meles

About

A malware scanner for container images that pulls images straight from the registry without a Docker daemon and scans every layer separately with ClamAV and YARA. Because layers are scanned individually, a file deleted by a later layer is still found. It also runs in Kubernetes as an operator that scans every pod image, with an optional gate that holds new pods until their image is scanned.