dhi.io/datadog-cluster-agent
Datadog Cluster Agent
Datadog Cluster Agent runs centralized Kubernetes cluster-level checks, serves a custom-metrics provider for HPA, and acts as a proxy between node agents and the Kubernetes API.
pushed 14 hours ago
linux/amd64
111.70 MB
for linux/amd64
547
for linux/amd64
Active support
datadog-cluster-agent, cws-instrumentation, secret-generic-connector
Build Level 3
Tamper-evident proof of how and from what sources this image was built. Build Level 3 is the highest the SLSA build track defines.
CycloneDX SBOM + SPDX SBOM
A software bill of materials in both CycloneDX and SPDX formats so it drops straight into your existing tooling. Audit exactly what you're shipping.
A Vulnerability Exploitability exchange document, Docker's assessment of which CVEs actually affect this image and which don't apply, so you can focus on real risk instead of chasing false positives.
Available
A link to everything used to build the image, package source code, Git repos, and build files, so you can audit or reproduce the build and stay compliant with open source licenses.
Every known vulnerability in this image, shown in full rather than hidden. The VEX data flags which ones actually apply, so you can tell real exposure from noise before you ship.
Exactly what changed in this build, down to the package bumps and fixes behind the version you're pulling.
Verifies no keys, tokens, or credentials were accidentally baked into the image.
The image layers were scanned for known malware signatures before publishing.
About Datadog Cluster Agent
The Datadog Cluster Agent is a Kubernetes-native companion to the Datadog node Agent that runs centralized cluster-level
checks (such as a single source of truth for cluster checks dispatched to other agents), exposes a custom-metrics
provider used by Horizontal Pod Autoscalers, and proxies all node-agent traffic to the Kubernetes API server. By
consolidating cluster-scoped responsibilities into a single workload, the Cluster Agent reduces load on kube-apiserver
and avoids the noise of running cluster checks on every node.
This Docker Hardened Image ships the datadog-cluster-agent binary together with cws-instrumentation and
secret-generic-connector, the nosys-seccomp shim used by the upstream image, and the cluster-agent configuration
templates found in /etc/datadog-agent/.
About Docker Hardened Images
Docker Hardened Images (DHI) are minimal, secure container images maintained by Docker. They contain only what's needed to run the application -- no shell, no package manager, and no unnecessary binaries in the runtime variant. DHI images are continuously scanned, patched, and signed, with cryptographic provenance and a complete SBOM.
Why use Docker Hardened Images?
- Continuously scanned, patched, and rebuilt to eliminate known CVEs.
- Minimal attack surface: no shell, no package manager, and no unnecessary tooling in runtime variants.
- Non-root by default and runtime hardening applied across the catalog.
- Cryptographically signed with full provenance and a complete SBOM so deployments can be audited and verified.
Trademarks
Datadog is a registered trademark of Datadog, Inc. This image is not affiliated with, endorsed by, or sponsored by Datadog, Inc. The image is provided to make it convenient to run upstream Datadog Cluster Agent releases inside the Docker Hardened Images program.