Antivirus scanning architecture for uploaded files
Provided is a system and method which perform an antivirus scan of incoming files via a file management application of a file system. Infected files can be prevented from being stored to the file system. In one example, the method may include receiving, via a first application contained in a first data container, a data file that is uploaded for storage to a file system, storing the data file in a temporary storage, transmitting a location of the data file in the temporary storage to a second application contained in a second data container, and receiving, via the first application contained in the first data container, a response from the second application contained in the second container, indicating results of a security scan performed on the data file.
1 . A computing system comprising:
a non-transitory computer-readable medium comprising computer-executable instructions;
a processor configured to access the computer-executable instructions and to:
execute a first containerized application within a pod of a host platform, the pod including a persistent volume (PV);
execute a second containerized application within the pod of the host platform in parallel with the first containerized application, wherein the second containerized application is distinct from the first containerized application;
establish a direct communication channel between a transmission control protocol (TCP) socket of a container of the first containerized application and a TCP socket of a container of the second containerized application within the pod; and
exchange data between the first and second containerized applications via the established socket-to-socket communication channel directly between the first and second containerized applications during execution of the first and second containerized applications;
wherein the PV of the pod is separate from and accessible by each of the first containerized application and the second containerized application; and
wherein the processor is further configured to read a file from a storage location within the PV via the second containerized application, scan the file, and determine a status for the file based on the scan.
2 . The computing system of claim 1 , wherein the processor is further configured to open the TCP socket on the container of the first containerized application within the pod and open the TCP socket on the container of the second containerized application within the pod, prior to establishing the communication channel.
3 . The computing system of claim 1 , wherein the processor is configured to establish the communication channel based on an IP address of the TCP socket of the container of the first containerized application and an IP address of the TCP socket of the container of the second containerized application.
4 . The computing system of claim 1 , wherein the processor is further configured to establish the communication channel based on a port number of the TCP socket of the container of the first containerized application and a port number of the TCP socket of the container of the second containerized application.
5 . The computing system of claim 1 , wherein the processor is further configured to provision the PV within the pod, wherein the PV comprises a file store.
6 . The computing system of claim 5 , wherein the processor is further configured to transfer a file from the first containerized application to a storage location within the PV, and transmit an identifier of the storage location of the file within the PV to the second containerized application via the established communication channel.
7 . The computing system of claim 1 , wherein the processor is configured to generate a log of the data that is exchanged between the first and second containerized applications and store the log within the pod.
8 . A method comprising:
executing a first containerized application within a pod of a host platform, the pod including a persistent volume (PV);
executing a second containerized application within the pod of the host platform in parallel with the first containerized application, wherein the second containerized application is distinct from the first containerized application;
establishing a direct communication channel between a transmission control protocol (TCP) socket of a container of the first containerized application and a TCP socket of a container of the second containerized application within the pod; and
exchanging data between the first and second containerized applications via the established socket-to-socket communication channel directly between the first and second containerized applications during execution of the first and second containerized applications;
wherein the PV of the pod is separate from and accessible by each of the first containerized application and the second containerized application; and
wherein the processor is further configured to read a file from a storage location within the PV via the second containerized application, scan the file, and determine a status for the file based on the scan.
9 . The method of claim 8 , wherein the method further comprises opening the TCP socket on the container of the first containerized application within the pod and opening the TCP socket on the container of the second containerized application within the pod, prior to establishing the communication channel.
10 . The method of claim 8 , wherein the establishing comprises establishing the communication channel based on an IP address of the TCP socket of the container of the first containerized application and an IP address of the TCP socket of the container of the second containerized application.
11 . The method of claim 8 , wherein the establishing comprises establishing the communication channel based on a port number of the TCP socket of the container of the first containerized application and a port number of the TCP socket of the container of the second containerized application.
12 . The method of claim 8 , wherein the method further comprises provisioning the PV within the pod, wherein the PV comprises a file store.
13 . The method of claim 12 , wherein the processor is further configured to transfer a file from the first containerized application to a storage location within the PV, and transmit an identifier of the storage location of the file within the PV to the second containerized application via the established communication channel.
14 . The method of claim 8 , wherein the processor is configured to generate a log of the data that is exchanged between the first and second containerized applications and store the log within the pod.
15 . A non-transitory computer-readable medium comprising instruction which when executed by a processor cause a computer to perform a method comprising:
executing a first containerized application within a pod of a host platform, the pod including a persistent volume (PV);
executing a second containerized application within the pod of the host platform in parallel with the first containerized application, wherein the second containerized application is distinct from the first containerized application;
establishing a direct communication channel between a transmission control protocol (TCP) socket of a container of the first containerized application and a TCP socket of a container of the second containerized application within the pod; and
exchanging data between the first and second containerized applications via the established socket-to-socket communication channel directly between the first and second containerized applications during execution of the first and second containerized applications;
wherein the PV of the pod is separate from and accessible by each of the first containerized application and the second containerized application; and
wherein the processor is further configured to read a file from a storage location within the PV via the second containerized application, scan the file, and determine a status for the file based on the scan.
16 . The non-transitory computer-readable medium of claim 15 , wherein the method further comprises opening the TCP socket on the container of the first containerized application within the pod and opening the TCP socket on the container of the second containerized application within the pod, prior to establishing the communication channel.
17 . The non-transitory computer-readable medium of claim 15 , wherein the establishing comprises establishing the communication channel based on an IP address of the TCP socket of the container of the first containerized application and an IP address of the TCP socket of the container of the second containerized application.