ClamAV container does not come up / Malformed Database

[h4fnp]

Steps to reproduce

1. Have ClamAV container enabled
2. Click on Start Containers

Expected behavior

Clam AV container should reach status Running.

Actual behavior

Clam AV container remains in status Starting. It ran fine until the daily backup this morning.

Other information

root@nextcloud:~# uname -a
Linux nextcloud 6.12.31-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.31-1 (2025-06-09) x86_64 GNU/Linux

Output of sudo docker info

root@nextcloud:~# docker info
Client: Docker Engine - Community
 Version:    28.4.0
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.28.0
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.39.4
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 13
  Running: 1
  Paused: 0
  Stopped: 12
 Images: 14
 Server Version: 28.4.0
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: true
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: b98a3aace656320842a23f4a392a33f46af97866
 runc version: v1.3.0-0-g4ca628d1
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.12.31-amd64
 Operating System: Debian GNU/Linux 13 (trixie)
 OSType: linux
 Architecture: x86_64
 CPUs: 4
 Total Memory: 15.29GiB
 Name: nextcloud
 ID: 5d26e202-3824-4a39-82a5-0c7a0406ae70
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  ::1/128
  127.0.0.0/8
 Live Restore Enabled: false

Docker run command or docker-compose file that you used

docker run --init --sig-proxy=false --name nextcloud-aio-mastercontainer --restart always --publish 8080:8080 --volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config --volume /var/run/docker.sock:/var/run/docker.sock:ro --env NEXTCLOUD_DATADIR="/mnt/ncdata" --env APACHE_PORT="11000" --env SKIP_DOMAIN_VALIDATION="true" ghcr.io/nextcloud-releases/all-in-one:latest

Other valuable info

The log reads:

2025-10-20T08:17:25.929253448Z ClamAV 1.4.3/27797/Sun Oct 19 09:52:26 2025
2025-10-20T08:17:25.930479388Z Clamav started
2025-10-20T08:17:26.373308734Z /usr/lib/python3.12/site-packages/supervisor/options.py:13: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
2025-10-20T08:17:26.373363923Z   import pkg_resources
2025-10-20T08:17:27.499857635Z ClamAV update process started at Mon Oct 20 08:17:27 2025
2025-10-20T08:17:27.504803877Z daily.cld database is up-to-date (version: 27797, sigs: 2076974, f-level: 90, builder: svc.clamav-publisher)
2025-10-20T08:17:27.504857890Z main.cvd database is up-to-date (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr)
2025-10-20T08:17:27.504869340Z bytecode.cvd database is up-to-date (version: 339, sigs: 80, f-level: 90, builder: nrandolp)
2025-10-20T08:17:30.556224091Z LibClamAV Error: cli_add_content_match_pattern: Problem adding signature (3).
2025-10-20T08:17:30.556289476Z LibClamAV Error: cli_loadldb: failed to parse subsignature 16 in Win.Trojan.Agent-6949970-1
2025-10-20T08:17:30.556301277Z LibClamAV Error: Problem parsing database at line 60136
2025-10-20T08:17:30.556311716Z LibClamAV Error: Can't load daily.ldb: Malformed database
2025-10-20T08:17:30.556321826Z LibClamAV Error: cli_tgzload: Can't load daily.ldb
2025-10-20T08:17:30.556331826Z LibClamAV Error: Can't load /var/lib/clamav/daily.cld: Malformed database
2025-10-20T08:17:30.556341953Z LibClamAV Error: cli_loaddbdir: error loading database /var/lib/clamav/daily.cld
2025-10-20T08:17:30.556352162Z ERROR: Mon Oct 20 08:17:30 2025 -> Malformed database
2025-10-20T08:17:34.403746818Z LibClamAV Error: cli_add_content_match_pattern: Problem adding signature (3).
2025-10-20T08:17:34.403829149Z LibClamAV Error: cli_loadldb: failed to parse subsignature 16 in Win.Trojan.Agent-6949970-1
2025-10-20T08:17:34.403841740Z LibClamAV Error: Problem parsing database at line 60136
2025-10-20T08:17:34.403852137Z LibClamAV Error: Can't load daily.ldb: Malformed database
2025-10-20T08:17:34.403862305Z LibClamAV Error: cli_tgzload: Can't load daily.ldb
2025-10-20T08:17:34.403872536Z LibClamAV Error: Can't load /var/lib/clamav/daily.cld: Malformed database
2025-10-20T08:17:34.403882783Z LibClamAV Error: cli_loaddbdir: error loading database /var/lib/clamav/daily.cld
2025-10-20T08:17:34.403893054Z ERROR: Mon Oct 20 08:17:34 2025 -> Malformed database
...

The last 8 lines keep repeating until one stops the container.

The container should either be able to resolve this situation by itself or the documentation should contain some hint how to resolve this issue.

[h4fnp]

Steps to resolve the issue:

# Connect to the docker host via ssh
ssh my-aio-nextcloud-host.tld
# Get a shell on the ClamAV container:
docker exec -it nextcloud-aio-clamav sh
# Remove the malformed database:
rm /var/lib/clamav/daily.cld
# Run freshclam to download the database
freshclam --show-progress

Although, this solves the issue for me, others might stumble above that, too. Therefore I again recommend to add some handling to the container or at least extend the documentation to cover this issue.

[szaimen]

Hey, thanks for the idea! I created #7017 now. Feedback is welcome!