<p>I have a spring-boot application running on a container. One of the APIs is a file upload API and every time a file is uploaded it has to be scanned for viruses. We have uvscan to scan the uploaded file. I'm looking at adding uvscan to the base image but the virus definitions need to be updated on a daily basis. I've created a script to update the virus definitions. The simplest way currently is to run a cron inside the container which invokes the script. Is there any other alternative to do this? Can the uvscan utility be isolated from the app pod and invoked from the application?</p>

<p>There are many ways to solve the problem. I hope, I can help you to find what suits you best.</p>

<p>From my perspective, it would be pretty convenient to have a <a href="https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/" rel="nofollow noreferrer">CronJob</a> that builds and pushes the new docker image with uvscan and the updated virus definition database on a daily basis. </p>

<p>In your file processing sequence you can create a scan <a href="https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/" rel="nofollow noreferrer">Job</a> using Kubernetes API, and provide it access to shared <a href="https://kubernetes.io/docs/concepts/storage/volumes/#types-of-volumes" rel="nofollow noreferrer">volume</a> with a file you need to scan. </p>

<p>Scan Job will use <code>:latest</code> <a href="https://kubernetes.io/docs/concepts/containers/images/" rel="nofollow noreferrer">image</a>, and if new images will appear in the registry it will download new image and create pod from it.</p>

<p>The downside is when you create images daily it consumes "some" amount of disk space, so you may need to invent the process of removing the old images from the registry and from the docker cache on each node of Kubernetes cluster.</p>

<p>Alternatively, you can put AV database on a shared volume or using <a href="https://kubernetes.io/docs/concepts/storage/volumes/#mount-propagation" rel="nofollow noreferrer">Mount Propagation</a> and update it independently of pods. If uvscan opens AV database in <a href="https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes" rel="nofollow noreferrer">read-only mode</a> it should be possible. </p>

<p>On the other hand it usually takes time to load virus definition into the memory, so it might be better to run virus scan as a <a href="https://kubernetes.io/docs/concepts/workloads/controllers/deployment/" rel="nofollow noreferrer">Deployment</a> than as a Job with a daily restart after new image was pushed to the registry.</p>
