SAVDI on Docker

This repository provides resources to build docker image that run Sophos Antivirus Dynamic Interface (SAVDI). Note that additional proprietary resources are required to build image. (See Makefile)

Main process launches following processes on container.

• savdi daemon : savdi itself
• sophos updater : This process updates sophos periodically and reload savdi daemon if there is any updates.
• logcat : This process cat log file contents to stdout and truncate them periodically. (It's really agry but required because daemon can't output log to stdout even if we configure to output to 'CONSOLE' using savdid.conf)

For more detail see init.sh.

Build

# (optional) configure
edit ./savdid.conf
sed -i '' 's,# COPY savdid.conf,COPY savdid.conf,g' Dockerfile

# build image
make image

# or specify tag (defalt: branch name)
make tag=latest image

# or pass username / password if you have license
env SOPHOS_INSTALL_OPTIONS="--update-source-username=$username --update-source-password=$password" make image

Run

docker run --rm -it -p 4010:4010 -e SOPHOS_UPDATE_INTERVAL_SEC=3600 savdi:<tag>

Test

make run

echo '123' | ./scandata.sh
echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' | ./scandata.sh