Container Image

The maintained image is published on Docker Hub.

Pull an image

docker pull marcocesarato/php-antimalware-scanner:latest

Use latest for an interactive scan of the current stable release. Pin a complete release tag such as 0.19.1 for automated jobs.

Run a report-only scan

Mount the directory to scan as read only. Use a separate output directory for reports so the scanner cannot change the target files:

docker run --rm \
  --volume "/var/www/example:/scan:ro" \
  --volume "$PWD/amwscan-output:/output" \
  marcocesarato/php-antimalware-scanner:latest /scan \
  --lite --report-only --report-format=html \
  --path-report=/output/report.html \
  --disable-checksum --disable-definitions-update

The command writes report.html to amwscan-output. Open it in a browser to review the findings.

Build from source

Build the included image when testing a source checkout. Use --pull --no-cache to fetch the current PHP 8.5 Alpine base and refresh packages rather than reuse an older security-update layer:

docker build --pull --no-cache --tag amwscan .
bash tests/DockerImageTest.sh amwscan

The image upgrades Alpine packages and requires libcurl 8.22.0-r0 or newer and nghttp2-libs 1.70.0-r0 or newer. Until stable Alpine includes the nghttp2 fix, only that library is explicitly selected from a tagged Alpine edge repository; edge is not enabled as a general upgrade source. The unused curl command and extension build dependencies are removed, while PHP's curl extension remains available.

Release builds bypass cached build layers, test both AMD64 and ARM64 images, and scan them before publication. Existing pulled images do not receive package updates automatically: rebuild or pull a newly published image. These version checks address the reported curl and nghttp2 issues, not a guarantee that an image has no vulnerabilities.

Replace the Docker Hub image name in the scan command with amwscan to use the local build.

For CI integrations, see GitHub Actions, Jenkins, or GitLab CI.