Add Clamav image that can run unprivileged

.github/workflows/build-clamav-image.yml

@@ -0,0 +1,30 @@
+name: Build and publish clamav image to ECR
+
+on:
+  workflow_dispatch:
+    inputs:
+      gitRef:
+        description: 'Commit, tag or branch name to deploy'
+        required: true
+        type: string
+        default: 'main'
+
+  push:
+    branches:
+      - main
+    paths:
+      - "images/clamav/**"
+
+  schedule:
+    - cron: '0 0 * * 1'
+
+jobs:
+  build-and-push-image:
+    uses: alphagov/govuk-infrastructure/.github/workflows/build-and-push-image.yml@main
+    with:
+      gitRef: ${{ inputs.gitRef || github.ref }}
+      ecrRepositoryName: clamav
+      dockerfilePath: images/clamav/Dockerfile
+    secrets:
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_GOVUK_ECR_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_GOVUK_ECR_SECRET_ACCESS_KEY }}

images/clamav/Dockerfile

@@ -0,0 +1,12 @@
+FROM clamav/clamav-debian:1.2
+
+COPY "./scripts/unprivileged-entrypoint.sh" "/unpriv-init"
+
+RUN chown -R clamav:clamav /var/lib/clamav
+RUN chown -R clamav:clamav /unpriv-init
+
+USER clamav
+
+HEALTHCHECK --start-period=6m CMD clamdcheck.sh
+
+ENTRYPOINT [ "/unpriv-init" ]

images/clamav/scripts/unprivileged-entrypoint.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env sh
+#
+# This script is licensed under the GPL-2.0 (or later) license.
+#
+# Copyright (C) 2021 Olliver Schinagl <[email protected]>
+# Copyright (C) 2021-2023 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
+#
+# The original version of this script can be found at
+# https://github.com/Cisco-Talos/clamav-docker/blob/9ff5b234042d8bc2ca53dfdea83a8576ac9b2822/clamav/1.2/debian/scripts/docker-entrypoint-unprivileged.sh.
+
+set -eu
+
+# run command if it is not starting with a "-" and is an executable in PATH
+if [ "${#}" -gt 0 ] && \
+   [ "${1#-}" = "${1}" ] && \
+   command -v "${1}" > "/dev/null" 2>&1; then
+	# Ensure healthcheck always passes
+	CLAMAV_NO_CLAMD="true" exec "${@}"
+else
+	if [ "${#}" -ge 1 ] && \
+	   [ "${1#-}" != "${1}" ]; then
+		# If an argument starts with "-" pass it to clamd specifically
+		exec clamd "${@}"
+	fi
+	# else default to running clamav's servers
+
+	# Ensure we have some virus data, otherwise clamd refuses to start
+	if [ ! -f "/var/lib/clamav/main.cvd" ]; then
+		echo "Updating initial database"
+		freshclam --foreground --stdout
+	fi
+
+	if [ "${CLAMAV_NO_FRESHCLAMD:-false}" != "true" ]; then
+		echo "Starting Freshclamd"
+		freshclam \
+		          --checks="${FRESHCLAM_CHECKS:-1}" \
+		          --daemon \
+		          --foreground \
+		          --stdout \
+		          --user="clamav" \
+			  &
+	fi
+
+	if [ "${CLAMAV_NO_CLAMD:-false}" != "true" ]; then
+		echo "Starting ClamAV"
+		if [ -S "/tmp/clamd.sock" ]; then
+			unlink "/tmp/clamd.sock"
+		fi
+		clamd --foreground &
+		while [ ! -S "/tmp/clamd.sock" ]; do
+			if [ "${_timeout:=0}" -gt "${CLAMD_STARTUP_TIMEOUT:=1800}" ]; then
+				echo
+				echo "Failed to start clamd"
+				exit 1
+			fi
+			printf "\r%s" "Socket for clamd not found yet, retrying (${_timeout}/${CLAMD_STARTUP_TIMEOUT}) ..."
+			sleep 1
+			_timeout="$((_timeout + 1))"
+		done
+		echo "socket found, clamd started."
+	fi
+
+	if [ "${CLAMAV_NO_MILTERD:-true}" != "true" ]; then
+		echo "Starting clamav milterd"
+		clamav-milter &
+	fi
+
+	# Wait forever (or until canceled)
+	exec tail -f "/dev/null"
+fi
+
+exit 0

terraform/deployments/ecr/main.tf

@@ -47,6 +47,7 @@ locals {
     "github-cli",
     "mongodb",
     "toolbox",
+    "clamav",
     "statsd",
     "govuk-terraform",
     "search-api-learn-to-rank",