DataDog · darccio · Jul 24, 2026
@@ -32,12 +32,12 @@ updates:
   # Docker — updates base image digests (sha256 pins) to latest verified digests.
   - package-ecosystem: "docker"
     directories:
+      - "/.gitlab/benchmarks/micro/container"
       - "/contrib/azure/apim-callout/cmd/apim-callout"
       - "/contrib/envoyproxy/go-control-plane/cmd/serviceextensions"
       - "/contrib/haproxy/stream-processing-offload/cmd/spoa"
       - "/contrib/k8s.io/gateway-api/cmd/request-mirror"
       - "/internal/apps"
-      - "/internal/setup-smoke-test"
     schedule:
       interval: "weekly"
       day: "monday"
@@ -54,12 +54,87 @@ updates:
       - "dependencies"
     cooldown:
       default-days: 2
+
+  # Docker Compose (dev/local) — updates image digests in the local-development
+  # stacks. Version/tag upgrades are allowed here; maintainers curate them.
+  - package-ecosystem: "docker-compose"
+    directories:
+      - "/"
+      - "/internal/apps"
+      - "/internal/apps/staleidle-soak"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "Europe/Paris"
+    groups:
+      docker-compose-dev:
+        patterns:
+          - "*"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(deps)"
+    labels:
+      - "dependencies"
+    cooldown:
+      default-days: 2
+
+  # Docker Compose (test images) — CI service containers and the Testcontainers
+  # image catalog intentionally pin specific (often old) versions to cover
+  # compatibility matrices. Only digests are refreshed; version/tag bumps are
+  # ignored so the test matrix doesn't silently drift.
+  - package-ecosystem: "docker-compose"
+    directories:
+      - "/.github/testservices"
+      - "/instrumentation/testutils/containers/images"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "Europe/Paris"
+    groups:
+      docker-compose-test-images:
+        patterns:
+          - "*"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(deps)"
+    labels:
+      - "dependencies"
+    cooldown:
+      default-days: 2
     ignore:
-      # amazonlinux:2 is pinned to a specific AL2 (glibc 2.26) digest and must
-      # never be upgraded to AL2023 (glibc 2.34).  Omitting `versions` blocks
-      # ALL Dependabot updates for this image — both digest refreshes of :2 and
-      # any tag-change PR proposing :2023 — because a version-scoped rule like
-      # "= 2" would still permit a :2 → :2023 tag upgrade.  The :2023 stage in
-      # the same Dockerfile is unpinned and always pulls the current :2023 at
-      # build time, so losing automated digest updates there is acceptable.
-      - dependency-name: "amazonlinux"
+      - dependency-name: "ghcr.io/datadog/dd-apm-test-agent/ddapm-test-agent"
+        update-types: &ignore-version-bumps ["version-update:semver-major", "version-update:semver-minor", "version-update:semver-patch"]
+      - dependency-name: "cassandra"
+        update-types: *ignore-version-bumps
+      - dependency-name: "cimg/mysql"
+        update-types: *ignore-version-bumps
+      - dependency-name: "cimg/postgres"
+        update-types: *ignore-version-bumps
+      - dependency-name: "mcr.microsoft.com/mssql/server"
+        update-types: *ignore-version-bumps
+      - dependency-name: "consul"
+        update-types: *ignore-version-bumps
+      - dependency-name: "redis"
+        update-types: *ignore-version-bumps
+      - dependency-name: "valkey/valkey"
+        update-types: *ignore-version-bumps
+      - dependency-name: "elasticsearch"
+        update-types: *ignore-version-bumps
+      - dependency-name: "docker.elastic.co/elasticsearch/elasticsearch"
+        update-types: *ignore-version-bumps
+      - dependency-name: "mongo"
+        update-types: *ignore-version-bumps
+      - dependency-name: "memcached"
+        update-types: *ignore-version-bumps
+      - dependency-name: "confluentinc/confluent-local"
+        update-types: *ignore-version-bumps
+      - dependency-name: "localstack/localstack"
+        update-types: *ignore-version-bumps
+      - dependency-name: "docker.io/postgres"
+        update-types: *ignore-version-bumps
+      - dependency-name: "vault"
+        update-types: *ignore-version-bumps
+      - dependency-name: "aerospike"
+        update-types: *ignore-version-bumps
@@ -0,0 +1,189 @@
+# CI service containers for .github/workflows/unit-integration-tests.yml.
+#
+# These used to be defined natively via the workflow's `services:` key.
+# They live here instead so the `docker-compose` Dependabot ecosystem can
+# keep every image digest fresh — GitHub Actions `services:`/`container:`
+# image references are not tracked by Dependabot (dependabot-core#5819).
+#
+# `test-contrib-matrix` brings up the full stack; `test-core` brings up only
+# `datadog-agent`. Several images are intentionally pinned to old versions to
+# cover compatibility matrices (cassandra, redis, consul, elasticsearch,
+# memcached, mysql/postgres via cimg) — see the `ignore` rules in
+# .github/dependabot.yml, which restrict Dependabot to digest-only refreshes
+# for these.
+
+services:
+  datadog-agent:
+    image: registry.datadoghq.com/agent:latest@sha256:44bfe2c475d9467e78e73e4327148d7e3902da5a48cbb1b0f6b84b01283e89d5
+    environment:
+      DD_HOSTNAME: "github-actions-worker"
+      DD_APM_ENABLED: "true"
+      DD_BIND_HOST: "0.0.0.0"
+      DD_API_KEY: "invalid_key_but_this_is_fine"
+      DD_TEST_AGENT_HOST: "localhost"
+      DD_TEST_AGENT_PORT: "9126"
+    healthcheck:
+      test: ["CMD-SHELL", "bash -c '</dev/tcp/127.0.0.1/8126'"]
+    ports:
+      - "8125:8125/udp"
+      - "8126:8126"
+
+  testagent:
+    image: ghcr.io/datadog/dd-apm-test-agent/ddapm-test-agent:v1.61.1@sha256:0b428281c1ba33f4af9f81efe79330a7577c8810609a7bcd1cecf8c7de82abec
+    environment:
+      LOG_LEVEL: DEBUG
+      TRACE_LANGUAGE: golang
+      ENABLED_CHECKS: trace_stall,trace_count_header,trace_peer_service,trace_dd_service
+      PORT: "9126"
+      DD_SUPPRESS_TRACE_PARSE_ERRORS: "true"
+      DD_POOL_TRACE_CHECK_FAILURES: "true"
+      DD_DISABLE_ERROR_RESPONSES: "true"
+    healthcheck:
+      test: ["CMD-SHELL", "bash -c '</dev/tcp/127.0.0.1/9126'"]
+    ports:
+      - "9126:9126"
+
+  cassandra:
+    image: cassandra:3.11@sha256:9a14b18eb658851e8939cfdeca8fcbca389f5f0d00fca4a995d80b6accfcbd96
+    environment:
+      JVM_OPTS: "-Xms750m -Xmx750m"
+      CASSANDRA_CLUSTER_NAME: "dd-trace-go-test-cluster"
+      CASSANDRA_DC: "dd-trace-go-test-datacenter"
+      CASSANDRA_ENDPOINT_SNITCH: "GossipingPropertyFileSnitch"
+    ports:
+      - "9042:9042"
+
+  mysql:
+    image: cimg/mysql:8.0@sha256:3f14424dee82da7c784350ac9b7d292edcc2eac921d24fd0099dd4c45edd1fcd
+    environment:
+      MYSQL_ROOT_PASSWORD: admin
+      MYSQL_PASSWORD: test
+      MYSQL_USER: test
+      MYSQL_DATABASE: test
+    ports:
+      - "3306:3306"
+
+  postgres:
+    image: cimg/postgres:16.4@sha256:2e4f1a965bdd9ba77aa6a0a7b93968c07576ba2a8a7cf86d5eb7b31483db1378
+    environment:
+      POSTGRES_PASSWORD: postgres
+      POSTGRES_USER: postgres
+      POSTGRES_DB: postgres
+    ports:
+      - "5432:5432"
+
+  mssql:
+    image: mcr.microsoft.com/mssql/server:2019-latest@sha256:fdee98d3f631673cd8fb9be6d29d7883d7111be9fc0246103dc0cfbbffdabd5a
+    environment:
+      SA_PASSWORD: myPassw0rd
+      ACCEPT_EULA: "Y"
+    ports:
+      - "1433:1433"
+
+  consul:
+    image: consul:1.6.0@sha256:63e1a07260418ba05be08b6dc53f4a3bb95aa231cd53922f7b5b5ee5fd77ef3f
+    ports:
+      - "8500:8500"
+
+  redis:
+    image: redis:3.2@sha256:7b0a40301bc1567205e6461c5bf94c38e1e1ad0169709e49132cafc47f6b51f3
+    ports:
+      - "6379:6379"
+
+  valkey:
+    image: valkey/valkey:8@sha256:1f84517eca8e0dd9585ed57c572796f32839e1b0e7ce07ad28e6bce098468371
+    environment:
+      VALKEY_EXTRA_FLAGS: "--port 6380 --requirepass password-for-default"
+    ports:
+      - "6380:6380"
+
+  elasticsearch2:
+    image: elasticsearch:2@sha256:41ed3a1a16b63de740767944d5405843db00e55058626c22838f23b413aa4a39
+    environment:
+      ES_JAVA_OPTS: "-Xms750m -Xmx750m" # https://github.com/10up/wp-local-docker/issues/6
+    ports:
+      - "9200:9200"
+
+  elasticsearch5:
+    image: elasticsearch:5@sha256:d0e119779df7ddf9d476102691d9d0b8783c13434e00d77f01327019c1297839
+    environment:
+      ES_JAVA_OPTS: "-Xms750m -Xmx750m" # https://github.com/10up/wp-local-docker/issues/6
+    ports:
+      - "9201:9200"
+
+  elasticsearch6:
+    image: elasticsearch:6.8.13@sha256:8d4e29332dc159e7c256efa131453bd62a35b6e90f32aa9ab3f76632e29372c3
+    environment:
+      ES_JAVA_OPTS: "-Xms750m -Xmx750m" # https://github.com/10up/wp-local-docker/issues/6
+    ports:
+      - "9202:9200"
+
+  elasticsearch7:
+    image: elasticsearch:7.14.1@sha256:80bc3fe9d3ab2da410abadc2245eb5833c7ef7bb58ce2d89b24dabfb8c3d5233
+    environment:
+      ES_JAVA_OPTS: "-Xms750m -Xmx750m" # https://github.com/10up/wp-local-docker/issues/6
+      discovery.type: single-node
+    ports:
+      - "9203:9200"
+
+  elasticsearch8:
+    image: elasticsearch:8.6.2@sha256:93bc71907ca0e6e3b4f181e0dc850b90bb6cb2686c2778def0b8542398983c28
+    environment:
+      ES_JAVA_OPTS: "-Xms750m -Xmx750m" # https://github.com/10up/wp-local-docker/issues/6
+      discovery.type: single-node
+      xpack.security.enabled: "false"
+    ports:
+      - "9204:9200"
+
+  mongo3:
+    image: mongo:3@sha256:146c1fd999a660e697aac40bc6da842b005c7868232eb0b7d8996c8f3545b05d
+    ports:
+      - "27018:27017"
+
+  mongo:
+    image: mongo:8@sha256:7abfba0d07c9330373f8173981ea4d09cd8a82cdf0e86ccaf7008848d1d24f62
+    ports:
+      - "27017:27017"
+
+  memcached:
+    image: memcached:1.5.9@sha256:dc68a9ffa03b81dde70ce536bc96655e3d23503916b0d931078391d752bb4e27
+    ports:
+      - "11211:11211"
+
+  # Intentionally kept in lockstep with the same-named entry in
+  # instrumentation/testutils/containers/images/docker-compose.yaml.
+  # Dependabot scans both files independently, so a digest bump to one won't
+  # automatically update the other — keep them in sync manually.
+  kafka:
+    image: confluentinc/confluent-local:7.5.0@sha256:8e391de42cfcd3498e7317dcf159790f1f1cc3f3ffce900b30d7da23888687fd
+    container_name: kafka
+    environment:
+      KAFKA_LISTENERS: "PLAINTEXT://0.0.0.0:9093,BROKER://0.0.0.0:9092,CONTROLLER://0.0.0.0:9094"
+      KAFKA_ADVERTISED_LISTENERS: "PLAINTEXT://localhost:9093,BROKER://localhost:9092"
+      KAFKA_REST_BOOTSTRAP_SERVERS: "PLAINTEXT://0.0.0.0:9093,BROKER://0.0.0.0:9092"
+      KAFKA_CONTROLLER_QUORUM_VOTERS: "1@localhost:9094"
+      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: "BROKER:PLAINTEXT,PLAINTEXT:PLAINTEXT,CONTROLLER:PLAINTEXT"
+      KAFKA_INTER_BROKER_LISTENER_NAME: "BROKER"
+      KAFKA_BROKER_ID: "1"
+      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: "1"
+      KAFKA_OFFSETS_TOPIC_NUM_PARTITIONS: "1"
+      KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: "1"
+      KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: "1"
+      KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS: "0"
+      KAFKA_NODE_ID: "1"
+      KAFKA_PROCESS_ROLES: "broker,controller"
+      KAFKA_CONTROLLER_LISTENER_NAMES: "CONTROLLER"
+    ports:
+      - "9092:9092"
+      - "9093:9093"
+
+  localstack:
+    image: localstack/localstack:4.14.0@sha256:3ebc37595918b8accb852f8048fef2aff047d465167edd655528065b07bc364a
+    ports:
+      - "4566:4566"
+
+  # See the "kept in lockstep" note on kafka above — applies here too.
+  aerospike:
+    image: aerospike:ce-7.2.0.6@sha256:79c30951edab8878b14b650f32db416106a21d458be994344e488756fe8b651f
+    ports:
+      - "3000:3000"
@@ -216,19 +216,14 @@ jobs:
         working-directory: ${{ github.workspace }}/dd-trace-go/internal/orchestrion/_integration
 
       # Pull docker images ahead of time so the pulls of large images don't have to fit within the
-      # test timeout.
+      # test timeout. Images (and their pinned digests) come from the shared Testcontainers catalog,
+      # which Dependabot keeps up to date; dynamodb/postgres/vault are the largest images used by the
+      # suite, hence worth pre-warming.
       - name: Pull container images
         # Docker is only supported on Linux runners at the moment
         if: runner.os == 'Linux'
         run: |-
-          # AWS DynamoDB Local is used to have a pretend AWS API endpoint
-          docker pull amazon/dynamodb-local:latest
-
-          # PostgreSQL service
-          docker pull docker.io/postgres:16-alpine
-
-          # Vault service
-          docker pull vault:1.7.3
+          docker compose -f "${{ github.workspace }}/dd-trace-go/instrumentation/testutils/containers/images/docker-compose.yaml" pull dynamodb postgres vault
 
       # Enable VM overcommit memory, which is essential to ensure smooth operations of the Redis
       # servers. This VM setting is not namespaced, so changing it on the host also affects all