Run system-probe config fixups after BuildSchema

pkg/config/setup/config.go

@@ -133,6 +133,9 @@ func InitConfigObjects() {
 	// Build the environment variable layer
 	datadog.(pkgconfigmodel.BuildableConfig).BuildSchema()
 	systemProbe.(pkgconfigmodel.BuildableConfig).BuildSchema()
+
+	// Fixups that need to read config values must run after BuildSchema(), once the config is ready for use.
+	fixupPostBuildConfig()
 }
 
 // InitConfig initializes the config defaults on a config used by all agents

pkg/config/setup/config_init.go

@@ -19,7 +19,11 @@ func fixupInitConfig() {
 	ddcfg := Datadog()
 	fixupInitCommonConfigComponents(ddcfg)
 	fixupInitFullAgentOnlyComponents(ddcfg)
+}
 
-	sysprobe := SystemProbe()
-	fixupInitSystemProbe(sysprobe)
+// fixupPostBuildConfig runs fixups that need to read config values, so they must run after
+// BuildSchema() has marked the config ready for use (unlike fixupInitConfig, which only
+// registers override funcs and declares defaults before the config is ready).
+func fixupPostBuildConfig() {
+	fixupInitSystemProbe(SystemProbe())
 }

pkg/config/setup/config_init_serverless.go

@@ -23,6 +23,9 @@ func fixupInitConfig() {
 	fixupInitServerlessOnlyComponents(ddcfg)
 }
 
+// fixupPostBuildConfig is a no-op in serverless builds, which have no system-probe config.
+func fixupPostBuildConfig() {}
+
 // called only for full-agent, ONLY for serverless, after declaring settings
 func fixupInitServerlessOnlyComponents(_ pkgconfigmodel.Config) { // nolint:unused,deadcode this is only used by serverless
 	// Do not extend this list !

pkg/config/setup/config_init_test.go

@@ -0,0 +1,44 @@
+// Unless explicitly stated otherwise all files in this repository are licensed
+// under the Apache License Version 2.0.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2016-present Datadog, Inc.
+
+//go:build test && !serverless
+
+package setup
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	pkgconfigmodel "github.com/DataDog/datadog-agent/pkg/config/model"
+)
+
+// TestFixupInitSystemProbeRunsAfterConfigIsReady is a regression test for a bug where
+// fixupInitSystemProbe read/wrote system-probe config keys before BuildSchema() marked the
+// config ready for use. Under HOST_ETC (any containerized deployment), the guarded getters
+// silently no-op instead of applying the HOST_ETC path rewrite, so apt/yum/zypper repo dirs
+// were never adjusted to point under the host filesystem.
+func TestFixupInitSystemProbeRunsAfterConfigIsReady(t *testing.T) {
+	origDatadog := Datadog().(pkgconfigmodel.BuildableConfig)
+	origSystemProbe := SystemProbe().(pkgconfigmodel.BuildableConfig)
+	t.Cleanup(func() {
+		SetDatadog(origDatadog)         // nolint: forbidigo // restoring the singleton after the test
+		SetSystemProbe(origSystemProbe) // nolint: forbidigo // restoring the singleton after the test
+	})
+
+	t.Setenv("HOST_ETC", "/host/etc")
+
+	InitConfigObjects()
+
+	for _, name := range []string{
+		"system_probe_config.apt_config_dir",
+		"system_probe_config.yum_repos_dir",
+		"system_probe_config.zypper_repos_dir",
+	} {
+		val := SystemProbe().GetString(name)
+		require.True(t, strings.HasPrefix(val, "/host/etc"), "expected %s to be rooted under HOST_ETC, got %q", name, val)
+	}
+}