From c6037a4b8c42de0eb9f20fe005a7e6b81f9fe1cd Mon Sep 17 00:00:00 2001
From: "agent-platform-auto-pr[bot]"
 <153269286+agent-platform-auto-pr[bot]@users.noreply.github.com>
Date: Wed, 8 Jan 2025 12:04:03 +0100
Subject: [PATCH] [Backport 7.62.x] workloadmeta: add missing runtime and state
 fields in container parsed from ECS v1 (#32748)

Co-authored-by: Paul Cacheux <paul.cacheux@datadoghq.com>
---
 .../collectors/internal/ecs/v1parser.go       |  5 +++++
 comp/core/workloadmeta/def/merge.go           | 19 +++++++++++++++++++
 ...x-containers-billing-19580e6f968dd79a.yaml | 13 +++++++++++++
 3 files changed, 37 insertions(+)
 create mode 100644 releasenotes/notes/cws-fix-containers-billing-19580e6f968dd79a.yaml

diff --git a/comp/core/workloadmeta/collectors/internal/ecs/v1parser.go b/comp/core/workloadmeta/collectors/internal/ecs/v1parser.go
index 48f524b154dc3e..6d742ba6068fc4 100644
--- a/comp/core/workloadmeta/collectors/internal/ecs/v1parser.go
+++ b/comp/core/workloadmeta/collectors/internal/ecs/v1parser.go
@@ -102,9 +102,14 @@ func (c *collector) parseTaskContainers(
 			Type:   workloadmeta.EventTypeSet,
 			Entity: &workloadmeta.Container{
 				EntityID: entityID,
+				Runtime:  workloadmeta.ContainerRuntimeDocker,
 				EntityMeta: workloadmeta.EntityMeta{
 					Name: container.DockerName,
 				},
+				State: workloadmeta.ContainerState{
+					Status: workloadmeta.ContainerStatusUnknown,
+					Health: workloadmeta.ContainerHealthUnknown,
+				},
 			},
 		})
 	}
diff --git a/comp/core/workloadmeta/def/merge.go b/comp/core/workloadmeta/def/merge.go
index a01416927b6b03..e529b01aca133c 100644
--- a/comp/core/workloadmeta/def/merge.go
+++ b/comp/core/workloadmeta/def/merge.go
@@ -22,6 +22,7 @@ var (
 	timeType            = reflect.TypeOf(time.Time{})
 	portSliceType       = reflect.TypeOf([]ContainerPort{})
 	containerHealthType = reflect.TypeOf(ContainerHealthUnknown)
+	containerStatusType = reflect.TypeOf(ContainerStatusUnknown)
 	mergerInstance      = merger{}
 )
 
@@ -34,6 +35,9 @@ func (merger) Transformer(typ reflect.Type) func(dst, src reflect.Value) error {
 	// Even though Health is string alias, the matching only matches actual Health
 	case containerHealthType:
 		return healthMerge
+	// Even though Status is string alias, the matching only matches actual Status
+	case containerStatusType:
+		return statusMerge
 	}
 
 	return nil
@@ -54,6 +58,21 @@ func healthMerge(dst, src reflect.Value) error {
 	return nil
 }
 
+func statusMerge(dst, src reflect.Value) error {
+	if !dst.CanSet() {
+		return nil
+	}
+
+	srcStatus := src.Interface().(ContainerStatus)
+	dstStatus := dst.Interface().(ContainerStatus)
+
+	if srcStatus != "" && srcStatus != ContainerStatusUnknown && (dstStatus == "" || dstStatus == ContainerStatusUnknown) {
+		dst.Set(src)
+	}
+
+	return nil
+}
+
 func timeMerge(dst, src reflect.Value) error {
 	if !dst.CanSet() {
 		return nil
diff --git a/releasenotes/notes/cws-fix-containers-billing-19580e6f968dd79a.yaml b/releasenotes/notes/cws-fix-containers-billing-19580e6f968dd79a.yaml
new file mode 100644
index 00000000000000..443fb87b654435
--- /dev/null
+++ b/releasenotes/notes/cws-fix-containers-billing-19580e6f968dd79a.yaml
@@ -0,0 +1,13 @@
+# Each section from every release note are combined when the
+# CHANGELOG.rst is rendered. So the text needs to be worded so that
+# it does not depend on any information only available in another
+# section. This may mean repeating some details, but each section
+# must be readable independently of the other.
+#
+# Each section note must be formatted as reStructuredText.
+---
+fixes:
+  - |
+    Fix an issue where the remote workloadmeta was not receiving some unset
+    events for ECS containers, causing incorrect billing in CWS, CSPM, CSM Pro, CSM
+    Enterprise, and DevSecOps Enterprise Containers.