tiredofit / docker-clamav

Docker antivirus software with monitoring and customizable features
MIT License
27 stars 18 forks source link

How to scan #5

Open longfeide2008 opened 4 years ago

longfeide2008 commented 4 years ago

How to scan

tiredofit commented 4 years ago

It's meant to operate as a daemon for other applications to pass their files to and have it respond with either good/bad. You could certainly use it for scanning however of file systems if you opened a bind mount volume and went into the container and executed the appropriate clam commands, however again, that's not what this is designed for..

I use it with my docker-nextcloud repo, and also docker-postal and docker-rspamd.

longfeide2008 commented 4 years ago

It's meant to operate as a daemon for other applications to pass their files to and have it respond with either good/bad. You could certainly use it for scanning however of file systems if you opened a bind mount volume and went into the container and executed the appropriate clam commands, however again, that's not what this is designed for..

I use it with my docker-nextcloud repo, and also docker-postal and docker-rspamd.

Do I need to mount the local directory to the docker container using volumes and then call clamscan? Can you give me an example?

tiredofit commented 4 years ago

Yes, that's what I was saying: You could try this as a command line example docker run -it -v /home/lonefeide2008:/scan tiredofit/clamav:latest bash

Then when inside you would run the clamscan executible against your /scan folder which would be your home directory from outside the container.

longfeide2008 commented 4 years ago

Yes, that's what I was saying: You could try this as a command line example docker run -it -v /home/lonefeide2008:/scan tiredofit/clamav:latest bash

Then when inside you would run the clamscan executible against your /scan folder which would be your home directory from outside the container.

I found a problem that there is no virus database by default. I am a Chinese user, but the download speed here is very slow. How should I solve it?

tiredofit commented 4 years ago

Right the container is designed to download a database on first install and will persist if you expose the proper volumes (/data). It's hardcoded where we download the definitions from but I can add in an environment variable for that, however i'm not sure where else we would get them from. Will do so tomorrow.

longfeide2008 commented 4 years ago

正确的是,该容器旨在在首次安装时下载数据库,并且如果公开适当的卷(/数据),该容器将保留下来。我们从哪里下载定义是硬编码的,但是我可以为此添加一个环境变量,但是我不确定我们还能从哪里获得它们。明天会这样做。

Thank you very much

longfeide2008 commented 4 years ago

Does this container have exposed APIs that can be used

longfeide2008 commented 4 years ago

Is this project used correctly? https://github.com/eliasgranderubio/dagda/blob/master/dagda/analysis/static/av/malware_extractor.py

image

tiredofit commented 4 years ago

I'm not so great with Python unfortunately. From my limited view should be correct?

tiredofit commented 4 years ago

WRT to an API. We do expose port 3310 as a socket to take parameters. Thats the original intent of the container. If you research the way that Clam AV takes socket connections you should be able to pass a file via a TCP socket to it and it should give you a response (OK/FAIL).

longfeide2008 commented 4 years ago

I'm not so great with Python unfortunately. From my limited view should be correct?

The result of my test is a failure

longfeide2008 commented 4 years ago

WRT to an API. We do expose port 3310 as a socket to take parameters. Thats the original intent of the container. If you research the way that Clam AV takes socket connections you should be able to pass a file via a TCP socket to it and it should give you a response (OK/FAIL).

What is the correct way to use this project? I didn't figure out how your project was used.

tiredofit commented 4 years ago

I use it for this purpose - To scan email messages as they come in from Rspamd, as per manual here: https://rspamd.com/doc/modules/antivirus.html

longfeide2008 commented 4 years ago

是的,这就是我的意思:您可以尝试将其作为命令行示例 docker run -it -v /home/lonefeide2008:/scan tiredofit/clamav:latest bash 然后在内部时,将对clamscan容器运行可执行/scan文件,该文件夹将是容器外部的主目录。

我发现一个问题,默认情况下没有病毒数据库。我是中国用户,但是这里的下载速度非常慢。我应该如何解决?

Is it supported now?

tiredofit commented 4 years ago

There's been no updates since we last wrote in here, image is working as intended..

yllekz commented 3 years ago

/scan is not in the documentation, can this please be added? What I'm reading here isn't documented and I think this is pretty critical to using this container.