DevShield for Linux

0.3.0 adds --quick-scan to inspect running process executables only, using the installed ClamAV signatures. Actionable detections are terminated and host binaries are quarantined through the existing conservative response. It requires root and can interrupt services. Runtime depends on the number and size of unique process executables and may take longer than a few seconds.

0.2.1 fixes custom scan-limit propagation: --max-filesize-mb, --max-scansize-mb, and --max-files now apply to running-process snapshots as well as filesystem/container scans.

Quick scan and process response

Quick process scan: run sudo /opt/devshield/bin/devshield --quick-scan. It inspects running process executables only using the local ClamAV database, then exits without scanning host folders or Docker. Actionable signature detections use the existing conservative response: preserve evidence, terminate the process, and quarantine the matching host binary. This requires root and Python/Linux pidfd support. It may take longer than a few seconds depending on process count and executable sizes. Update signatures separately with sudo freshclam or your distribution's database updater.

sudo /opt/devshield/bin/devshield --remediate-running first snapshots and scans running executables, sends SIGKILL to signature-detected processes, and attempts to move matching host executables into /var/lib/devshield/quarantine. It then scans host files and Docker data. Without this flag, scanning remains read-only. This is an experimental opt-in response mode and can interrupt production services. Process response currently requires root and Python/Linux pidfd support (normally Python 3.9+ and Linux 5.3+).

Heuristic, PUA, encrypted-content, scan-limit and EICAR test alerts never trigger automatic process response. Evidence copies and action records are saved before termination. PID 1, DevShield and its ancestors are excluded. Original-file moves require a matching inode and a same-filesystem rename; failures are reported rather than falling back to destructive copy/delete. Container executables are not moved: rebuild affected containers from trusted images. Supervisors may restart terminated processes. Script interpreters, injected code, memory-only malware and persistence are not comprehensively inspected, and files found during the subsequent host/container scan are not automatically removed. Quarantine samples must not be executed. Quarantine is excluded from later scans.

--max-files 200000 raises the archive member-count limit when needed. Increasing limits raises resource use. A privileged attacker can still evade or interfere with live-host inspection. There is no guarantee of complete malware removal.

The Python distribution is devshield-scanner; the command is devshield. Version 0.3.0 adds devshield --quick-scan, which scans running process executables only and uses the conservative process response for actionable ClamAV signature detections. See INSTALL.md for installation and upgrade instructions. devshield --version displays the installed CLI version.

Version 0.1.1 enables ClamAV scan-limit alerts and marks zero-data scans, missing summaries and logged warnings/errors as incomplete coverage (exit 2), even when ClamAV returns 0. Limit alerts are not proof of malware. Optional --max-filesize-mb and --max-scansize-mb override engine limits in MB. Increasing limits can increase memory, CPU and runtime; engine hard limits still apply. A positive data count alone does not prove every archive entry was inspected.

Read-only host and Docker filesystem malware scanning using the locally installed ClamAV signature engine. Requires Linux, Python 3.8+, clamscan, updated ClamAV databases, and the Docker CLI for container scanning. Run on the Docker host with a local Unix socket context. Root access normally provides the required file/socket access.

On Debian/Ubuntu, install prerequisites using your normal package-management policy:

sudo apt-get update
sudo apt-get install python3 clamav clamav-freshclam

Ensure the ClamAV databases have downloaded before scanning. Use your distribution's freshclam service, or sudo freshclam if that service is not already managing updates. The scanner does not install software, change services, or update databases automatically. Docker must already be installed if you use it.

Copy this folder onto the server, then run:

sudo python3 devshield_linux.py

# Process-only signature scan and response
sudo python3 devshield_linux.py --quick-scan

Console messages identify each stage and show a heartbeat every 10 seconds during long scans. Verbose file-level progress is saved to each stage's log; inspect a log with tail -f /path/printed/by/script.log. JSON results are checkpointed after every completed scan and on interruption, under /var/log/devshield/<run>/report.json.

# Check a small directory first
sudo python3 devshield_linux.py --host-root /srv/project --skip-docker

# Containers and volumes only
sudo python3 devshield_linux.py --skip-host

# Use a scratch disk with room for the largest container filesystem export
sudo python3 devshield_linux.py --temp-dir /mnt/scratch --heartbeat 5

Host scanning starts at / and traverses mounted filesystems, including potentially slow network mounts. /proc, /sys, /dev, /run, raw default Docker/containerd storage, the report directory and scratch directory are excluded. No symlinks are followed. Custom Docker storage may be scanned twice. Logs can be large and contain private file paths; keep them private.

For each running container the script uses docker export, scans the resulting TAR as an archive, then deletes only its own temporary export. It does not execute programs inside containers, extract archives, stop containers or change their files. It separately scans bind-mount sources and discovered Docker volumes, including unused volumes. Remote daemons are rejected. Volume plugins/network-backed volumes may need separate mounting and scanning. If using a local socket proxy to a remote daemon, do not use this script: mount paths must refer to this machine.

Stopped containers, unused image layers, RAM, kernel state and rootkits are not covered. ClamAV's configured/default size, archive and recursion limits still apply, including to large container TAR exports; a successful scan can miss content past those limits. Review ClamAV summaries and warnings in every log. This is a best-effort filesystem scan, not a comprehensive compromise assessment. Live files can change during scanning. Use a trusted rescue environment for suspected root-level compromise.

Exit status: 0 = no signature detections reported and no recorded orchestration errors; 1 = detections; 2 = incomplete/error (detections may also exist; always inspect the report). The default scan is read-only. --quick-scan and --remediate-running can terminate detected processes and quarantine matching host executables. Reports persist if Docker scanning fails or the scan is interrupted with Ctrl+C. A forced kill or power loss may lose the active stage, but earlier checkpoints remain.

Validation on the development Windows machine covers syntax and mocked orchestration only. A real Linux/Docker/ClamAV integration scan must be validated on your server before operational use.