Skip to content

Conversation

@aiuto
Copy link
Contributor

@aiuto aiuto commented Jan 16, 2026

ABLD-267 Build nghttp2 with Bazel.

  • Follows the standard pattern for pkg_* rules.
  • Add the shared lib symlinks
  • Preserve the fetch-ocsp-response tool from version 1.58. It is dropped at head, so if we want to continue shipping it AND update versions of, we'll need to provide it another way.

This does not hook into curl right now.

Getting this build file a little better will let us explore both forks of the new problems indepenedently.

Desk check

$ bazelisk run -- @nghttp2//:install --destdir=/tmp/opt/datadog-agent ; find /tmp/opt/datadog-agent
$ find /tmp/opt/datadog-agent
/tmp/opt/datadog-agent
/tmp/opt/datadog-agent/LICENSES
/tmp/opt/datadog-agent/LICENSES/nghttp2-COPYING
/tmp/opt/datadog-agent/embedded
/tmp/opt/datadog-agent/embedded/lib
/tmp/opt/datadog-agent/embedded/lib/lib
/tmp/opt/datadog-agent/embedded/lib/lib/libnghttp2.so.14.25.1
/tmp/opt/datadog-agent/embedded/lib/lib/libnghttp2.so
/tmp/opt/datadog-agent/embedded/lib/lib/libnghttp2.so.14
/tmp/opt/datadog-agent/embedded/include
/tmp/opt/datadog-agent/embedded/include/nghttp2
/tmp/opt/datadog-agent/embedded/include/nghttp2/nghttp2.h
/tmp/opt/datadog-agent/embedded/include/nghttp2/nghttp2ver.h
/tmp/opt/datadog-agent/embedded/share
/tmp/opt/datadog-agent/embedded/share/nghttp2
/tmp/opt/datadog-agent/embedded/share/nghttp2/fetch-ocsp-response

@aiuto aiuto requested a review from a team as a code owner January 16, 2026 04:54
@aiuto aiuto added changelog/no-changelog qa/no-code-change No code change in Agent code requiring validation labels Jan 16, 2026
@github-actions github-actions bot added medium review PR review might take time team/agent-build labels Jan 16, 2026
@agent-platform-auto-pr
Copy link
Contributor

agent-platform-auto-pr bot commented Jan 16, 2026

Static quality checks

✅ Please find below the results from static quality gates
Comparison made with ancestor 028a6cf
📊 Static Quality Gates Dashboard

31 successful checks with minimal change (< 2 KiB)
Quality gate Current Size
agent_deb_amd64 752.495 MiB
agent_deb_amd64_fips 701.164 MiB
agent_heroku_amd64 326.966 MiB
agent_msi 663.040 MiB
agent_rpm_amd64 752.479 MiB
agent_rpm_amd64_fips 701.148 MiB
agent_rpm_arm64 731.252 MiB
agent_rpm_arm64_fips 683.248 MiB
agent_suse_amd64 752.479 MiB
agent_suse_amd64_fips 701.148 MiB
agent_suse_arm64 731.252 MiB
agent_suse_arm64_fips 683.248 MiB
docker_agent_amd64 814.597 MiB
docker_agent_arm64 817.960 MiB
docker_agent_jmx_amd64 1005.475 MiB
docker_agent_jmx_arm64 997.558 MiB
docker_cluster_agent_amd64 181.112 MiB
docker_cluster_agent_arm64 196.918 MiB
docker_cws_instrumentation_amd64 7.135 MiB
docker_cws_instrumentation_arm64 6.689 MiB
docker_dogstatsd_amd64 38.832 MiB
docker_dogstatsd_arm64 37.128 MiB
dogstatsd_deb_amd64 30.055 MiB
dogstatsd_deb_arm64 28.200 MiB
dogstatsd_rpm_amd64 30.055 MiB
dogstatsd_suse_amd64 30.055 MiB
iot_agent_deb_amd64 43.029 MiB
iot_agent_deb_arm64 40.135 MiB
iot_agent_deb_armhf 40.705 MiB
iot_agent_rpm_amd64 43.030 MiB
iot_agent_suse_amd64 43.030 MiB
On-wire sizes (compressed)
Quality gate Change Size (prev → curr → max)
agent_deb_amd64 +6.68 KiB (0.00% increase) 183.932 → 183.938 → 184.810
agent_deb_amd64_fips +3.34 KiB (0.00% increase) 172.629 → 172.632 → 173.790
agent_heroku_amd64 +2.2 KiB (0.00% increase) 87.153 → 87.155 → 88.450
agent_msi -20.0 KiB (0.01% reduction) 143.172 → 143.152 → 143.300
agent_rpm_amd64 -6.43 KiB (0.00% reduction) 186.838 → 186.832 → 188.160
agent_rpm_amd64_fips -6.61 KiB (0.00% reduction) 175.695 → 175.689 → 176.600
agent_rpm_arm64 +2.89 KiB (0.00% increase) 168.607 → 168.610 → 169.930
agent_rpm_arm64_fips -5.46 KiB (0.00% reduction) 159.209 → 159.204 → 160.550
agent_suse_amd64 -6.43 KiB (0.00% reduction) 186.838 → 186.832 → 188.160
agent_suse_amd64_fips -6.61 KiB (0.00% reduction) 175.695 → 175.689 → 176.600
agent_suse_arm64 +2.89 KiB (0.00% increase) 168.607 → 168.610 → 169.930
agent_suse_arm64_fips -5.46 KiB (0.00% reduction) 159.209 → 159.204 → 160.550
docker_agent_amd64 neutral 276.622 MiB → 277.400
docker_agent_arm64 -2.99 KiB (0.00% reduction) 264.039 → 264.036 → 266.040
docker_agent_jmx_amd64 +3.66 KiB (0.00% increase) 345.252 → 345.255 → 346.020
docker_agent_jmx_arm64 +2.26 KiB (0.00% increase) 328.657 → 328.659 → 330.660
docker_cluster_agent_amd64 neutral 63.994 MiB → 64.490
docker_cluster_agent_arm64 neutral 60.258 MiB → 61.170
docker_cws_instrumentation_amd64 neutral 2.994 MiB → 3.330
docker_cws_instrumentation_arm64 neutral 2.726 MiB → 3.090
docker_dogstatsd_amd64 neutral 15.031 MiB → 15.820
docker_dogstatsd_arm64 neutral 14.352 MiB → 14.830
dogstatsd_deb_amd64 neutral 7.947 MiB → 8.790
dogstatsd_deb_arm64 neutral 6.825 MiB → 7.710
dogstatsd_rpm_amd64 neutral 7.958 MiB → 8.800
dogstatsd_suse_amd64 neutral 7.958 MiB → 8.800
iot_agent_deb_amd64 neutral 11.289 MiB → 12.040
iot_agent_deb_arm64 neutral 9.646 MiB → 10.450
iot_agent_deb_armhf neutral 9.844 MiB → 10.620
iot_agent_rpm_amd64 -2.91 KiB (0.03% reduction) 11.310 → 11.307 → 12.060
iot_agent_suse_amd64 -2.91 KiB (0.03% reduction) 11.310 → 11.307 → 12.060

@cit-pr-commenter
Copy link

cit-pr-commenter bot commented Jan 16, 2026

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Run ID: ef2ce0d7-db02-43d5-9c11-a3b517d3a688

Baseline: 028a6cf
Comparison: f458129
Diff

Optimization Goals: ✅ No significant changes detected

Experiments ignored for regressions

Regressions in experiments with settings containing erratic: true are ignored.

perf experiment goal Δ mean % Δ mean % CI trials links
docker_containers_cpu % cpu utilization +1.49 [-1.61, +4.58] 1 Logs

Fine details of change detection per experiment

perf experiment goal Δ mean % Δ mean % CI trials links
docker_containers_cpu % cpu utilization +1.49 [-1.61, +4.58] 1 Logs
quality_gate_metrics_logs memory utilization +1.30 [+1.08, +1.51] 1 Logs bounds checks dashboard
tcp_syslog_to_blackhole ingress throughput +0.48 [+0.39, +0.58] 1 Logs
ddot_metrics_sum_delta memory utilization +0.30 [+0.10, +0.50] 1 Logs
quality_gate_logs % cpu utilization +0.26 [-1.26, +1.79] 1 Logs bounds checks dashboard
quality_gate_idle memory utilization +0.24 [+0.20, +0.29] 1 Logs bounds checks dashboard
ddot_metrics_sum_cumulativetodelta_exporter memory utilization +0.23 [+0.00, +0.46] 1 Logs
ddot_metrics memory utilization +0.22 [-0.00, +0.44] 1 Logs
otlp_ingest_logs memory utilization +0.13 [+0.04, +0.22] 1 Logs
quality_gate_idle_all_features memory utilization +0.06 [+0.02, +0.09] 1 Logs bounds checks dashboard
file_to_blackhole_0ms_latency egress throughput +0.03 [-0.48, +0.54] 1 Logs
file_to_blackhole_100ms_latency egress throughput +0.03 [-0.02, +0.07] 1 Logs
file_to_blackhole_1000ms_latency egress throughput +0.02 [-0.39, +0.43] 1 Logs
tcp_dd_logs_filter_exclude ingress throughput -0.00 [-0.09, +0.09] 1 Logs
uds_dogstatsd_to_api ingress throughput -0.01 [-0.14, +0.12] 1 Logs
uds_dogstatsd_to_api_v3 ingress throughput -0.02 [-0.14, +0.10] 1 Logs
file_to_blackhole_500ms_latency egress throughput -0.04 [-0.43, +0.35] 1 Logs
file_tree memory utilization -0.11 [-0.16, -0.06] 1 Logs
otlp_ingest_metrics memory utilization -0.12 [-0.27, +0.03] 1 Logs
uds_dogstatsd_20mb_12k_contexts_20_senders memory utilization -0.18 [-0.23, -0.13] 1 Logs
ddot_metrics_sum_cumulative memory utilization -0.19 [-0.36, -0.02] 1 Logs
docker_containers_memory memory utilization -0.23 [-0.30, -0.16] 1 Logs
ddot_logs memory utilization -0.69 [-0.76, -0.62] 1 Logs

Bounds Checks: ✅ Passed

perf experiment bounds_check_name replicates_passed links
docker_containers_cpu simple_check_run 10/10
docker_containers_memory memory_usage 10/10
docker_containers_memory simple_check_run 10/10
file_to_blackhole_0ms_latency lost_bytes 10/10
file_to_blackhole_0ms_latency memory_usage 10/10
file_to_blackhole_1000ms_latency lost_bytes 10/10
file_to_blackhole_1000ms_latency memory_usage 10/10
file_to_blackhole_100ms_latency lost_bytes 10/10
file_to_blackhole_100ms_latency memory_usage 10/10
file_to_blackhole_500ms_latency lost_bytes 10/10
file_to_blackhole_500ms_latency memory_usage 10/10
quality_gate_idle intake_connections 10/10 bounds checks dashboard
quality_gate_idle memory_usage 10/10 bounds checks dashboard
quality_gate_idle_all_features intake_connections 10/10 bounds checks dashboard
quality_gate_idle_all_features memory_usage 10/10 bounds checks dashboard
quality_gate_logs intake_connections 10/10 bounds checks dashboard
quality_gate_logs lost_bytes 10/10 bounds checks dashboard
quality_gate_logs memory_usage 10/10 bounds checks dashboard
quality_gate_metrics_logs cpu_usage 10/10 bounds checks dashboard
quality_gate_metrics_logs intake_connections 10/10 bounds checks dashboard
quality_gate_metrics_logs lost_bytes 10/10 bounds checks dashboard
quality_gate_metrics_logs memory_usage 10/10 bounds checks dashboard

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

  • ✅ = significantly better comparison variant performance
  • ❌ = significantly worse comparison variant performance
  • ➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

  1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.

  2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.

  3. Its configuration does not mark it "erratic".

CI Pass/Fail Decision

Passed. All Quality Gates passed.

  • quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check lost_bytes: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check lost_bytes: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.

Copy link
Contributor

@chouquette chouquette left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Preserve the fetch-ocsp-response tool from version 1.58. It is dropped at head, so if we want to continue shipping it AND update versions of, we'll need to provide it another way.

I don't follow, we are using 1.58, then it should still be present in the sources we expend, and if we update to a version that doesn't ship it, I'd rather we adapt to its removal instead of commiting to maintain it

Comment on lines 146 to 147
# It must be a separate pkg_install because it has to go to
# / on the build machine, not {install_dir}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you extend on that comment? I don't understand what you mean

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I changed to comment here and at the other install to clarify that they get installed into different roots.

},
)

# This is a hack to work around a bug in rules_pkg.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you maybe add a link to that bug for more context? Just in case someone else encounters the same bug

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is no bug filed yet. The description of the problem is a few lines below, where this target is used.
I'll create that at the end of the month when I do rules_pkg backlog.

Comment on lines +100 to +159
# "@@//third_party/nghttp2:fetch-ocsp-response"
# here, but rules_pkg calculates the path as a relative ref to @nghttp2
Copy link
Contributor

@rdesgroppes rdesgroppes Jan 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I may have a look since one of my earlier contributions got accepted by their BDFLs.

Copy link
Contributor

@rdesgroppes rdesgroppes Jan 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't bother fixing anything in rules_pkg right now. We are probably going to throw out the intermediate manifest and replace it with the thing from rules_img. Work until then is potentially throwaway.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

whether we keep rules_pkg or not, the change wasn't that difficult to implement: bazelbuild/rules_pkg#1004

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can keep rules_pkg, it's just that the implementation underneath the remapping will change to interoperate with rules_img.

@aiuto aiuto added the ask-review Ask required teams to review this PR label Jan 16, 2026
@github-actions github-actions bot added long review PR is complex, plan time to review it and removed medium review PR review might take time labels Jan 16, 2026
- Follows the standard pattern.
- Preserve the fetch-ocsp-response tool from version 1.58. It is
  dropped at head, so if we want to continue shipping it AND update
  versions of, we'll need to provide it another way.
- make the globs explicit to guard against unexpected extra code.

This is not in use yet.
- Still investigating why the .so size is larger. blocked on better toolchains
- When used with curl, other random things start to fail linking. This is bonkers.
@aiuto
Copy link
Contributor Author

aiuto commented Jan 20, 2026

Preserve the fetch-ocsp-response tool from version 1.58. It is dropped at head, so if we want to continue shipping it AND update versions of, we'll need to provide it another way.

I don't follow, we are using 1.58, then it should still be present in the sources we expend, and if we update to a version that doesn't ship it, I'd rather we adapt to its removal instead of committing to maintain it

There are a few independent things going on.

  • We always want to be in a place where we can do fast update to a new version.
  • As we know, dropping files can have bad effects. We should not rush that choice, but do it at a slow time scale. Certainly longer than the time needed to finish bazel migration.

So, the prudent thing to do now is get poised to make a quick update if we want it.

@aiuto aiuto requested a review from chouquette January 21, 2026 02:46
@aiuto aiuto changed the title [ABLD-267] Build nghttp2 with Bazel. [ABLD-267] improve nghttp2 bazel config Jan 21, 2026
user_link_flags = select({
"@platforms//os:linux": [
"-Wl,--gc-sections",
"-Wl,--strip-all",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will not generate the debug symbols at all instead of stripping them later on.

Personally I'm very fine with it, as I doubt anyone will ever need the agent's nghttp2's debug symbols, but that is technically a breaking change.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ack. We should move this all to the toolchain anyway.
And there is still another round of tuning after I do the lib file comparison to see why the size change is dramatic.
It does not have to be right now, since it is not replacing omnibus. But having the baseline allows forking work into two independent PRs that deal with size and overall link correctness.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do we have to vendor this file?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We discussed that in the main thread.

  • We are very out of date in versions: using 1.58 instead of 1.68
  • 1.68 drops the file.
  • In order to update and avoid a breaking change, we'll need to copy it out of 1.58 and preserve it.

Doing this now makes it easy to do a fast update to 1.68 without rediscovering this problem.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ack.
Although, I can't find any usage of this fine in neither curl nor the agent, so I suppose this is out of safety rather than an actual need? If so we should create a task to remove it as followup work

@aiuto aiuto requested a review from chouquette January 22, 2026 17:10
Copy link
Contributor

@chouquette chouquette left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM with a couple nits

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ack.
Although, I can't find any usage of this fine in neither curl nor the agent, so I suppose this is out of safety rather than an actual need? If so we should create a task to remove it as followup work

@aiuto
Copy link
Contributor Author

aiuto commented Jan 26, 2026

so I suppose this is out of safety rather than an actual need? If so we should create a task to remove it as followup work

Yes. Removing things is a recurring problem. https://datadoghq.atlassian.net/browse/ABLD-350

@aiuto
Copy link
Contributor Author

aiuto commented Jan 26, 2026

/merge

@gh-worker-devflow-routing-ef8351
Copy link

gh-worker-devflow-routing-ef8351 bot commented Jan 26, 2026

View all feedbacks in Devflow UI.

2026-01-26 15:43:12 UTC ℹ️ Start processing command /merge


2026-01-26 15:43:59 UTC ℹ️ MergeQueue: waiting for PR to be ready

This pull request is not mergeable according to GitHub. Common reasons include pending required checks, missing approvals, or merge conflicts — but it could also be blocked by other repository rules or settings.
It will be added to the queue as soon as checks pass and/or get approvals. View in MergeQueue UI.
Note: if you pushed new commits since the last approval, you may need additional approval.
You can remove it from the waiting list with /remove command.


2026-01-26 19:45:11 UTC ⚠️ MergeQueue: This merge request was unqueued

devflow unqueued this merge request: It did not become mergeable within the expected time

@aiuto
Copy link
Contributor Author

aiuto commented Jan 26, 2026

/merge

@gh-worker-devflow-routing-ef8351
Copy link

gh-worker-devflow-routing-ef8351 bot commented Jan 26, 2026

View all feedbacks in Devflow UI.

2026-01-26 20:12:02 UTC ℹ️ Start processing command /merge


2026-01-26 20:12:15 UTC ℹ️ MergeQueue: waiting for PR to be ready

This pull request is not mergeable according to GitHub. Common reasons include pending required checks, missing approvals, or merge conflicts — but it could also be blocked by other repository rules or settings.
It will be added to the queue as soon as checks pass and/or get approvals. View in MergeQueue UI.
Note: if you pushed new commits since the last approval, you may need additional approval.
You can remove it from the waiting list with /remove command.


2026-01-26 22:30:19 UTC ℹ️ MergeQueue: merge request added to the queue

The expected merge time in main is approximately 58m (p90).


2026-01-26 22:51:22 UTC ℹ️ MergeQueue: This merge request was merged

@gh-worker-dd-mergequeue-cf854d gh-worker-dd-mergequeue-cf854d bot merged commit b66e1bb into main Jan 26, 2026
272 checks passed
@gh-worker-dd-mergequeue-cf854d gh-worker-dd-mergequeue-cf854d bot deleted the aiuto/nhg branch January 26, 2026 22:51
@github-actions github-actions bot added this to the 7.77.0 milestone Jan 26, 2026
@github-actions github-actions bot locked and limited conversation to collaborators Jan 26, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

ask-review Ask required teams to review this PR changelog/no-changelog long review PR is complex, plan time to review it qa/no-code-change No code change in Agent code requiring validation team/agent-build

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants