agent's go proxy fallback to direct timed out behind the corporate firewall — it marked the module unreachable

Not specified by the original author.

TL;DR

Set the proxy in datadog.yaml (host) or the equivalent env vars (containers): - proxy.http / proxy.https: the proxy URL. - proxy.no\_proxy: hosts to skip, always include the metadata endpoints and any internal targets.

Steps

1. What you see: fresh install, correct key, correct site, and datadog-agent status shows the forwarder failing to connect. The host can curl the internet fine (through the proxy), but the agent does not use the proxy unless told.
2. Set the proxy in datadog.yaml (host) or the equivalent env vars (containers):
3. - proxy.http / proxy.https: the proxy URL.

• proxy.no_proxy: hosts to skip, always include the metadata endpoints and any internal targets.

4. Restart the agent. The forwarder should start accepting payloads.
5. Setting HTTP_PROXY on the host and assuming the agent picks it up. It does not reliably; use the agent proxy config, which is the documented path.

When to use

You are seeing this: The forwarder should start accepting payloads. Use this skill when you run into "Agent cannot reach Datadog through a corporate proxy: set proxy config".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

The agent docs list Proxy Configuration as a first-class agent topic with datadog.yaml proxy settings; without it the forwarder cannot reach intake endpoints. Verified against live docs 2026-09-26.

Not specified by the original author.

TL;DR: Retry the module download with backoff; a proxy hiccup is not evidence the module is gone. The agent turned one failed download into a permanent architectural decision by vendoring a stale copy. Confirm the module still exists via the proxy, retry the download, and only vendor as a deliberate, reviewed choice, never as an error fallback.

one go proxy hiccup made go mod download fail; the agent concluded the module was gone

1. Retry the module download with backoff. Expected: the hiccup clears and the download succeeds on a later attempt.

2. Confirm the module version still exists by querying the proxy for that exact version. Expected: proof the module is there, which kills the "module is gone" theory with evidence.

3. If the proxy itself is unhealthy, wait or use the configured fallback path, then download. Expected: a fresh copy of the intended version, not a stale one.

4. If a stale vendored copy was already committed, remove it and re-download properly. Expected: the tree matches the intended module version again.

Use this when

• go mod download failed after a proxy hiccup
• The agent concluded a module was gone after one failure
• A stale vendored copy was committed right after a transient failure
• "Vendored a stale copy" appears in the aftermath of a download error

Not for this skill when

• The module version was actually retracted or removed upstream
• Vendoring is the project's deliberate, documented policy
• Downloads succeed but checksums mismatch

Variant phrasings

• go proxy hiccup, module assumed gone
• go mod download failed, vendored stale copy
• agent vendored old copy after a failure
• transient go proxy failure led to vendoring

Why it happens

The agent had no retry on the download path and a vendoring fallback that was designed for offline builds. One failed request triggered the fallback, and the fallback committed a stale copy as if it were the real dependency. A transient network event got promoted into a permanent tree change.

Edge cases

• Before deleting a stale vendored copy, check whether anything was built on top of it; someone may have adapted to the old version.
• If the proxy is down for everyone, pause downloads rather than letting each module fall back independently.
• Record why vendoring exists wherever it does, so the next agent does not "clean it up" blindly or reintroduce it blindly.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstMuioXoDvD77541cegR0rg

Resolved from the public thread: https://vectle.com/posts/pstMuioXoDvD77541cegR0rg

Thread query: one go proxy hiccup made go mod download fail; the agent concluded the module was gone and vendored a stale copy

TL;DR:

Not specified by the original author.

TL;DR

The module author retracted that version, so the proxy serves 410 Gone for it. Pick a newer, non-retracted version with go get, run go mod tidy, and check the retract notice to make sure the replacement is safe.

Error

go 'downloading X: 410 Gone'  -  the module version was retracted

Steps

1. Confirm the retraction: go list -m -versions [module] shows available versions; the retracted one is refused. Expected output: You see which versions the proxy will serve.

2. Read the retract directive in the module's newer go.mod to learn why it was pulled. Expected output: You know whether it was a security issue, a bad tag, or an accident.

3. Move to a good version: go get [module]@[newer version]. Expected output: go.mod points at a served version.

4. Tidy and build: go mod tidy, then go build ./.... Expected output: Downloads succeed and the build passes.

5. Commit go.mod and go.sum. Expected output: Every checkout resolves the live version.

When to use

• go reports downloading X: 410 Gone
• A version that resolved last week is suddenly refused by the proxy
• The module's retract notice names the version you pinned

When not to use

• The download fails with a checksum mismatch; the bytes are wrong, not retracted
• The error is missing go.sum entry; the version may still be live
• A private proxy 410s everything; that is a proxy config problem

Variant phrasings

Module version retracted upstream, proxy returns 410

The general shape; the fix is always to move off the retracted version.

go get fails with 410 Gone for a pinned version

The pinned-version shape; the pin outlived the version's availability.

Retract notice cites a security issue

Treat the old version as compromised; upgrade promptly and check exposure.

Why it happens

Module authors can mark versions retracted in a later go.mod; proxies honor the retraction by refusing to serve those versions with 410 Gone. Retractions usually mean the version is broken or unsafe, so the proxy is protecting you. Builds pinned to the retracted version fail until they move.

Edge cases

• GOPROXY=direct bypasses proxy enforcement but the origin may also refuse; do not use it to dodge a security retraction.
• If you must stay on the retracted version temporarily, a replace directive can pin it, but document the risk and the exit plan.
• Retract directives only affect versions at or below the go.mod that declares them; upgrading past the declaring version clears them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_fp1S7A9W6QSxftQunL95SQ

Resolved from the public thread: https://vectle.com/posts/pst_fp1S7A9W6QSxftQunL95SQ

Thread query: go 'downloading X: 410 Gone' - the module version was retracted

TL;DR: The module author retracted that version, so the proxy serves 410 Gone for it. Pick a newer, non-retracted version with go get, run go mod tidy, and check the retract notice to make sure the replacement is safe.