[gengnamstyle]

Changes

• Select read-only /host/etc/passwd for live-process/process-discovery mounts on stable Agent 7.x >= 7.86.0, preserving image-local accounts. Follow effective image overrides; old/unknown images and Autopilot retain /etc/passwd.
• Preserve Talos exclusions, security/group mounts, and user environment configuration. Add image-selection and in-memory pod-template tests, including both process features and single-container mode.
• Document Gohai's separate limitation: it can still resolve image-local users instead of host users, including UID collisions.

Validation

• Full make ci-test passed locally on ARM64: root/API unit suites plus controller and fleet envtest integration suites, using isolated control planes (USE_EXISTING_CLUSTER=false). make lint (including go vet) also passed.
• Built and installed this Operator on local ARM64 KinD / Kubernetes 1.34.11. Reconciled a DatadogAgent with both process features enabled against genuine Agent 7.84.5 and the supported-image fixture.
• Supported fixture: one read-only /host/etc/passwd mount; image-local accounts preserved; Process Check and Discovery resolved the colliding UID 31001 to the host username. Root and nonroot (UID 100, GID 0) status/IPC passed. Scheduled Process Check payloads independently confirmed the host username in a non-forwarding local fake intake.
• A per-container experimental override to 7.84.5 correctly restored the legacy mount despite the newer component image. Removing it restored /host/etc/passwd; runtime checks passed again.

Remaining limits

• The locally tagged 7.86.0 fixture contains core/process binaries built from Agent commit 8113ee2796ec, reporting 7.86.0-devel. This is not verification of an official 7.86.0 release image.
• Runtime checks covered core-Agent process collection. Sidecar/provider/security combinations remain unit coverage; Gohai is separate follow-up work.
• Autopilot stays guarded pending an updated Google-approved/published allowlist and admission validation.

[datadog-datadog-prod-us1-2]

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 56.00% (+0.79%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: fd2e024 | Docs | View more details | Give us feedback!}