Build- & run-time features¶

Delta can be tailored at compile time (to shrink the binary for embedded targets) and at run time (to control what a deployed instance collects).

Build-time selection¶

Optional modules can be compiled out; the collection domains (processes, ports, mounts, fingerprints, packages, network) are always built:

CMake option	Default	Drops
`DELTA_FEATURE_FLEET`	ON	`--fleet` cohort analysis
`DELTA_FEATURE_MONITOR`	ON	`--interval` monitoring
`DELTA_FEATURE_HTTP`	ON	`--server` report shipping
`DELTA_FEATURE_RESPOND`	ON	active response (`kill` / `quarantine` / `block` / `fetch`)
`DELTA_FEATURE_TRACE`	ON	`--trace` syscall behavior tracing (all backends)
`DELTA_TRACE_ES`	OFF	macOS Endpoint Security trace backend (needs the endpoint-security entitlement; without it macOS falls back to per-task counters)

cmake -S . -B build -G Ninja \
      -DDELTA_FEATURE_MONITOR=OFF -DDELTA_FEATURE_FLEET=OFF -DDELTA_FEATURE_HTTP=OFF

CMake generates dlt_features.h; code is guarded with #if DLT_FEATURE_X. Invoking a flag for a compiled-out feature exits non-zero with a clear message (the exception is --allow-response, which a report-only build accepts and ignores — there is simply nothing left for it to enable).

Report-only builds¶

DELTA_FEATURE_RESPOND=OFF drops dlt_respond.c entirely, so the binary contains no code path that can modify host state — no process can be killed, no file moved, no firewall rule installed, whatever the server sends. Response commands are still recognised on the wire and refused with a log line; --allow-response becomes a no-op and --help says so.

This is the build to ship when the agent’s remit is observation only: it removes the destructive surface rather than gating it, so the guarantee holds even against a compromised collector or a mistaken operator.

cmake -S . -B build -G Ninja -DDELTA_FEATURE_RESPOND=OFF

The response commands arrive over the server channel, so DELTA_FEATURE_HTTP=OFF implies a report-only agent as well.

HTTP backend¶

With DELTA_FEATURE_HTTP=ON, pick the transport with DELTA_HTTP_BACKEND:

Value	Dependency	TLS
`socket` (default)	none (raw TCP)	no — plain HTTP only
`curl`	libcurl	yes — supports `https://`

Minimal-size builds¶

DELTA_MINSIZE=ON (or make build_min) optimizes for size: -Os, LTO, section GC, no debug info / unwind tables, link-time strip on ELF.

make build_min
# or, manual + drop optional modules:
cmake -S . -B build -G Ninja -DDELTA_MINSIZE=ON \
      -DDELTA_FEATURE_FLEET=OFF -DDELTA_FEATURE_MONITOR=OFF -DDELTA_FEATURE_HTTP=OFF

Indicative sizes (macOS arm64; the executable, excluding the C library):

Build	Size
default (with `-g`)	~222 KB
`DELTA_MINSIZE=ON`	~124 KB
`DELTA_MINSIZE=ON` + `strip`	~104 KB
real machine code (`__text`)	~61 KB

DELTA_MINSIZE roughly halves the binary. For the smallest result on Linux, combine it with a static musl toolchain (see Cross-compilation) and the feature switches — smaller pages and no Mach-O overhead make the file smaller still, and there is no third-party runtime dependency to drag in.

Runtime selection¶

Which domains run is the union of CLI flags (--processes, --ports, --packages, --netif, --trace, --fingerprint, --cve-feed) and a collect section in the config, so a config pushed to a device can drive it without changing the command line:

{ "collect": { "processes": true, "ports": true, "packages": true,
               "netif": true, "trace": true },
  "norm": { "...": "..." } }

A build-time-disabled module (fleet/monitor/http/respond/trace) cannot be enabled at runtime. See Configuration.