Add experimental filtered IoT Agent installer

[thieman]

Summary

Add an experimental install_script_agent7_iot.sh variant that installs the normal Agent 7 DEB with a reduced IoT filesystem profile instead of installing the separately packaged datadog-iot-agent artifact.

The generated script:

• installs the normal datadog-agent package;
• forces infrastructure_mode: iot;
• writes a persistent, ordered dpkg path-filter policy before package unpack;
• retains the main Agent, Agent Data Plane, rtloader shim, support views, SSL/support assets, and IoT core-check configurations;
• filters Python, packaged integrations, companion agents, system-probe/eBPF assets, JMX, ODBC, and security/compliance payloads;
• validates the final retained and excluded filesystem contract;
• writes a root-owned, versioned /etc/datadog-agent/install_profile marker only after package, configuration, layout, and service handling succeed;
• rolls back a transient filter if APT or package post-installation fails.

Existing generated installers remain byte-for-byte unchanged. The new script is generated as a CI artifact but is intentionally absent from the public deploy matrix while this remains a prototype.

Disk measurement

Same-version Agent 7.82.2 comparison on Ubuntu 22.04:

Layout	Installed logical bytes
Normal Agent	797,357,886
Filtered IoT profile	184,336,138
Saved	613,021,748 (76.88%)

A prior same-version allocated-block comparison measured a 77.81% reduction. These are experimental measurements rather than CI thresholds and vary with package version and filesystem.

Validation

• 76 main installer shunit tests pass.
• 19 filtered-IoT orchestration tests pass.
• Generated-script contract, Bash syntax, ShellCheck, and CI YAML parsing pass.
• Fresh real installs pass on Ubuntu 22.04 and Debian 12.
• Pinned Agent 7.82.2 install passes package/version, filter policy, configuration, marker, filesystem layout, checksum, and Agent CLI checks.
• Ordinary generated Agent 6, Agent 7, legacy, and Docker-injection scripts remain byte-identical.
• Controlled APT failures restore or remove the transient dpkg policy and do not publish a completed marker.

Prototype limitations

• Debian and Ubuntu only.
• Fresh installs only; existing Agent packages/configuration and ordinary APT upgrades are rejected/unsupported.
• RPM support is not included. A real Rocky 9 attempt showed that the Agent RPM %post requires the embedded installer before the final filtered state; reconciling that with RPM's recorded file state needs a separate design.
• The current Agent does not yet consume install_profile. A companion Agent change should require infrastructure_mode: iot and strict capability guards whenever profile: iot-filtered is present.
• Runtime daemon/payload behavior beyond the Agent CLI is follow-up validation against an Agent build containing the IoT runtime mode.

[datadog-official]

✨ Unblock PR with BitsAI

⚠️ Warnings

❌ Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 1 Pipeline job failed

Shellcheck | shellcheck — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

Multiple commands in test_iot_deb_orchestration.sh are unreachable due to improper function definitions as indicated by SC2317.

📋 Copy fix prompt

CI on my pull request is failing. Help me find and fix the root cause of each failing job below — they were flagged as caused by changes in this PR, so focus on the diff. For each job, explain the failure and propose a fix.

Before you start, set up the Datadog software-delivery tooling so you can
query the CI data yourself:

1. Check whether you already have the Datadog software-delivery MCP tools
   (e.g. a `search_datadog_ci_pipeline_events` tool) and the `unblock-pr` skill.
2. If either is missing, STOP and ask me for permission before installing
   anything. Do not install or run anything until I have said yes.
3. Only with my explicit approval, set up the Datadog software-delivery MCP
   server and skills by following:
     https://docs.datadoghq.com/getting_started/software_delivery_mcp_tools/
   then restart so the skill is picked up.
4. If I decline, skip all of the above and work from the context below alone.

Then run /unblock-pr — it will pull the CI data itself. The job context below is what we already know.

If /unblock-pr is not available — because I declined the setup above, or it did not install — work from the context below instead.

Datadog has already classified this failure as caused by changes in this PR.
Take that as given and work the fix:

1. Locate the change. Diff this branch against its base and find the change
   that produces this error. Explain the mechanism, don't just name a file:
     git fetch origin && git diff $(git merge-base origin/main HEAD)...HEAD
2. Reproduce it locally. Run the failing job's command or test before
   proposing anything.
3. Propose the smallest fix that addresses the root cause — not a workaround,
   not a broadened assertion, not a disabled or skipped test.
4. Re-run the same command to confirm, and say exactly what you ran.
5. If the failure turns out to be intermittent rather than deterministic, say
   so plainly instead of "fixing" it — that is a flaky test, and patching it
   hides the problem.

If the right move is to re-run the job rather than change code, use the job
link in the context below. For GitHub Actions: `gh run rerun <run-id> --failed`,
where the run ID is the number after `/runs/` in that URL (not the trailing
number, which is the job ID).

Branch: thieman/iot-filtered-install-script

Shellcheck | shellcheck
Commit: 80012a26c86ad71634ff457250fb8d3e885424d9
Error (code / build):
Multiple commands in test_iot_deb_orchestration.sh are unreachable due to improper function definitions as indicated by SC2317.
CI job: https://github.com/DataDog/agent-linux-install-script/actions/runs/32873294758/job/97885198089

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 80012a2 | Docs | View more details | Give us feedback!}