ClamAV

ClamAV checks files for signs of malware such as viruses and trojans. Applications can use it in an upload or mail-processing workflow so suspicious content is examined before being passed to users or other systems. The engine depends on its detection databases and on the application handling scan failures appropriately. This is file scanning: it answers a different question from whether a container's installed software has known security vulnerabilities.

Deployment and operating notes

The recovered chart used a Mailu container, whereas ClamAV now documents its own Docker images and container operation. ClamAV is a malware-scanning engine; it does not replace vulnerability scanning of operating-system packages or a Kubernetes runtime policy engine. A chart that starts successfully can still have stale signatures or insufficient resources for database reloads.

Choose an image publisher and supported ClamAV release, then define how signature updates persist and how the scanner is exposed to trusted callers. The official container guide highlights memory use during signature loading and reloads, so size limits for that peak rather than only idle usage. Test a harmless standard test signature through the actual upload or mail-processing path, along with oversized files, timeouts and unavailable scanning. Decide explicitly whether the application fails closed or queues work when scanning cannot complete. Preserve configuration and update-cache behavior during migration. Do not expose the scanner daemon directly to untrusted networks or interpret a clean scan as a guarantee that uploaded content is safe.