Docker Hub Image

The official justsouichi/pompelmi-scanner image ships ClamAV, clamd, and a lightweight HTTP scan API so you can add antivirus scanning to any stack without installing anything beyond Docker.

Docker Hub: hub.docker.com/r/justsouichi/pompelmi-scanner

Quick start

# Pull and run
docker pull justsouichi/pompelmi-scanner
docker run -p 8080:8080 justsouichi/pompelmi-scanner

# Scan a file
curl -F "file=@./document.pdf" http://localhost:8080/scan

Response:

{ "verdict": "clean", "file": "document.pdf", "viruses": [] }

For infected files the verdict is "malicious".

HTTP endpoints

MethodPathDescription
POST /scan Accepts multipart/form-data with a file field. Returns { verdict, file, viruses }.
GET /health Returns { status: "ok", clamd: "running" }. Use for Docker / Kubernetes health checks.
GET /stats Returns scan statistics: total, clean, infected, errors, uptime.

Scan response schema

{
  "verdict": "clean" | "malicious" | "error",
  "file": "<filename>",
  "viruses": []
}

Docker Compose

services:
  pompelmi:
    image: justsouichi/pompelmi-scanner
    ports:
      - "8080:8080"
    volumes:
      - /uploads:/uploads
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3

Calling the API from Node.js

const FormData = require('form-data');
const fs       = require('fs');
const fetch    = require('node-fetch'); // or native fetch (Node 18+)

const form = new FormData();
form.append('file', fs.createReadStream('./upload.pdf'), 'upload.pdf');

const res  = await fetch('http://localhost:8080/scan', { method: 'POST', body: form });
const data = await res.json();
console.log(data.verdict); // "clean" | "malicious" | "error"

Ports

PortDescription
8080HTTP scan API
3310clamd TCP socket (for direct clamd connections from other containers)

Build locally

git clone https://github.com/pompelmi/pompelmi.git
cd pompelmi
docker build -f docker/Dockerfile -t justsouichi/pompelmi-scanner .

The Dockerfile and entrypoint.sh live in docker/. See Docker & Remote Scanning for connecting pompelmi to an existing clamd instance.