I've dug through some history of this site (which inevitably means someone will post how I missed it) and didn't find anything directly relating to my question.
What has been the typical solution when it comes to running docker but still trying to meet security requirements?
The particular use case is that we have dedicated container hosts and following Docker's guide on AV, have certain directories excluded. We still have issues with containers somehow getting roped into on demand scans, so we turn that off. Still have issues, so we exclude more directories. In the end we've disabled parts of the AV solution and excluded any directory users would be writing to, which - in my opinion - makes the AV solution ineffective. So I'm curious what other companies responses have been, whether it's technical (different vendor, settings in AV, etc) or policy driven (not requiring AV on Docker hosts).