Repository: Mailu/Mailu

Issue:
Use official clamav docker image for Mailu clamav image
With https://github.com/Cisco-Talos/clamav having official docker support https://hub.docker.com/r/clamav/clamav it might be worth considering referring or preferring that container in the future?


Discussion:
It might be worthwhile to have a deeper look at using their image. However a quick look already shows a couple of issues
- no TZData package (timezone settings)
- No proper healthcheck
But this can be addressed in our Dockerfile which will use the clamav docker image of course.

I see they also offer pinned versions. That means we can use it.
@diman0, Hi

as the original author of the docker container, can you point out the issues in more detail? I'm sure we can discuss and integrate the needed things.

No TZData package, that is of course trivial to add. I'm no clamav expert, but is it used by clamav if available? If so, we could and should of course include it.

No proper healthcheck is supprising, because afaik it was inpsired by the healthcheck in mailu :p (but this was in 2019 so it may have changed significantly). Getting a better healthcheck in is of course only better then a poor healthcheck. But how is the current healthcheck not proper in your eyes?

Edit: I've opened a merge request to clamav's repo to delay the healthcheck on startup; and add the tzdata package. Thanks for that @Diman0. Happy to address any other issues in the container if needed be.
I see the Dockerfile does contain a HEALTHCHECK, but it is in the wrong location.
(https://github.com/Cisco-Talos/clamav/blob/679883fdb6b123ac534d5e7c27c902e04cbfa711/Dockerfile#L14
If this is moved below the second FROM (line 90), then the docker image will have a working healthcheck.

But that is actually not required for inclusion with Mailu. We would also have to define this in our Dockerfile. 
@diman0, thank you for pointing out these oversights. I'm fairly certain it worked at some point :) Docker improvement or broken Dockerfile for a long time. Either or; they are addressed.

Resolving patch:
diff --git a/optional/clamav/start.py b/optional/clamav/start.py
deleted file mode 100755
--- a/optional/clamav/start.py
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/usr/bin/env python3
-
-import os
-import logging as logger
-import sys
-from socrate import system
-
-system.set_env(log_filters=r'SelfCheck: Database status OK\.$')
-
-# Bootstrap the database if clamav is running for the first time
-if not os.path.isfile("/data/main.cvd"):
-    logger.info("Starting primary virus DB download")
-    os.system("freshclam")
-
-# Run the update daemon
-logger.info("Starting the update daemon")
-os.system("freshclam -d -c 6")
-
-# Run clamav
-logger.info("Starting clamav")
-os.system("clamd")


Test patch:
diff --git a/.github/workflows/build_test_deploy.yml b/.github/workflows/build_test_deploy.yml
--- a/.github/workflows/build_test_deploy.yml
+++ b/.github/workflows/build_test_deploy.yml
@@ -474,7 +474,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: ["setup", "docs", "fetchmail", "webmail", "admin", "traefik-certdumper", "radicale", "clamav", "rspamd", "oletools", "postfix", "dovecot", "unbound", "nginx"]
+        target: ["setup", "docs", "fetchmail", "webmail", "admin", "traefik-certdumper", "radicale", "rspamd", "oletools", "postfix", "dovecot", "unbound", "nginx"]
     steps:
       - uses: actions/checkout@v3
       - name: Retrieve global variables
diff --git a/tests/build-ci.hcl b/tests/build-ci.hcl
--- a/tests/build-ci.hcl
+++ b/tests/build-ci.hcl
@@ -49,7 +49,6 @@ group "default" {
 
     "webmail",
 
-    "antivirus",
     "fetchmail",
     "resolver",
     "traefik-certdumper",
@@ -207,15 +206,6 @@ target "webmail" {
 # -----------------------------------------------------------------------------------------
 # Optional images
 # -----------------------------------------------------------------------------------------
-target "antivirus" {
-  inherits = ["defaults"]
-  context = "optional/clamav/"
-  contexts = {
-    base = "docker-image://${DOCKER_ORG}/base:${MAILU_VERSION}"
-  }
-  tags = tag("clamav")
-}
-
 target "fetchmail" {
   inherits = ["defaults"]
   context = "optional/fetchmail/"
diff --git a/tests/build.hcl b/tests/build.hcl
--- a/tests/build.hcl
+++ b/tests/build.hcl
@@ -45,7 +45,6 @@ group "default" {
 
     "webmail",
 
-    "antivirus",
     "fetchmail",
     "resolver",
     "traefik-certdumper",
@@ -201,15 +200,6 @@ target "webmail" {
 # -----------------------------------------------------------------------------------------
 # Optional images
 # -----------------------------------------------------------------------------------------
-target "antivirus" {
-  inherits = ["defaults"]
-  context = "optional/clamav/"
-  contexts = {
-    base = "target:base"
-  }
-  tags = tag("clamav")
-}
-
 target "fetchmail" {
   inherits = ["defaults"]
   context = "optional/fetchmail/"
diff --git a/tests/compose/filters/docker-compose.yml b/tests/compose/filters/docker-compose.yml
--- a/tests/compose/filters/docker-compose.yml
+++ b/tests/compose/filters/docker-compose.yml
@@ -70,7 +70,7 @@ services:
     hostname: oletools
     restart: always
     networks:
-      - noinet
+      - oletools
 
   antispam:
     image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}rspamd:${MAILU_VERSION:-local}
@@ -78,7 +78,8 @@ services:
     env_file: mailu.env
     networks:
       - default
-      - noinet
+      - oletools
+      - clamav
     volumes:
       - "/mailu/filter:/var/lib/rspamd"
       - "/mailu/dkim:/dkim"
@@ -88,11 +89,22 @@ services:
 
   # Optional services
   antivirus:
-    image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}clamav:${MAILU_VERSION:-local}
+    image: clamav/clamav-debian:1.2.0-6
     restart: always
-    env_file: mailu.env
+    logging:
+      driver: journald
+      options:
+        tag: mailu-clamav
+    networks:
+      - clamav
     volumes:
-      - "/mailu/filter:/data"
+      - "/mailu/filter/clamav:/var/lib/clamav"
+    healthcheck:
+      test: ["CMD-SHELL", "kill -0 `cat /tmp/clamd.pid` && kill -0 `cat /tmp/freshclam.pid`"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
 
   resolver:
     image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}unbound:${MAILU_VERSION:-local}
@@ -112,6 +124,8 @@ networks:
       driver: default
       config:
         - subnet: 192.168.203.0/24
-  noinet:
+  clamav:
+    driver: bridge
+  oletools:
     driver: bridge
     internal: true