How to check a docker container for malware?

Question

open source

Hello. I read an article on habré on creating a voice assistant through alphacephei.com vosk, I searched on Google about this company and found nothing except their website, the question arose of how safe it is to use their docker image and their python module? And then the question arose of how to generally detect malicious software distributed through a docker hub or pypi?

Answer 1

No way. All public repositories are dangerous. In the case of PyPI, only personally check the source code of each version. Docker is even more difficult.

Answer 2

At a minimum, you should use off-source images from developers.

Answer 3

You can check with ClamAV antivirus, also try running the container in the sandbox and see if it does anything wrong. And if you open the source, you can build the program yourself, but it should be noted that even open source code without verification can be dangerous (although I don’t think anyone will substitute it).