Adding an auto-instrumentation package silently instruments the application

Installing a Composer package should not change application runtime behavior. Adding any open-telemetry/opentelemetry-auto-* package is enough to instrument the app. Registration happens on its own and there is no place where the application can prevent it, so it is opt-out.
I think opt-in would be the less surprising default.

The Node SDK works that way. Installing the package does nothing until you activate it, either with a CLI flag:

--require @opentelemetry/auto-instrumentations-node/register

or from your own instrumentation file:

registerInstrumentations({
  instrumentations: [getNodeAutoInstrumentations()]
});

The docs point at OTEL_PHP_DISABLED_INSTRUMENTATIONS as the way to disable instrumentations, but there is no place inside the application where that variable can be set. You can work around it, by passing the env var on every PHP invocation or by running a putenv() function before the autoload happens, but these are workarounds for something that should not need one.

Every auto package ships a _register.php in its autoload.files:

if (class_exists(Sdk::class) && Sdk::isInstrumentationDisabled(FooInstrumentation::NAME) === true) {
    return;
}

FooInstrumentation::register();

The check runs once, during autoload, and whatever it decides is final. So a PHPUnit config like this silently does nothing, because the autoloader has already run by the time the XML is parsed:

<php>
  <env name="OTEL_PHP_DISABLED_INSTRUMENTATIONS" value="all" force="true"/>
</php>

OTEL_PHP_AUTOLOAD_ENABLED=false is not an opt-out either. It controls SDK autoconfiguration, not instrumentation registration. The hooks are still installed and still execute on every instrumented call. They just resolve a NoopTracerProvider.

Deploying with OpenTelemetry disabled is something I can only do in the environment that launches the process, never in the project itself, and I have to repeat it for every entry point: web, console, workers, test runner. Forcing a no-op TracerProvider from application code suppresses the output but does not disable the instrumentation. The hooks still fire.

I think the model itself should change to opt-in. Nothing registers until the application says so. Installing a package should only make an instrumentation available.

Ref: https://github.com/open-telemetry/opentelemetry-php/issues/1509 (https://github.com/open-telemetry/opentelemetry-php/issues/1509#issuecomment-4729430000)