gjyoung1974 / docker-malware-scan

Docker image that scans other images for malware, viruses, potentially unwanted programs

gjyoung1974/docker-malware-scan

Antivirus & Antimalware as a Microservice / as a Docker Container

gjyoung1974/docker-malware-scan is a docker image malware scanner. Y

The resulting Docker image runs inotify as the main process that watches a pre-defined volume for file write events and calls clamscan for each new file that is written into the volume. We do not use the ClamAV daemon, which has a constant, large memory consumption.

Notes

• The image may only be built once per hour on the same IP address due to download limitations of the ClamAV signatures
• the image is maintained by Gordon Young,

Quick start

Try out the setup, copy the docker-compose.yml file from the repository to your local file system and run:

docker-compose up -d

Introduction

Build for gjyoung1974/docker-malware-scan
Docker image running Linux Malware Detect (LMD) with ClamAV as the scanner.

gjyoung1974/docker-malware-scan provides a plug-in container to e.g. scan file uploads in web applications before further processing.

The container requires three volume mounts from where to take files to scan, and to deliver back scanned files and scan reports.

The container auto-updates the LMD and ClamAV virus signatures once per hour.

Optionally, an email alert can be sent to a specified email address whenever a virus/malware is detected in a file.

Required volume mounts

Please provide the following volume mounts at runtime (e.g. in your docker-compose file). The antivirus container expects the following paths to be present when running:

    /data/av/queue         --> files to be checked
    /data/av/ok            --> checked files (ok)
    /data/av/nok           --> scan reports for infected files

Additionally, you may mount the quarantine folder and provide it to the antivirus container at the following path (this might be useful if you want to process the quarantined files from another container):

    /data/av/quarantine    --> quarantined files

Docker Pull & Run

To install the container, pull it from the Docker registry (latest tag refers to the master branch, use dev tag for dev branch):

docker pull gjyoung1974/docker-malware-scan:latest

To run the docker container, use the following command. If you pass an email address as the last argument, email alerts will be activated and sent to this email address whenever a virus is detected.

docker run -tid --name docker-antivirus gjyoung1974/docker-malware-scan [[e-mail]]

Docker Build & Run

To build your own image, clone the repo and cd into the cloned repository root folder. Then, build as follows:

docker build -t docker-antivirus .

To start the built image, run the following command. Optionally pass an email address to activate email alerts when a virus/malware is detected:

docker run -tid --name docker-antivirus docker-antivirus:latest [[e-mail]]

Testing

You can use the EICAR test file to test the AV setup. (Caution: create the file yourself and copy-past the file content that can be found on the linked Wikipedia article.)

Mounting volumes with docker-compose

Here is an exmple entry that you can use in your docker-compose file to easily plug in the container into your existing network. Replace "networkid" with your actual netwerk id. Optionally turn on email alerts by uncommenting the "command". Finally, make sure the ./data/av/... folders exist on your local/host system or change the paths.

docker-malware-scan:
  image: gjyoung1974/docker-malware-scan
  container_name: docker-malware-scan
  # uncomment and set the email address to receive email alerts when viruses are detected
  #command:
  # - /usr/local/install_alerts.sh [e-mail]
  volumes:
    - ./data/queue:/data/av/queue
    - ./data/ok:/data/av/ok
    - ./data/nok:/data/av/nok
  networks:
    - yournetworkid