Memory usage?

[aznarepse]

I am guessing the daemon needs considerable memory to hold the virus signatures but the container alpine-edge is using 1.3G RAM. Is this normal?

[mko-x]

ClamAV holds the search strings using the classic string (Boyer Moore) and regular expression (Aho Corasick) algorithms. Being algorithms from the 1970s they are extemely memory efficient.

The problem is the huge number of virus signatures. This leads to the algorithms' datastructures growing quite large.

You can't send those datastructures to swap, as there are no parts of the algorithms' datastructures accessed less often than other parts. If you do force pages of them to swap disk, then they'll be referenced moments later and just swap straight back in. (Technically we say "the random access of the datastructure forces the entire datastructure to be in the process's working set of memory".)

The datastructures are needed if you are scanning from the command line or scanning from a daemon.

You can't use just a portion of the virus signatures, as you don't get to choose which viruses you will be sent, and thus can't tell which signatures you will need.

From: https://unix.stackexchange.com/questions/114709/how-to-reduce-clamav-memory-usage

[mko-x]

This repo is only for making ClamAV work with docker.

Performance issues should be questioned to ClamAV or Alpine directly.

In general an increase of ram allocation on startup of the image is usual.

You could dive into memory consumption inside the image with top, Lime or Votality or other tools and report your results.