[AGENTRUN-1124] Replace gopsutil fork with upstream where possible (#47700)

### What does this PR do?
Replace the gopsutil fork with upstream where possible, and isolate the remaining uses.
See below for the impact of some of the changes.

The fork is now only used on Darwin for live process collection, I'll look into that in a follow-up.

### Motivation
Remove the fork as much as possible.

### Describe how you validated your changes
CI

### Additional Notes



Changes with behavioral impact:

- `host.PlatformInformation()` on Darwin: `PlatformFamily` changes from always "darwin" to either "Standalone Workstation" or "Server".
- `host.PlatformInformation()` on Windows: version field previously returned "10.0.19041 Build 19041" (`WMI`). Now calls `KernelVersion()` instead, returning "10.0.19041.x Build 19041.x" (`RtlGetVersion`, same format, adds UBR patch revision).
- `host.BootTime()` on Linux (test only): upstream uses `/proc/uptime` float arithmetic in Docker/LXC containers instead of the integer btime from `/proc/stat`, so the test assertion is relaxed to within 1 second.

No behavior changes:

- `host.BootTime()` on Windows: different underlying API (`GetTickCount64` vs `WMI`), same result.
- `host.KernelVersion()` on Linux: `uname()` syscall vs `/proc/sys/kernel/osrelease`, same value.
- `host.PlatformInformation()` on Linux: upstream v4 respects `HOST_ETC` identically to the fork, same results for all supported distros.
- `host.Info()` on Linux: same fields and values, stale comment about missing containerized environment support removed.
- `process.MemoryMaps()`: struct literal replaced with `NewProcess()`, same behavior.


Co-authored-by: pierre.gimalac <pierre.gimalac@datadoghq.com>

Author: pgimalac

comp/logonduration/impl/impl_windows.go

@@ -14,7 +14,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/DataDog/gopsutil/host"
+	"github.com/shirou/gopsutil/v4/host"
 
 	configcomp "github.com/DataDog/datadog-agent/comp/core/config"
 	hostname "github.com/DataDog/datadog-agent/comp/core/hostname/hostnameinterface"

pkg/network/tracer/offsetguess/tracer.go

@@ -23,7 +23,7 @@ import (
 	"time"
 
 	manager "github.com/DataDog/ebpf-manager"
-	"github.com/DataDog/gopsutil/host"
+	"github.com/shirou/gopsutil/v4/host"
 	"golang.org/x/sys/unix"
 
 	ddebpf "github.com/DataDog/datadog-agent/pkg/ebpf"

pkg/process/checks/system_info.go

@@ -8,9 +8,8 @@
 package checks
 
 import (
-	// waiting for upstream fix to platform collection in containerized environments
-	"github.com/DataDog/gopsutil/host"
 	"github.com/shirou/gopsutil/v4/cpu"
+	"github.com/shirou/gopsutil/v4/host"
 	"github.com/shirou/gopsutil/v4/mem"
 
 	model "github.com/DataDog/agent-payload/v5/process"

pkg/process/checks/system_info_darwin.go

@@ -11,10 +11,8 @@ import (
 	"errors"
 
 	model "github.com/DataDog/agent-payload/v5/process"
-	// difference between methods for collecting macOS platform, kernel version
-	// between shirou and Datadog psutil
-	"github.com/DataDog/gopsutil/host"
 	"github.com/shirou/gopsutil/v4/cpu"
+	"github.com/shirou/gopsutil/v4/host"
 	"github.com/shirou/gopsutil/v4/mem"
 	"golang.org/x/sys/unix"
 )

pkg/process/procutil/process_linux_test.go

@@ -20,8 +20,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	// relying upon fork BootTime behavior
-	"github.com/DataDog/gopsutil/host"
+	"github.com/shirou/gopsutil/v4/host"
 	// using process.AllProcesses()
 	"github.com/DataDog/gopsutil/process"
 )
@@ -976,7 +975,9 @@ func TestBootTimeLocalFS(t *testing.T) {
 	defer probe.Close()
 	expectT, err := host.BootTime()
 	assert.NoError(t, err)
-	assert.Equal(t, expectT, probe.bootTime.Load())
+	// upstream BootTime may use /proc/uptime (float arithmetic) in container environments
+	// rather than the integer btime from /proc/stat, so allow 1 second of difference
+	assert.InDelta(t, float64(expectT), float64(probe.bootTime.Load()), 1.0)
 }
 
 func TestBootTimeRefresh(t *testing.T) {

pkg/process/procutil/process_model.go

@@ -11,13 +11,8 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/DataDog/gopsutil/cpu"
-
 	"github.com/DataDog/datadog-agent/pkg/discovery/tracermetadata"
 	"github.com/DataDog/datadog-agent/pkg/languagedetection/languagemodels"
-
-	// using process.FilledProcess
-	"github.com/DataDog/gopsutil/process"
 )
 
 // InjectionState represents the APM injection state of a process
@@ -325,112 +320,3 @@ type NumCtxSwitchesStat struct {
 	Voluntary   int64
 	Involuntary int64
 }
-
-// ConvertAllFilledProcesses takes a group of FilledProcess objects and convert them into Process
-func ConvertAllFilledProcesses(processes map[int32]*process.FilledProcess) map[int32]*Process {
-	result := make(map[int32]*Process, len(processes))
-	for pid, p := range processes {
-		result[pid] = ConvertFromFilledProcess(p)
-	}
-	return result
-}
-
-// ConvertAllFilledProcessesToStats takes a group of FilledProcess objects and convert them into Stats
-func ConvertAllFilledProcessesToStats(processes map[int32]*process.FilledProcess) map[int32]*Stats {
-	stats := make(map[int32]*Stats, len(processes))
-	for pid, p := range processes {
-		stats[pid] = ConvertFilledProcessesToStats(p)
-	}
-	return stats
-}
-
-// ConvertFilledProcessesToStats takes a group of FilledProcess objects and convert them into Stats
-func ConvertFilledProcessesToStats(p *process.FilledProcess) *Stats {
-	return &Stats{
-		CreateTime:  p.CreateTime,
-		Status:      p.Status,
-		Nice:        p.Nice,
-		OpenFdCount: p.OpenFdCount,
-		NumThreads:  p.NumThreads,
-		CPUTime:     ConvertFromCPUStat(p.CpuTime),
-		MemInfo:     ConvertFromMemInfo(p.MemInfo),
-		MemInfoEx:   ConvertFromMemInfoEx(p.MemInfoEx),
-		IOStat:      ConvertFromIOStats(p.IOStat),
-		CtxSwitches: ConvertFromCtxSwitches(p.CtxSwitches),
-	}
-}
-
-// ConvertFromFilledProcess takes a FilledProcess object and convert it into Process
-func ConvertFromFilledProcess(p *process.FilledProcess) *Process {
-	return &Process{
-		Pid:      p.Pid,
-		Ppid:     p.Ppid,
-		NsPid:    p.NsPid,
-		Name:     p.Name,
-		Cwd:      p.Cwd,
-		Exe:      p.Exe,
-		Cmdline:  p.Cmdline,
-		Username: p.Username,
-		Uids:     p.Uids,
-		Gids:     p.Gids,
-		Stats:    ConvertFilledProcessesToStats(p),
-	}
-}
-
-// ConvertFromCPUStat converts gopsutil TimesStat object to CPUTimesStat in procutil
-func ConvertFromCPUStat(s cpu.TimesStat) *CPUTimesStat {
-	return &CPUTimesStat{
-		User:      s.User,
-		System:    s.System,
-		Idle:      s.Idle,
-		Nice:      s.Nice,
-		Iowait:    s.Iowait,
-		Irq:       s.Irq,
-		Softirq:   s.Softirq,
-		Steal:     s.Steal,
-		Guest:     s.Guest,
-		GuestNice: s.GuestNice,
-		Stolen:    s.Stolen,
-		Timestamp: s.Timestamp,
-	}
-}
-
-// ConvertFromMemInfo converts gopsutil MemoryInfoStat object to MemoryInfoStat in procutil
-func ConvertFromMemInfo(s *process.MemoryInfoStat) *MemoryInfoStat {
-	return &MemoryInfoStat{
-		RSS:  s.RSS,
-		VMS:  s.VMS,
-		Swap: s.Swap,
-	}
-}
-
-// ConvertFromMemInfoEx converts gopsutil MemoryInfoExStat object to MemoryInfoExStat in procutil
-func ConvertFromMemInfoEx(s *process.MemoryInfoExStat) *MemoryInfoExStat {
-	return &MemoryInfoExStat{
-		RSS:    s.RSS,
-		VMS:    s.VMS,
-		Shared: s.Shared,
-		Text:   s.Text,
-		Lib:    s.Lib,
-		Data:   s.Data,
-		Dirty:  s.Dirty,
-	}
-}
-
-// ConvertFromIOStats converts gopsutil IOCountersStat object to IOCounterStat in procutil
-func ConvertFromIOStats(s *process.IOCountersStat) *IOCountersStat {
-	return &IOCountersStat{
-		ReadCount:  int64(s.ReadCount),
-		WriteCount: int64(s.WriteCount),
-		ReadBytes:  int64(s.ReadBytes),
-		WriteBytes: int64(s.WriteBytes),
-	}
-}
-
-// ConvertFromCtxSwitches converts gopsutil NumCtxSwitchesStat object to NumCtxSwitchesStat in procutil
-func ConvertFromCtxSwitches(s *process.NumCtxSwitchesStat) *NumCtxSwitchesStat {
-	return &NumCtxSwitchesStat{
-		Voluntary:   s.Voluntary,
-		Involuntary: s.Involuntary,
-	}
-}

pkg/process/procutil/process_model_filled.go

@@ -0,0 +1,122 @@
+// Unless explicitly stated otherwise all files in this repository are licensed
+// under the Apache License Version 2.0.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2016-present Datadog, Inc.
+
+//go:build (!linux && !windows) || test
+
+package procutil
+
+import (
+	"github.com/DataDog/gopsutil/cpu"
+	"github.com/DataDog/gopsutil/process"
+)
+
+// ConvertAllFilledProcesses takes a group of FilledProcess objects and convert them into Process
+func ConvertAllFilledProcesses(processes map[int32]*process.FilledProcess) map[int32]*Process {
+	result := make(map[int32]*Process, len(processes))
+	for pid, p := range processes {
+		result[pid] = ConvertFromFilledProcess(p)
+	}
+	return result
+}
+
+// ConvertAllFilledProcessesToStats takes a group of FilledProcess objects and convert them into Stats
+func ConvertAllFilledProcessesToStats(processes map[int32]*process.FilledProcess) map[int32]*Stats {
+	stats := make(map[int32]*Stats, len(processes))
+	for pid, p := range processes {
+		stats[pid] = ConvertFilledProcessesToStats(p)
+	}
+	return stats
+}
+
+// ConvertFilledProcessesToStats takes a group of FilledProcess objects and convert them into Stats
+func ConvertFilledProcessesToStats(p *process.FilledProcess) *Stats {
+	return &Stats{
+		CreateTime:  p.CreateTime,
+		Status:      p.Status,
+		Nice:        p.Nice,
+		OpenFdCount: p.OpenFdCount,
+		NumThreads:  p.NumThreads,
+		CPUTime:     ConvertFromCPUStat(p.CpuTime),
+		MemInfo:     ConvertFromMemInfo(p.MemInfo),
+		MemInfoEx:   ConvertFromMemInfoEx(p.MemInfoEx),
+		IOStat:      ConvertFromIOStats(p.IOStat),
+		CtxSwitches: ConvertFromCtxSwitches(p.CtxSwitches),
+	}
+}
+
+// ConvertFromFilledProcess takes a FilledProcess object and convert it into Process
+func ConvertFromFilledProcess(p *process.FilledProcess) *Process {
+	return &Process{
+		Pid:      p.Pid,
+		Ppid:     p.Ppid,
+		NsPid:    p.NsPid,
+		Name:     p.Name,
+		Cwd:      p.Cwd,
+		Exe:      p.Exe,
+		Cmdline:  p.Cmdline,
+		Username: p.Username,
+		Uids:     p.Uids,
+		Gids:     p.Gids,
+		Stats:    ConvertFilledProcessesToStats(p),
+	}
+}
+
+// ConvertFromCPUStat converts gopsutil TimesStat object to CPUTimesStat in procutil
+func ConvertFromCPUStat(s cpu.TimesStat) *CPUTimesStat {
+	return &CPUTimesStat{
+		User:      s.User,
+		System:    s.System,
+		Idle:      s.Idle,
+		Nice:      s.Nice,
+		Iowait:    s.Iowait,
+		Irq:       s.Irq,
+		Softirq:   s.Softirq,
+		Steal:     s.Steal,
+		Guest:     s.Guest,
+		GuestNice: s.GuestNice,
+		Stolen:    s.Stolen,
+		Timestamp: s.Timestamp,
+	}
+}
+
+// ConvertFromMemInfo converts gopsutil MemoryInfoStat object to MemoryInfoStat in procutil
+func ConvertFromMemInfo(s *process.MemoryInfoStat) *MemoryInfoStat {
+	return &MemoryInfoStat{
+		RSS:  s.RSS,
+		VMS:  s.VMS,
+		Swap: s.Swap,
+	}
+}
+
+// ConvertFromMemInfoEx converts gopsutil MemoryInfoExStat object to MemoryInfoExStat in procutil
+func ConvertFromMemInfoEx(s *process.MemoryInfoExStat) *MemoryInfoExStat {
+	return &MemoryInfoExStat{
+		RSS:    s.RSS,
+		VMS:    s.VMS,
+		Shared: s.Shared,
+		Text:   s.Text,
+		Lib:    s.Lib,
+		Data:   s.Data,
+		Dirty:  s.Dirty,
+	}
+}
+
+// ConvertFromIOStats converts gopsutil IOCountersStat object to IOCounterStat in procutil
+func ConvertFromIOStats(s *process.IOCountersStat) *IOCountersStat {
+	return &IOCountersStat{
+		ReadCount:  int64(s.ReadCount),
+		WriteCount: int64(s.WriteCount),
+		ReadBytes:  int64(s.ReadBytes),
+		WriteBytes: int64(s.WriteBytes),
+	}
+}
+
+// ConvertFromCtxSwitches converts gopsutil NumCtxSwitchesStat object to NumCtxSwitchesStat in procutil
+func ConvertFromCtxSwitches(s *process.NumCtxSwitchesStat) *NumCtxSwitchesStat {
+	return &NumCtxSwitchesStat{
+		Voluntary:   s.Voluntary,
+		Involuntary: s.Involuntary,
+	}
+}

pkg/sbom/collectors/host/host_wmi.go

@@ -20,9 +20,7 @@ import (
 	"github.com/DataDog/datadog-agent/pkg/util/option"
 	"github.com/DataDog/datadog-agent/pkg/util/pointer"
 	"github.com/DataDog/datadog-agent/pkg/util/winutil"
-	"github.com/DataDog/gopsutil/host"
-
-	host2 "github.com/shirou/gopsutil/v4/host"
+	"github.com/shirou/gopsutil/v4/host"
 	"github.com/yusufpapurcu/wmi"
 )
 
@@ -124,12 +122,17 @@ func (c *Collector) Init(_ config.Component, _ option.Option[workloadmeta.Compon
 		return err
 	}
 
-	c.platform, c.family, c.build, err = host.PlatformInformation()
+	c.platform, c.family, _, err = host.PlatformInformation()
+	if err != nil {
+		return err
+	}
+
+	c.build, err = host.KernelVersion()
 	if err != nil {
 		return err
 	}
 
-	c.arch, err = host2.KernelArch()
+	c.arch, err = host.KernelArch()
 	if err != nil {
 		return err
 	}

pkg/security/security_profile/activity_tree/process_node_snapshot_test.go

@@ -12,15 +12,18 @@ import (
 	"os"
 	"testing"
 
-	legacyprocess "github.com/DataDog/gopsutil/process"
+	"github.com/shirou/gopsutil/v4/process"
 	"github.com/stretchr/testify/assert"
 )
 
 func TestSnapshotMemoryMappedFiles(t *testing.T) {
 	pid := os.Getpid()
 
 	// gopsutil
-	fakeprocess := legacyprocess.Process{Pid: int32(pid)}
+	fakeprocess, err := process.NewProcess(int32(pid))
+	if err != nil {
+		t.Fatal(err)
+	}
 	smapsPtr, err := fakeprocess.MemoryMaps(false)
 	if err != nil {
 		t.Fatal(err)

pkg/util/kernel/platform.go

@@ -8,7 +8,7 @@
 package kernel
 
 import (
-	gopsutilhost "github.com/DataDog/gopsutil/host"
+	gopsutilhost "github.com/shirou/gopsutil/v4/host"
 
 	"github.com/DataDog/datadog-agent/pkg/util/funcs"
 )