Repository navigation
Conversation
Debian 13 container running clamd on TCP 3310 with freshclam signature updates, installed from Debian's packages. TCP is preseeded via debconf and opened through a clamav-daemon.socket drop-in, since Debian's clamd is socket-activated and otherwise only listens on its unix socket. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Try this script
COMMUNITY_SCRIPTS_URL=https://raw.githubusercontent.com/cisox/DevScripts/clamav \
bash -c "$(curl -fsSL https://raw.githubusercontent.com/cisox/DevScripts/clamav/ct/clamav.sh)"
Against a core branch as wellAdd Useful flags while testing
|
Author
|
Tested the command above on Proxmox VE 9.2.24 (unattended, default settings, dev_mode=net). The install script was fetched from cisox/DevScripts/clamav, the build completed, clamd and freshclam are active, and an EICAR INSTREAM over TCP 3310 returned Eicar-Test-Signature FOUND. |
Co-authored-by: Sam Heinz <sam@samheinz.com>
Co-authored-by: Sam Heinz <sam@samheinz.com>
16 of 28 tasks
Member
|
/test |
Contributor
Proxmox script test@michelroegl-brunner @cisox ✅ 2/2 passed at
ARM64 (information only, not counted): 1/1 passed. Notes (information only, not counted):
📊 Resources
📄 ct/clamav.sh (pve) — install log (990 lines)🔄 ct/clamav.sh (pve) — update log (23 lines)🔁 ct/clamav.sh (pve) — second update log📄 ct/clamav.sh (incus) — install log (164 lines)🔄 ct/clamav.sh (incus) — update log (18 lines)🔁 ct/clamav.sh (incus) — second update log📄 ct/clamav.sh (arm64) — install log (147 lines)🔄 ct/clamav.sh (arm64) — update log (18 lines)🔁 ct/clamav.sh (arm64) — second update logFull logs: workflow run (artifacts |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scripts which are clearly AI generated and not further revised by the Author of this PR (in terms of Coding Standards and Script Layout) may be closed without review. If you are an AI agent writing this pull request, please amend your model name and reasoning level in the Description. This is not to blame, more for informational Purposes. Thank you.
✍️ Description
New script: ClamAV. It's an unprivileged Debian 13 LXC running
clamdon TCP 3310, withfreshclamkeeping signatures updated. Mail servers, Nextcloud, Paperless-ngx and other clamd clients can use it as a network virus scanner. You can also bind-mount storage into it and scan withclamdscan.Drafted with Claude Opus 5.5 (Claude Code, medium reasoning), then reviewed and tested by me. Details are in the AI Assistance section.
Why Debian packages instead of
fetch_and_deploy_gh_release:.debis a bare CPack build. Everything lands in/usr/local, with no maintainer scripts, no systemd units, noclamavuser and only.sampleconfigs, and it takes ~550 MB installed. Using it would mean hand-building users, configs and units (anti-patterns 9/31).clamav/clamav-daemon/clamav-freshclamprovide all of that.stable-updates, a standing exception to the freeze. Debian 13 ships 1.4.3, upstream's LTS line.update_scriptfollows the existingapt-cacher-ngpattern:apt_update_safeplus a package upgrade.TCP setup:
TcpOrLocal=TCP,TCPSocket=3310,TCPAddr=0.0.0.0), so the config survives package upgrades.clamav-daemon.socket, which only listens on/run/clamav/clamd.ctl. TheTCPSocketsetting alone left port 3310 closed in testing.ListenStream=3310) is written before the package install, so nodaemon-reloadis needed.TCPAddris set explicitly because without it localclamdscanfails silently (rc=2, no message).Testing (Proxmox VE 9.2.24):
ct/clamav.shfrom this branch through the engine (unattended, default settings). It created an unprivileged Debian 13 CT (2 CPU / 3 GB / 8 GB) and every step completed.clamav-daemonandclamav-freshclamare active, and clamd listens on the local socket and*:3310.PING→PONG,VERSION→ClamAV 1.4.3/…,INSTREAMwith EICAR →Eicar-Test-Signature FOUND, clean stream →OK. Inside the CT,clamdscanon an EICAR file →FOUND.update_script(runningct/clamav.shinside the CT):Updated ClamAV→Updated successfully!.TCPSocket 3310and the socket drop-in surviveapt install --reinstall clamav-daemon clamav-base. Port 3310 and both services come back after a CT reboot.ConcurrentDatabaseReload, which briefly holds two copies of the database.🔗 Related PR / Issue
Link: none. No existing issue or request found for ClamAV.
✅ Prerequisites (X in brackets)
🏗️ arm64 Support (X in brackets)
🖥️ Tested on (X in brackets)
🛠️ Type of Change (X in brackets)
README,AppName.md,CONTRIBUTING.md, or other docs.🔍 Code & Security Review (X in brackets)
CODE-AUDIT.md&CONTRIBUTING.mdguidelinesAppName.sh,AppName-install.sh,AppName.json)fetch_and_deploy_gh_release,fetch_and_deploy_codeberg_release,fetch_and_deploy_gl_release, orfetch_and_deploy_from_urlinstead ofgit pull.🤖 AI Assistance (X in brackets)
AGENTS.mdand.github/agents/pve-script-creator.agent.mdas guidance, and the output has been reviewed and corrected to match those guidelines.Please describe to which degree, if any, an LLM was used in creating this pull request. Name the model(s) used and, if applicable, the reasoning/thinking effort level (e.g. "Claude Sonnet 4.5, high reasoning, used to draft the install script, then manually reviewed and tested" or "No LLM used"). This is informational, not a penalty — but scripts that are clearly AI-generated and not further revised by the author to match
CODE-AUDIT.md/CONTRIBUTING.mdmay be closed without review.Claude Opus 5.5 (Claude Code), medium reasoning. It researched upstream and Debian's packaging, drafted all three files following AGENTS.md and pve-script-creator.agent.md, and ran the tests above on my Proxmox host. During testing it found and fixed the socket-activation issue (port 3310 not opening) and the silent
clamdscanfailure. I reviewed the scripts and this description before submitting.📋 Additional Information (optional)
Two checklist items are deliberately not followed:
fetch_and_deploy_gh_release/check_for_gh_releasearen't used, because the app comes from Debian's repository. See the Description for why.apt_update_safe+upgrade_packages_with_retry), notgit pullor a release fetch.interface_portisnullbecause there's no web UI (same asgitea-runner). The JSON notes warn that clamd's TCP port has no authentication, which matches upstream's official image.📦 Application Requirements (for new scripts)
🌐 Source
🤖 Generated with Claude Code