This page lists configuration options for the Containers page in Datadog. To learn more about the Containers page and its capabilities, see Containers View documentation.

Configuration options

Include or exclude containers

Include and exclude containers from real-time collection:

• Exclude containers either by passing the environment variable DD_CONTAINER_EXCLUDE or by adding container_exclude: in your datadog.yaml main configuration file.
• Include containers either by passing the environment variable DD_CONTAINER_INCLUDE or by adding container_include: in your datadog.yaml main configuration file.

Both arguments take an image name as value. Regular expressions are also supported.

For example, to exclude all Debian images except containers with a name starting with frontend, add these two configuration lines in your datadog.yaml file:

container_exclude: ["image:debian"]
container_include: ["name:frontend.*"]

Note: For Agent 5, instead of including the above in the datadog.conf main configuration file, explicitly add a datadog.yaml file to /etc/datadog-agent/, as the Process Agent requires all configuration options here. This configuration only excludes containers from real-time collection, not from Autodiscovery.

Scrubbing sensitive information

To prevent the leaking of sensitive data, you can scrub sensitive words in container YAML files. Container scrubbing is enabled by default for Helm charts, and some default sensitive words are provided:

• password
• passwd
• mysql_pwd
• access_token
• auth_token
• api_key
• apikey
• pwd
• secret
• credentials
• stripetoken

You can set additional sensitive words by providing a list of words to the environment variable DD_ORCHESTRATOR_EXPLORER_CUSTOM_SENSITIVE_WORDS. This adds to, and does not overwrite, the default words.

Note: The additional sensitive words must be in lowercase, as the Agent compares the text with the pattern in lowercase. This means password scrubs MY_PASSWORD to MY_*******, while PASSWORD does not.

You need to setup this environment variable for the following agents:

• process-agent
• cluster-agent

env:
    - name: DD_ORCHESTRATOR_EXPLORER_CUSTOM_SENSITIVE_WORDS
      value: "customword1 customword2 customword3"

For example, because password is a sensitive word, the scrubber changes <MY_PASSWORD> in any of the following to a string of asterisks, ***********:

password <MY_PASSWORD>
password=<MY_PASSWORD>
password: <MY_PASSWORD>
password::::== <MY_PASSWORD>

However, the scrubber does not scrub paths that contain sensitive words. For example, it does not overwrite /etc/vaultd/secret/haproxy-crt.pem with /etc/vaultd/******/haproxy-crt.pem even though secret is a sensitive word.

Configure Orchestrator Explorer

Resource collection compatibility matrix

The following table presents the list of collected resources and the minimal Agent, Cluster Agent, and Helm chart versions for each.

Note: After version 1.22, Cluster Agent version numbering follows Agent release numbering, starting with version 7.39.0.

Add custom tags to resources

You can add custom tags to Kubernetes resources to ease filtering inside the Kubernetes resources view.

Additional tags are added through the DD_ORCHESTRATOR_EXPLORER_EXTRA_TAGS environment variable.

Note: These tags only show up in the Kubernetes resources view.

apiVersion: datadoghq.com/v2alpha1
kind: DatadogAgent
metadata:
  name: datadog
spec:
  global:
    credentials:
      apiKey: <DATADOG_API_KEY>
      appKey: <DATADOG_APP_KEY>
  features:
    liveContainerCollection:
      enabled: true
    orchestratorExplorer:
      enabled: true
  override:
    agents:
      containers:
        processAgent:
          env:
            - name: "DD_ORCHESTRATOR_EXPLORER_EXTRA_TAGS"
              value: "tag1:value1 tag2:value2"
    clusterAgent:
      env:
        - name: "DD_ORCHESTRATOR_EXPLORER_EXTRA_TAGS"
          value: "tag1:value1 tag2:value2"

kubectl apply -n $DD_NAMESPACE -f datadog-agent.yaml

agents:
  containers:
    processAgent:
      env:
        - name: "DD_ORCHESTRATOR_EXPLORER_EXTRA_TAGS"
          value: "tag1:value1 tag2:value2"
clusterAgent:
  env:
    - name: "DD_ORCHESTRATOR_EXPLORER_EXTRA_TAGS"
      value: "tag1:value1 tag2:value2"

- name: DD_ORCHESTRATOR_EXPLORER_EXTRA_TAGS
  value: "tag1:value1 tag2:value2"

Collect custom resources and CustomResourceDefinitions

The Orchestrator Explorer collects CustomResourceDefinitions by default. These definitions appear in Datadog without any user configuration required.

To collect custom resources, you need to configure both the Datadog Agent and set up indexing.

1. Configure the Datadog Agent:

   Add the following configuration to datadog-values.yaml:

   orchestratorExplorer:
       customResources:
           - <CUSTOM_RESOURCE_NAME>
   

   Each <CUSTOM_RESOURCE_NAME> must use the format group/version/kind.

   The Datadog Operator needs permission to allow the Agent to collect custom resources. Install the Operator with an option that grants this permission:

   helm install datadog-operator datadog/datadog-operator --set clusterRole.allowReadAllResources=true
   

   Then, add the following configuration to your DatadogAgent manifest, datadogagent.yaml:

   features:
     orchestratorExplorer:
       customResources:
         - <CUSTOM_RESOURCE_NAME>
   

   Each <CUSTOM_RESOURCE_NAME> must use the format group/version/kind.

2. In Datadog, open Orchestrator Explorer.

3. On the left panel, under Select Resources, select Kubernetes > Custom Resources > Resource Definitions.

4. Locate the custom resource definition that corresponds to the resource you want to visualize in the explorer. Click on the version under the Versions column.

5. Click to select the fields you would like to index from the Custom Resource (maximum of 50 fields per resource), then click Enable Indexing to save

Once fields are indexed, they will be available to add as columns in the explorer or as part of Saved Views.

Further reading

Additional helpful documentation, links, and articles:

See all of your hosts/containers with the Infrastructure MapDOCUMENTATION Understand what is going on at any level of your systemDOCUMENTATION