Description of general container scan settings
December 12, 2023
ID 234889
This section describes the values of the general container and namespace scan settings (see the table below). Integration with Docker container management system, CRI-O framework, and Podman and runc utilities is supported.
The application does not scan namespaces and containers unless components for working with containers and namespaces are installed in the operating system. Moreover, when viewing application information in the Container monitoring row, "The task is available and not running" is displayed. Namespace and container scans can be enabled using the NamespaceMonitoring setting described in the general application settings.
General container and namespace scan settings
Setting | Description | Values |
|---|---|---|
| Action to be performed on a container when an infected object is detected. This setting is available when using the application under a license that supports this function. For scanning, the settings of the File Threat Protection task are used. The action performed on a container when an infected object is detected also depends on the File Threat Protection task settings (see the table below). |
|
| Use the Docker environment. |
|
| Docker socket path or URI (Universal Resource Identifier). | Default value: /var/run/docker.sock. |
| Use the CRI-O environment. |
|
| Path to the CRI-O configuration file. | Default value: /etc/crio/crio.conf. |
| Use the Podman utility. |
|
| Path to the Podman utility executable file. | Default value: /usr/bin/podman. |
| Path to the root directory of the container storage. | Default value: /var/lib/containers/storage. |
| Use the runc utility. |
|
| Path to the runc utility executable file. | Default value: /usr/bin/runc. |
| Path to the root directory of the container state storage. | Default value: /run/runc-ctrs. |
Actions performed on a container when an infected object is detected may vary depending on the specified values of the FirstAction and SecondAction settings of the File Threat Protection task and on the value of the InterceptorProtectionMode setting, one of the general application settings (see the table below).
Dependence of actions performed on containers on the specified actions performed on infected objects
Value of the FirstAction / SecondAction or the InterceptorProtectionMode setting | Action performed on the container when the StopContainerIfFailed action is selected |
|---|---|
| Stop the container if disinfection of an infected object fails. |
| Stop the container if an infected object removal fails. |
| Do not perform any action on containers when an infected object is detected. |
