ClamAV runs a straightforward signature-based scan over the parts of the host most likely to matter: writable, higher-risk directories rather than the whole filesystem.
- Tool —
clamscan -r -i, raw output as text. - Findings — one critical finding per
... FOUNDline.
Default scope
Writable / higher-risk directories — /home, /root, /tmp, /opt, and
similar — not the entire host.
Params
| Key | Default | Effect |
|---|---|---|
target |
— | one host-absolute path to scan, e.g. / |
paths |
risk dirs (/home, /root, /tmp, …) |
list of host-absolute paths |
Signature updates
A clamav-db volume caches the virus database between restarts, and the agent
entrypoint runs freshclam on startup on a best-effort basis (it also chowns
the volume to the clamav user first, since a fresh volume mounts in
root-owned and freshclam drops privileges).