Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

adds support for loading yara rules from the Karton S3 storage #13

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

r1d3th3wav3s
Copy link

In some situations it can be helpful to load Yara rules from the Karton S3 storage instead of mapping a volume to the docker container (for example if you deploy the Karton ecosystem on OpenShift).

Maybe my solution has room for improvement:-)

What do you think?

@chivay
Copy link
Contributor

chivay commented Jun 22, 2021

Hi,
thank you for your contribution and sorry for the late response!
After some internal discussion, we've decided that implementing this would be out of scope of this project.

Why do you require such feature? Do you have any usecase for this?
You've mentioned OpenShift which suggests that you should be able build a container image
bundled with YARA rules. To me, this sounds like the most natural way of running yaramatcher.
Doing this would simplify deployment (no requirement for mounting a volume) and ensure
reproducible behavior (no dependency on external storage).

@r1d3th3wav3s
Copy link
Author

Yes one solution is, to build the image for karton-yaramatcher in our environment and copy the yara files into it and use this image for deployment for example on OpenShift. But for this, the repository of karton-yaramatcher needs to be in our git-repo and we slightly have to modify it (Dockerfile, yara files). That works fine, but as you provide an image via DockerHub, it would be simpler to directly pull this image, run a container from it and instruct the container to get the yara files from the Karton S3 storage.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants