Add docker_otel_input package

.github/CODEOWNERS

@@ -205,6 +205,7 @@
 /packages/dga @elastic/sec-applied-ml
 /packages/digital_guardian @elastic/security-service-integrations
 /packages/docker @elastic/obs-ds-hosted-services
+/packages/docker_input_otel @elastic/ecosystem
 /packages/docker_otel @elastic/obs-ds-hosted-services
 /packages/elastic_agent @elastic/elastic-agent
 /packages/elastic_connectors @elastic/search-extract-and-transform

packages/docker_input_otel/LICENSE.txt

@@ -0,0 +1,93 @@
+Elastic License 2.0
+
+URL: https://www.elastic.co/licensing/elastic-license
+
+## Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+## Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject to
+the limitations and conditions below.
+
+## Limitations
+
+You may not provide the software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set of
+the features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the software, and you may not remove or obscure any functionality in the
+software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other notices
+of the licensor in the software. Any use of the licensor's trademarks is subject
+to applicable law.
+
+## Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software. If you or your company make any written claim that the software
+infringes or contributes to infringement of any patent, your patent license for
+the software granted under these terms ends immediately. If your company makes
+such a claim, your patent license ends immediately for work on behalf of your
+company.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you
+also gets a copy of these terms.
+
+If you modify the software, you must include in any modified copies of the
+software prominent notices stating that you have modified the software.
+
+## No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+## Termination
+
+If you use the software in violation of these terms, such use is not licensed,
+and your licenses will automatically terminate. If the licensor provides you
+with a notice of your violation, and you cease all violation of this license no
+later than 30 days after you receive that notice, your licenses will be
+reinstated retroactively. However, if you violate these terms after such
+reinstatement, any additional violation of these terms will cause your licenses
+to terminate automatically and permanently.
+
+## No Liability
+
+*As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.*
+
+## Definitions
+
+The **licensor** is the entity offering these terms, and the **software** is the
+software the licensor makes available under these terms, including any portion
+of it.
+
+**you** refers to the individual or entity agreeing to these terms.
+
+**your company** is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that
+organization. **control** means ownership of substantially all the assets of an
+entity, or the power to direct its management and policies by vote, contract, or
+otherwise. Control can be direct or indirect.
+
+**your licenses** are all the licenses granted to you for the software under
+these terms.
+
+**use** means anything you do with the software requiring one of your licenses.
+
+**trademark** means trademarks, service marks, and similar rights.

packages/docker_input_otel/_dev/build/docs/README.md

@@ -0,0 +1,83 @@
+# Docker OpenTelemetry Input Package
+
+## Overview
+
+The Docker OpenTelemetry Input Package for Elastic enables collection of telemetry data from Docker containers through OpenTelemetry protocols using the [dockerstats receiver](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/dockerstatsreceiver). It provides comprehensive metrics about container resource usage including CPU, memory, network, and block I/O statistics.
+
+### How it works
+
+This package receives telemetry data from the Docker daemon by configuring the Docker endpoint in the Input Package, which then gets applied to the `docker_stats` receiver present in the EDOT collector, which then forwards the data to Elastic Agent. The Elastic Agent processes and enriches the data before sending it to Elasticsearch for indexing and analysis. Once the data arrives into Elasticsearch, its corresponding [Docker OpenTelemetry Assets Package](https://www.elastic.co/docs/reference/integrations/docker_otel) gets auto installed and the dashboards light up.
+
+## Requirements
+
+- Access to the Docker daemon socket (default: `unix:///var/run/docker.sock` on Linux and `npipe:////./pipe/docker_engine` on Windows)
+- Docker API version greater than or equal to the one defined in [Docker Stats Receiver Repo](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/dockerstatsreceiver). Also, the API version must be supported by the Docker Engine being monitored.
+
+## Compatibility
+
+This integration uses the OpenTelemetry dockerstats receiver which is currently in **alpha** stability. The configuration and metrics may change between versions.
+
+## Setup
+
+For step-by-step instructions on how to set up an integration, see the {{ url "getting-started-observability" "Getting started" }} guide.
+
+## Configuration
+
+The following configuration options are available:
+
+### Docker Endpoint
+The endpoint of the Docker daemon. If not specified, the receiver uses `unix:///var/run/docker.sock` on Linux.
+For remote Docker hosts, you can use TCP endpoints like `tcp://docker-host:2375`.
+
+### Excluded Images
+A list of container image names to exclude from metrics collection. Supports wildcards.
+Example:
+```yaml
+- "nginx:*"
+- "redis:latest"
+```
+
+### API Version
+The Docker API version to use. Default is `"1.44"`.
+For Docker Engine v29, API version `"1.44"` or higher must be used.
+
+### Initial Delay
+Defines how long this receiver waits before starting. Default is `1s`.
+
+### Container Labels to Metric Labels
+Map container labels to metric resource attributes. This allows you to add custom dimensions to your metrics based on container labels.
+Example:
+```yaml
+my.container.label: my_metric_label
+app.version: version
+```
+
+### Environment Variables to Metric Labels
+Map container environment variables to metric resource attributes.
+Example:
+```yaml
+MY_ENV_VAR: my_metric_label
+APP_VERSION: version
+```
+
+
+### Metrics
+
+For a complete list of all available metrics, including their types, descriptions, and default enabled status, refer to the [Docker Stats Receiver documentation](https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/receiver/dockerstatsreceiver/documentation.md) in the upstream OpenTelemetry Collector repository.
+
+The `metrics` configuration allows you to enable optional metrics or disable default metrics.
+
+For example, to enable per-CPU usage metrics (which are disabled by default):
+
+```yaml
+metrics:
+  container.cpu.usage.percpu:
+    enabled: true
+```
+
+
+## Additional Resources
+
+- [OpenTelemetry dockerstats receiver documentation](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/dockerstatsreceiver)
+- [Docker Stats API documentation](https://docs.docker.com/engine/api/v1.43/#tag/Container/operation/ContainerStats)
+- [Elastic Observability documentation](https://www.elastic.co/guide/en/observability/current/index.html)

packages/docker_input_otel/_dev/deploy/docker/docker-compose.yml

@@ -0,0 +1,45 @@
+services:
+  dockerd:
+    image: docker:24-dind
+    privileged: true
+    command: ["--tls=false", "--host=tcp://0.0.0.0:2375", "--host=unix:///var/run/docker.sock"]
+    environment:
+      DOCKER_TLS_CERTDIR: ""
+    ports:
+      - 2375
+    healthcheck:
+      test: ["CMD", "docker", "info"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+
+  workload:
+    image: docker:24-cli
+    environment:
+      - DOCKER_HOST=tcp://dockerd:2375
+    depends_on:
+      dockerd:
+        condition: service_healthy
+    entrypoint: ["/bin/sh", "-c"]
+    command:
+      - |
+        # Redirect all output (including stderr) to a log file
+        exec > /var/log/workload.log 2>&1
+        echo "Check binaries..."
+        which docker && which sh
+        echo "Waiting for Docker daemon at $DOCKER_HOST..."
+        # Simply wait for the daemon
+        while ! docker info >/dev/null 2>&1; do
+          echo "Waiting for Docker daemon connection..."
+          sleep 5
+        done
+        echo "Docker daemon found!"
+        docker info
+        # Start a container that generates some stats (simulating load)
+        echo "Starting stressful container..."
+        # Identify if container already exists to avoid conflict on restart
+        docker rm -f stressful || true
+        docker run -d --name stressful alpine sh -c "while true; do :; done"
+        echo "Stressful container running."
+        # Keep this container alive
+        tail -f /var/log/workload.log

packages/docker_input_otel/_dev/test/policy/test-default.expected

@@ -0,0 +1,53 @@
+connectors:
+    forward: {}
+exporters:
+    elasticsearch/componentid-0: {}
+inputs: []
+output_permissions:
+    default:
+        _elastic_agent_checks:
+            cluster:
+                - monitor
+        _elastic_agent_monitoring:
+            indices: []
+        uuid-for-permissions-on-related-indices:
+            indices:
+                - names:
+                    - metrics-*-*
+                  privileges:
+                    - auto_configure
+                    - create_doc
+processors:
+    resourcedetection/componentid-0:
+        detectors:
+            - system
+        override: false
+        timeout: 2s
+    transform/componentid-1:
+        metric_statements:
+            - context: datapoint
+              statements:
+                - set(attributes["data_stream.type"], "metrics")
+                - set(attributes["data_stream.dataset"], "docker_input_otel.dockerstatsreceiver")
+                - set(attributes["data_stream.namespace"], "ep")
+receivers:
+    docker_stats/componentid-0:
+        api_version: "1.44"
+        collection_interval: 60s
+        initial_delay: "1s"
+secret_references: []
+service:
+    pipelines:
+        metrics:
+            exporters:
+                - elasticsearch/componentid-0
+            receivers:
+                - forward
+        metrics/componentid-0:
+            exporters:
+                - forward
+            processors:
+                - resourcedetection/componentid-0
+                - transform/componentid-1
+            receivers:
+                - docker_stats/componentid-0

packages/docker_input_otel/_dev/test/policy/test-default.yml

@@ -0,0 +1 @@
+vars: {}

packages/docker_input_otel/_dev/test/policy/test-docker-stats.expected

@@ -0,0 +1,66 @@
+connectors:
+    forward: {}
+exporters:
+    elasticsearch/componentid-0: {}
+inputs: []
+output_permissions:
+    default:
+        _elastic_agent_checks:
+            cluster:
+                - monitor
+        _elastic_agent_monitoring:
+            indices: []
+        uuid-for-permissions-on-related-indices:
+            indices:
+                - names:
+                    - metrics-*-*
+                  privileges:
+                    - auto_configure
+                    - create_doc
+processors:
+    resourcedetection/componentid-0:
+        detectors:
+            - system
+        override: false
+        timeout: 2s
+    transform/componentid-1:
+        metric_statements:
+            - context: datapoint
+              statements:
+                - set(attributes["data_stream.type"], "metrics")
+                - set(attributes["data_stream.dataset"], "docker_input_otel.dockerstatsreceiver")
+                - set(attributes["data_stream.namespace"], "ep")
+receivers:
+    docker_stats/componentid-0:
+        api_version: "1.44"
+        collection_interval: 10s
+        container_labels_to_metric_labels:
+            com.docker.compose.service: compose_service
+            com.docker.compose.project: compose_project
+        endpoint: unix:///var/run/docker.sock
+        env_vars_to_metric_labels: 
+            ENVIRONMENT: environment
+        excluded_images:
+            - nginx:latest
+            - redis:alpine
+        initial_delay: "5s"
+        metrics:
+            container.cpu.usage.percpu:
+                enabled: true
+        timeout: 5s
+secret_references: []
+service:
+    pipelines:
+        metrics:
+            exporters:
+                - elasticsearch/componentid-0
+            receivers:
+                - forward
+        metrics/componentid-0:
+            exporters:
+                - forward
+            processors:
+                - resourcedetection/componentid-0
+                - transform/componentid-1
+            receivers:
+                - docker_stats/componentid-0

packages/docker_input_otel/_dev/test/policy/test-docker-stats.yml

@@ -0,0 +1,17 @@
+vars:
+  collection_interval: "10s"
+  initial_delay: "5s"
+  endpoint: "unix:///var/run/docker.sock"
+  excluded_images:
+    - "nginx:latest"
+    - "redis:alpine"
+  timeout: "5s"
+  api_version: "1.44"
+  metrics: |
+    container.cpu.usage.percpu:
+      enabled: true
+  container_labels_to_metric_labels: |
+    com.docker.compose.service: compose_service
+    com.docker.compose.project: compose_project
+  env_vars_to_metric_labels: |
+    ENVIRONMENT: environment

packages/docker_input_otel/_dev/test/system/test-default-config.yml

@@ -0,0 +1,6 @@
+service: dockerd
+vars:
+  collection_interval: 10s
+  endpoint: "tcp://{{Hostname}}:2375"
+  # Use a safe API version for the dind image
+  api_version: "1.41"