This is two in one docker image so it runs open source virus scanner ClamAV (https://www.clamav.net/), automatic virus definition updates as background process and REST api interface to interact with ClamAV process.

Usage:

Run clamav-rest docker image:

docker run -p 9000:9000 -itd --name clamav-rest ajilaag/clamav-rest

Test that service detects common test virus signature:

$ curl -i -F "file=@eicar.com.txt" http://localhost:9000/scan
HTTP/1.1 100 Continue

HTTP/1.1 406 Not Acceptable
Content-Type: application/json; charset=utf-8
Date: Mon, 28 Aug 2017 20:22:34 GMT
Content-Length: 56

{ Status: "FOUND", Description: "Eicar-Test-Signature" }

Test that service returns 200 for clean file:

$ curl -i -F "file=@clamrest.go" http://localhost:9000/scan

HTTP/1.1 100 Continue

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Date: Mon, 28 Aug 2017 20:23:16 GMT
Content-Length: 33

{ Status: "OK", Description: "" }

Status codes:

• 200 - clean file = no KNOWN infections
• 400 - ClamAV returned general error for file
• 406 - INFECTED
• 412 - unable to parse file
• 501 - unknown request

Developing:

Build golang (linux) binary and docker image:

# env GOOS=linux GOARCH=amd64 go build
docker build . -t clamav-go-rest
docker run -p 9000:9000 -itd --name clamav-rest clamav-go-rest