c36b0a5ae81975d",
+  "runArgs": [
+    "--pid=host",
+    "--cgroupns=host",
+    //"-v",
+    //"/etc/passwd:/etc/passwd",
+    //"-v",
+    //"/etc/group:/etc/group",
+    // WARNING: This mounts the entire host filesystem (read-only) into the container.
+    // When an AI coding agent runs inside, it can
+    // autonomously read any host file — SSH keys, cloud credentials, shell history,
+    // browser secrets — without explicit user action, and may include them in context
+    // sent to a remote model. Only use on machines that do not hold high-value secrets.
+    // Justified because system-probe and eBPF development require host filesystem
+    // visibility to mirror what the Datadog Agent does in production.
+    "-v",
+    "/:/host/root:ro",
+    "-v",
+    "/sys/kernel/debug:/sys/kernel/debug",
+    "-v",
+    "/etc/os-release:/etc/os-release",
+  ],
 }

.devcontainer/datadog/default/devcontainer.json

@@ -12,5 +12,24 @@
     "forwardPorts": [22],
     "containerUser": "root",
     "remoteUser": "bits",
-    "waitFor": "postStartCommand"
+    "waitFor": "postStartCommand",
+    "securityOpt": [
+        "apparmor:unconfined"
+    ],
+    "capAdd": [
+        "SYS_ADMIN",
+        "SYS_RESOURCE",
+        "SYS_PTRACE",
+        "NET_ADMIN",
+        "NET_BROADCAST",
+        "NET_RAW",
+        "IPC_LOCK",
+        "CHOWN",
+        "KILL"
+    ],
+    "containerEnv": {
+        "HOST_ROOT": "/host/root",
+        "HOST_PROC": "/host/root/proc",
+        "HOST_SYS": "/host/root/sys"
+    }
 }