[BUG] Container collection enabled forced to true when DD_PROCESS_CONFIG_ENABLED set to false

[nickmonad]

Agent version

7.77.0

Bug Report

We are attempting to run the DataDog agent in two separate modes, depending our customer's environment configuration.

• Dual-shipping metrics to both DataDog SaaS and a self-hosted VictoriaMetrics instance, as supported and configured according to VictoriaMetrics documentation
• Single-shipping metrics to just VictoriaMetrics, when DataDog SaaS is unavailable.

In the second case, when we are single-shipping metrics to just VM, we need to turn off a lot of agent functionality and built-in checks, to avoid unnecessary network requests and logging in the customer environment, since VM doesn't support all types of requests coming from the agent.

While working through figuring out which settings we need to provide to the agent to disable checks, we found a situation where the presence of a deprecated flag is forcing an override on another flag.

Specifically,

DD_PROCESS_CONFIG_ENABLED="false" 
DD_PROCESS_CONFIG_CONTAINER_COLLECTION_ENABLED="false"

Results in the following configuration, when inspected with agent config

process_config:
  container_collection:
    enabled: true

I believe this is due to the following logic: https://github.com/DataDog/datadog-agent/blob/7.77.0/pkg/config/setup/process.go#L192-L211

Specifically, this sequence here,

func loadProcessTransforms(config pkgconfigmodel.Config) {
	if config.IsSet("process_config.enabled") {
		log.Warn("process_config.enabled is deprecated, use process_config.container_collection.enabled " +
			"and process_config.process_collection.enabled instead, " +
			"see https://docs.datadoghq.com/infrastructure/process#installation for more information")
		procConfigEnabled := strings.ToLower(config.GetString("process_config.enabled"))
		if procConfigEnabled == "disabled" {
                    // .........
		} else if enabled, _ := strconv.ParseBool(procConfigEnabled); enabled { // "true"
                    // .........
		} else { // "false"
			config.Set("process_config.process_collection.enabled", false, pkgconfigmodel.SourceAgentRuntime)
                        // HERE: container collection forced to true
			config.Set("process_config.container_collection.enabled", true, pkgconfigmodel.SourceAgentRuntime)
			config.Set("process_config.enabled", "disabled", pkgconfigmodel.SourceAgentRuntime)
		}
	}
}

Removing DD_PROCESS_CONFIG_ENABLED from the environment variable configuration results in container collection being set to the expected value.

process_config:
  container_collection:
    enabled: false

I assume that container_collection should also be set to false in the logic above, but I'm not entirely sure, given the fact this process_config.enabled has been deprecated and I don't know exactly what the intention was here. :) In any case, it took a fair amount of time to track this down.

Reproduction Steps

In a local docker setup, run some other long-running container (like postgres), and then start the agent locally with the following configuration.

docker run --rm -it \
    --name "ddagent" \
    -v /var/run/docker.sock:/var/run/docker.sock:ro \
    -v /proc/:/host/proc/:ro \
    -v /sys/fs/cgroup/:/host/sys/fs/cgroup:ro \
    -e DD_API_KEY="apikey" \
    -e DD_APM_ENABLED="false" \
    -e DD_APM_NON_LOCAL_TRAFFIC="true" \
    -e DD_AUTOCONFIG_EXCLUDE_FEATURES="orchestratorexplorer" \
    -e DD_CHECKS_TAG_CARDINALITY="high" \
    -e DD_CONTAINER_IMAGE_ENABLED="false" \
    -e DD_CONTAINER_LIFECYCLE_ENABLED="false" \
    -e DD_DD_URL="https://VICTORIAMETRICS/datadog" \
    -e DD_DOGSTATSD_NON_LOCAL_TRAFFIC="true" \
    -e DD_ENV="local" \
    -e DD_HOSTNAME="local" \
    -e DD_IGNORE_AUTOCONF="consul" \
    -e DD_INVENTORIES_CONFIGURATION_ENABLED="false" \
    -e DD_LOGS_ENABLED="false" \
    -e DD_LOG_LEVEL="error" \
    -e DD_ORCHESTRATOR_EXPLORER_ENABLED="false" \
    -e DD_PROCESS_CONFIG_CONTAINER_COLLECTION_ENABLED="false" \
    -e DD_PROCESS_CONFIG_DISABLE_REALTIME_CHECKS="true" \
    -e DD_PROCESS_CONFIG_ENABLED="false" \
    -e DD_PROCESS_CONFIG_INTERVALS_CONTAINER="1" \
    -e DD_PROCESS_CONFIG_PROCESS_COLLECTION_ENABLED="false" \
    -e DD_PROCESS_CONFIG_PROCESS_DISCOVERY_ENABLED="false" \
    -e DD_REMOTE_CONFIGURATION_ENABLED="false" \
    -e DD_SBOM_ENABLED="false" \
    -e DD_SERVICE="service" \
    -e DD_VERSION="test" \
    datadog/agent:7

Observe the agent config

docker exec -it ddagent agent config

process_config:
  container_collection:
    enabled: true

Now, remove DD_PROCESS_CONFIG_ENABLED entirely from the environment configuration above and restart agent.

Observe expected container collection value in agent config

process_config:
  container_collection:
    enabled: false

Agent configuration

See repro setups above.

Operating System

Darwin Mac 24.6.0 Darwin Kernel Version 24.6.0

Other environment details

(also observed in ECS Fargate deployment)

[nickmonad]

I'm realizing now it makes sense that when process_config.enabled is false via the env var, that wouldn't necessarily mean that conatiner_collection.enabled should also be false (since "process" != "container"), but the forcing of that value was still confusing for us.