Base
Hardened build
minimal ports, security patches applied at build time
ClamAV on Ubuntu 24.04 LTS
Azure
Security
ClamAV, the open source malware scanning engine, ready to scan your files the moment it boots, with signatures fetched fresh on first boot rather than shipped stale.
Overview
ClamAV is the widely deployed open source malware scanning engine. It provides a scanning daemon that holds a signature set in memory and returns a verdict on any file handed to it, command line scanners for on demand and scheduled sweeps, and an updater that keeps signatures current directly from the signature provider.
It is worth being precise about what this is: ClamAV is a scanning engine, not a complete antivirus suite. There is no management console, no web interface, and it does not automatically protect other machines. What it does extremely well is answer one question reliably: is this file malicious. That makes it the right fit for four patterns. Scanning the storage attached to this instance, which is the common case: mount a file share or a data volume and let the scheduled sweep cover it. Acting as a scanning service that your other workloads call, handing files to the daemon and receiving a verdict, which is the standard way to scan uploads without putting a scanner in every application. Scanning this instance's own filesystem on a schedule. And serving as the engine underneath something you build yourself, such as a mail filter or a content adaptation gateway.
It is also a straightforward answer to compliance regimes that require a real, maintained antimalware capability with current signatures.
Why the cloudimg image
cloudimg delivers ClamAV fully installed and wired, with the scanning daemon, the signature updater and a scheduled sweep already configured as services. Signatures are deliberately not baked into the image: a signature set frozen at build time is stale the day it ships, and an engine that reports healthy while missing everything published since then is worse than none, so the first boot of every instance fetches a current signature set straight from the signature provider and an updater keeps it current thereafter. The image fails closed by design: the scanner physically cannot start without a signature set, and two independent safeguards enforce that on every start, not merely the first.
The scanning daemon listens on a local socket only, never an open network port, a deliberate choice because the daemon has no authentication of its own and an exposed scanner would accept content from anything that could reach it. The paired guide shows exactly how to open it to your own private network when you genuinely need a shared scanning service. This product carries no login and no password of any kind, because ClamAV has none to carry: administration is over your own key. Everything is installed from official package archives so security updates keep flowing automatically for the life of the release, nothing is pinned or held back, the base is fully patched, and every deployment is paired with a step by step deploy guide and backed by 24/7 cloudimg support.
Common uses
- Scheduled malware scanning of mounted file shares and data volumes
- A scanning service that your other workloads call to check uploads
- A maintained antimalware capability for compliance requirements
More in Security
KeePass Password Manager
Security
KeePass is a free, open source password manager that stores all your passwords in a highly encrypted database. The datab...
CrowdSec
Security
This image runs CrowdSec, the free and open source collaborative behavioural security engine.
Ollama GPU-Accelerated LLM Server
Security
This image runs Ollama 0.30, the easiest way to run open large language models locally - pull and serve Llama, Mistral, ...
OWASP ZAP
Security
This image runs OWASP ZAP (the Zed Attack Proxy), the world's most widely used open source web-application security scan...
step-ca
Security
This image runs step-ca, the open source online certificate authority from Smallstep for secure, automated X.509 and ACM...
Trivy Security Scanner
Security
This image runs Trivy, the open source, Apache-2.0 licensed all-in-one security scanner from Aqua Security.