# Datadog

> Coming soon — bake the Datadog Agent into the golden image from the software catalog, with the API key supplied as an encrypted secret that never reaches the image filesystem.

- Software catalog package
- Catalog section: Monitoring

The **Datadog Agent** is a package in Primcoat's software catalog, under Monitoring. You select it on an image definition, supply its configuration, and Primcoat installs it during the provision stage of every build of that image.

## The point is that instances are monitored from first boot

The usual alternative is to install the agent after the instance is running — from cloud-init, a configuration-management run, or a bootstrap script. That works, and it leaves a gap: the window between an instance starting and the agent reporting. On a fleet that autoscales, that window is a meaningful fraction of the lifetime of a short-lived instance, and the instances you most want telemetry from — the ones that came up under load and died quickly — are exactly the ones that fall into it.

Baking the agent into the image closes the gap. The instance boots monitored.

## The API key is a secret, and it is treated as one

The Datadog API key goes into the image definition's variable store as an **encrypted secret**. Primcoat encrypts it at rest, injects it as an environment variable during the build, and never writes it to the image filesystem — and a post-build scan verifies that no secret value appears in the finished image.

This is not a formality. An image is copied to every host you run and often shared across accounts, so a key baked into one is a key handed to your whole fleet.

## What the catalog package carries

Like every catalog package, the Datadog Agent ships with install logic that Primcoat maintains and versions, a compatibility matrix across supported operating systems, a post-install validation test that runs inside the build, a configuration input schema describing what you must supply, and a record of known conflicts with other packages.

The practical consequence is that an agent version bump is a Primcoat concern rather than a playbook you maintain — and if the agent fails to install or fails its validation, the build fails. It does not publish an image that is silently missing its monitoring and let you find out from the absence of data.

## What you configure

The API key, the Datadog site your organization is on, and any tags you want baked in. Instance-specific values are better supplied at deploy time through cloud-init than frozen into the image, which is the general rule for anything that differs per host rather than per image.

The agent appears in the [SBOM](https://primcoat.app/glossary/sbom) as a component like any other, and the [CVE](https://primcoat.app/glossary/cve) scan covers it.

---

Source: https://primcoat.app/integrations/datadog
Primcoat — a managed VM image factory. https://primcoat.app