ci: restore EL7 stresstest coverage, add nightly EL7 functional tests

[rkennke]

Summary

Follow-up to #790's "One coverage regression this introduces, and how to undo it" section.

Moving build:x64 to AlmaLinux 8 (#790) took stresstest:x64 with it, since it ran in the same image — runtime coverage at the shipped binary's actual glibc floor (2.17) went from thin to zero. This implements the two follow-ups #790 proposed:

1. .stresstest_job gets its own runtime image, independent of the image the artifact was built in. RUNTIME_IMAGE replaces the reused BUILD_IMAGE variable in the job template; stresstest:x64 now points it at a new Oracle Linux 7 image (glibc 2.17), while build:x64 stays on AlmaLinux 8 — matching ci: move the shipped binaries to AlmaLinux 8, get the test images off EOL Debian #790's own note that this "is better than the old arrangement, because it would exercise the el8-built artifact on 2.17 rather than a 2.17-built one." Every other stresstest:* job keeps its existing image, just renamed to the new variable.
2. A functional job matrix, functional:x64-el7-jdk{8,17,21}, runs the ddprof-test suite against the shipped x64 artifact on the same EL7 image — the "libc-sensitive suites" coverage ci: move the shipped binaries to AlmaLinux 8, get the test images off EOL Debian #790 called out. jdk17 and jdk21 are nightly-only (CI_PIPELINE_SOURCE == "schedule", same pattern as the existing chaos:build job); jdk8 also runs on every pipeline — it's the oldest/most different from the JDK 21 that runs Gradle, so EL7 functional coverage isn't gated entirely on the nightly schedule.

Details

• .gitlab/base/el7/Dockerfile (new): Oracle Linux 7. Built and pushed for real via rebuild-images (BUILD_IMAGE_X64_EL7, currently pinned to the pipeline-138438605 digest, gcc-c++ included — see below).
• .gitlab/scripts/functional-tests.sh (new): fetches the JDK under test from Adoptium into JAVA_TEST_HOME, so Gradle itself keeps running on JDK 21 (Gradle 9's minimum) regardless of which JDK the suite targets. Runs testRelease, not testDebug — build:x64 only ever ships a release-config .so, so testDebug would set ddprof_test.config=debug against a library that was actually built release, and debug-only assertions would fail outright instead of correctly assumeTrue-skipping.
• .gitlab/build-deploy/images.yml, rebuild-images.sh, check-image-updates.sh: wired BASE_IMAGE_EL7 / x64-el7 through the same image-build, repin and staleness-check machinery as the existing images.
• PlatformUtils.isNativeSkipped() (build-logic): -Pskip-native now also accepts a comma-separated project list (-Pskip-native=ddprof-lib,malloc-shim) instead of only the bare, skip-everywhere form. functional-tests.sh needs to skip only ddprof-lib's own native build (substituted via -Pwith-libs) while still compiling ddprof-test-native's small JNI test helper for real — several ddprof-test suites need it on java.library.path regardless of which profiler binary is under test, and the bare flag disabled that unconditionally.
• ddprof-test-native/build.gradle.kts: added -std=gnu99 — one of its .c files uses a C99 for-loop-scoped declaration, which EL7's stock gcc 4.8.5 rejects under its default gnu89 dialect (every other gcc/clang this project builds on already defaults to C99+, so this was latent until a compiler this old actually compiled the file).
• ddprof-test/build.gradle.kts: added an opt-in -PtestMaxHeap property (appended after the plugin's default -Xmx512m, so the last -Xmx wins), and functional-tests.sh passes -PtestMaxHeap=1536m. One suite (ContendedCallTraceStorageTest) drives more concurrent CPU/allocation load than this shared runner's pod apparently gives it headroom for at the default heap. Every other caller (GH Actions matrix, stresstest.sh) is unaffected.
• .gitlab/base/el8/Dockerfile: added gcc-c++. Gradle's ConfigurationPresets.setupStandardConfigurations() calls findCompiler() unconditionally at configuration time, before -Pskip-native is even consulted — an image with no compiler at all fails to configure the build, even though -Pskip-native means it's never actually invoked. (Applies to the EL7 image functional-tests.sh runs in, not the shipped AlmaLinux 8 build.)

A real bug this surfaced (not fixed here)

With all of the above green, functional:x64-el7-jdk8 still fails — but now for a legitimate reason, not a CI bug. Every NativeSocket* test reports datadog.NativeSocketEvent count: 0.

Built a temporary debug-config diagnostic build (statically linked, since debug configs don't get -static-libstdc++ and needed it to even load on EL7 — see the now-removed diagnostic commits for the full trail) to get NativeSocketSampler's debug-only hook-fire counters. Confirmed the hooks are not the problem: send_hook/recv_hook/write_hook/read_hook all fire correctly, PLT patching succeeds across libjvm.so/libnio.so/libnet.so. The stop summary lines show the sampler's rate limiter rejecting nearly every single call (accept=0 on almost every line, out of hundreds to thousands of calls) because none of them are actually slow — NativeSocketTestBase.doTcpTransfer()'s comment claims the persistent connection's send buffer fills after ~32 iterations and blocks for >1ms, but on this runner's network stack that assumption doesn't hold, so the time-weighted sampler correctly rejects everything as "too fast to be worth a sample."

That's a real test-portability bug in NativeSocketTestBase, unrelated to EL7/glibc-2.17 specifically. Tracked separately for quarantine (ddprof-test/quarantine.txt) now that #777 is merged, rather than worked around here.

Test plan

• .gitlab/base/el7/Dockerfile builds locally and the resulting image runs java -version against glibc 2.17
• x64-el7 image built and pushed via a real pipeline, digest pinned
• stresstest:x64 and functional:x64-el7-jdk8 run in real GitLab pipelines through several rounds of fixes (compiler probe, exec permission, C99, debug/release config, heap) — each fix verified against the actual failure it targets
• The remaining functional:x64-el7-jdk8 failure (NativeSocket*) root-caused via a temporary diagnostic build/job pair, now removed
• One more green (or known-red-only-on-the-quarantined-flake) pipeline run to confirm after the latest rebase + diagnostic-job removal

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: daedd84e8c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[datadog-prod-us1-4]

The EL7 stress job cannot pull its image. The nightly functional jobs also cannot start the script or load the required native test library.

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit daedd84 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[datadog-prod-us1-4]

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 1 Pipeline job failed

DataDog/java-profiler | functional:x64-el7-jdk8

View more details · View in GitLab

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: cb4d5a1 | Docs | View more details | Give us feedback!}

[dd-octo-sts]

CI Test Results

Run: #35973884240 | Commit: 23fae64 | Duration: 15m 17s (longest job)

✅ All 32 test jobs passed

Status Overview

JDK	glibc-aarch64/debug	glibc-amd64/debug	musl-aarch64/debug	musl-amd64/debug
8	-	✅	-	-
8-ibm	-	✅	-	-
8-j9	✅	✅	-	-
8-librca	-	-	✅	✅
8-orcl	-	✅	-	-
11	-	✅	-	-
11-j9	✅	✅	-	-
11-librca	-	-	✅	✅
17	✅	✅	-	-
17-graal	✅	✅	-	-
17-j9	✅	✅	-	-
17-librca	-	-	✅	✅
21	✅	✅	-	-
21-graal	✅	✅	-	-
21-librca	-	-	✅	✅
25	✅	✅	-	-
25-graal	✅	✅	-	-
25-librca	-	-	✅	✅

Legend: ✅ passed | ❌ failed | ⚪ skipped | 🚫 cancelled

Summary: Total: 32 | Passed: 32 | Failed: 0

---

Updated: 2026-09-24 08:31:31 UTC

[dd-octo-sts]

✅ All 40 integration tests passed

📊 Dashboard · 👷 Pipeline · 📦 cb4d5a11

[rkennke]

Checked all 6 review threads — all point at the very first commit (daedd84), before the follow-up fixes landed. Each is already addressed:

• Placeholder EL7 digest (2 threads): pinned to the real built-and-pushed image, then re-pinned again after the gcc-c++ fix.
• functional-tests.sh not executable (2 threads): chmod +x'd.
• -Pskip-native also breaking ddproftest (2 threads): PlatformUtils.isNativeSkipped() now supports a comma-separated project list, so functional-tests.sh skips only ddprof-lib's own build while still compiling the JNI test helper for real.

Resolving all six.

[kaahos]

I've left 2 comments, but nothing blocking. Thanks!

[zhengyu123]

LGTM