search

maliceio / malice

VirusTotal Wanna Be - Now with 100% more Hipster
Apache License 2.0
1.65k stars 265 forks source link

Whether the container will be destroyed #111

Open drwpeng opened 4 years ago

drwpeng commented 4 years ago

Is your feature request related to a problem? Please describe. Containers are created every scan. When there are a lot of files to be scanned, containers are frequently created and deleted. I think this is a waste of time.

Describe the solution you'd like Can I keep the malice-av container like a c/s server to avoid frequent container creation? Is this feasible? Will scanning files destroy the container?

blacktop commented 4 years ago

The initial idea was you are scanning dangerous malware so you would want to throw away the container after every scan. I'm not sure this is true but I had heard that VirusTotals scanners are all VMs the get reverted after a scan to prevent infection. With Docker the containers are all sharing a kernel so if the malware can attack the antivirus and infect the kernel then re-creating the container doesn't offer any extra protection, but it is still better than nothing.

blacktop commented 4 years ago

But I agree, if your main concern is speed then keeping the containers around longer would be better. I've designed each AV engine to be stand alone which means you can run them as little micro-services and submit to them via http post. You would have to write an engine to automate submission and storing the results.

blacktop commented 4 years ago

I will also add that when have have time to start my complete overhaul of the official Malice engine... some day.

drwpeng commented 4 years ago

Thank you for your reply, I will probably keep these containers running all the time, and then open a service to send malicious files to them。 Emm,where do you plan to modify?