I've dug through some history of this site (which inevitably means someone will post how I missed it) and didn't find anything directly relating to my question.

What has been the typical solution when it comes to running docker but still trying to meet security requirements?

The particular use case is that we have dedicated container hosts and following Docker's guide on AV, have certain directories excluded. We still have issues with containers somehow getting roped into on demand scans, so we turn that off. Still have issues, so we exclude more directories. In the end we've disabled parts of the AV solution and excluded any directory users would be writing to, which - in my opinion - makes the AV solution ineffective. So I'm curious what other companies responses have been, whether it's technical (different vendor, settings in AV, etc) or policy driven (not requiring AV on Docker hosts).

1 Answer 1


With a Docker container host, I think the best question to ask in terms of deciding your policy is "what threats does Anti-Virus address on this host"?

A-V is designed to catch malware running on a host, so the question becomes, how can malware be introduced onto that host. For Docker containers, that would either come via the images which are used to create the containers, or via data uploaded to applications running in the containers on the host.

For the first risk, a better solution would likely to be to A-V scan the images as part of the build process, alongside other security checks like vulnerability assessment. Assuming you're using common CI/CD pipeline tools like Jenkins, it should be possible to integrate an A-V scanner into your pipelines.

For the second risk, if you're thinking about files uploaded as part of the application's operation, then you could target A-V scanning at purely the directories used by the applications to receive uploaded files. As Docker containers are generally ephemeral, you would likely be using external volumes for storage of uploaded files, which makes it easy to target A-V at specific directories, as opposed to scanning the whole host.

The only other scenario that springs to mind would be where an attacker was able to compromise an application running in a container and uploaded tools which may be caught by an A-V scanner into the running container. For this you would likely need to run a scanner which targeted the Docker directories, I guess it would come down to your risk assessment as to whether that was a risk you considered serious enough to warrant the performance hit of allowing an A-V scanner to run in those areas.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .