[Bug]: ddappsec gets installed without the cli option provided

[TomKeur]

Bug report

When I'm installing the PHP Extension in a Docker container, the ddappsec php extensions gets installed, but I do not want it.

I'm using the following Docker image: php:8.2.13-fpm-bookworm

I'm installing Datadog via the PHP installer (inside a Dockerfile)

RUN set -xe \
    # Install Datadog APM
    && cd /tmp && curl -LO https://github.com/DataDog/dd-trace-php/releases/latest/download/datadog-setup.php \
    && php /tmp/datadog-setup.php --php-bin=/usr/local/bin/php --php-bin=/usr/local/sbin/php-fpm \
    && rm -rf /tmp/*

The CLI commands have been found at: https://docs.datadoghq.com/tracing/trace_collection/dd_libraries/php/

PHP version

8.2.13

Tracer or profiler version

0.94.1

Installed extensions

[PHP Modules]
amqp
apcu
bcmath
Core
ctype
curl
date
ddappsec
ddtrace
dom
fileinfo
filter
ftp
gettext
gmp
hash
iconv
intl
json
libxml
mbstring
mysqlnd
openssl
pcntl
pcre
PDO
pdo_mysql
pdo_pgsql
pdo_sqlite
pdo_sqlsrv
Phar
posix
random
readline
redis
Reflection
session
SimpleXML
sockets
sodium
SPL
sqlite3
sqlsrv
standard
sysvmsg
sysvsem
sysvshm
tokenizer
xml
xmlreader
xmlwriter
xsl
Zend OPcache
zip
zlib
[Zend Modules]
Zend OPcache
ddappsec
ddtrace

Output of phpinfo()

No response

Upgrading from

No response

[Anilm3]

We always install the appsec extension when using this particular installer in order to allow customers to enable application security automatically through the dashboard without having to go through a separate installation process. When using --enable-appsec, we also set datadog.appsec.enabled to On so that the extension isn't only loaded but also active.

If you don't wish to load the appsec extension, my suggestion would be to comment out extension = ddappsec.so from your 98-ddtrace.ini configuration file. Although we'll looking into adding more installer options to allow you to customise your installation.

[bertoost]

I agree with @TomKeur and it should be possible to disable installing the appsec extension. Installing it could be the default, with keeping the --enable-appsec. But a --disable-appsec should be an option to avoid installing the extension at all