DockerDefender

A Host-Based Malware Scanner for active Docker Containers

DockerDefender is a security tool that runs on the host system, scanning actively running Docker containers for malware from outside the containerized environment. It integrates with ClamAV to detect threats in containers without needing to run inside them. Key features include:

• Full container scans from the host system
• Real-time scanning of new files inside containers
• Automatic removal of detected malware
• Popup alerts for malware detection

✅ Scans all running containers for malware from the host system
✅ Runs outside of containers for enhanced security
✅ Supports ClamAV (clamscan or clamdscan) for detection
✅ Tracks newly created files inside containers
✅ Periodic monitoring for continuous security
✅ Optional automatic deletion of infected files
✅ Popup alerts for immediate threat notifications

Ensure Docker and ClamAV are installed on your system.

Follow Docker Installation Guide

On Ubuntu/Debian:

sudo apt update && sudo apt install clamav clamav-daemon -y

On CentOS/RHEL:

sudo yum install epel-release -y
sudo yum install clamav clamav-update -y

On Mac (Homebrew):

brew install clamav

git clone https://github.com/yourrepo/docker-defender.git
cd docker-defender

sudo python3 docker_defender.py scan

DockerDefender provides three main modes:

Scans all actively running containers for malware.

sudo python3 docker_defender.py scan

Continuously monitors running containers for new files and scans them at a set interval.

sudo python3 docker_defender.py monitor --interval 30

• --interval <seconds>: Time between scans (default: 60s)
• --popup: Show a popup alert if malware is found

Automatically removes detected malware from all running containers.

sudo python3 docker_defender.py defend

1. Detects Running Containers
   Uses docker ps to list all active containers.

2. Extracts Container Filesystem Paths
   Retrieves MergedDir from docker inspect, which represents the container's overlay filesystem.

3. Scans Files for Malware
   Runs ClamAV (clamdscan or clamscan) on container files.

4. Tracks new Files
   Uses an SQLite database to track and detect newly created files.

5. Alerts on Detection
   Shows warnings in the terminal and optionally triggers a popup alert.

6. Auto-Removes Infected Files (if enabled)

sudo python3 docker_defender.py scan

sudo python3 docker_defender.py monitor --interval 10

sudo python3 docker_defender.py defend

✔️ Lightweight & Fast – Uses ClamAV for efficient scanning
✔️ Works with Any Docker Container
✔️ Automated Security – Monitors for new threats
✔️ Simple to Use – Just one command to secure containers

DockerDefender helps detect and remove malware, but it is not a replacement for complete security measures. Always follow best security practices for containerized applications.

If you enjoy using DockerDefender and find it useful, you can support the project and help keep it going by buying me a coffee! Your support allows me to continue working on this project and improving it for everyone.

Simply click the button to make a small contribution and buy me a coffee (or two!). Every little bit helps and is greatly appreciated!

Thank you for your support! 💖

We welcome contributions! Feel free to open issues or pull requests on GitHub.

Shield:

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.