Maksim Kabakou - Fotolia
Antivirus and many antimalware tools operate by scanning files against a database of known threats and often perform additional heuristic analysis of those files for potentially unknown threats. In a typical bare-metal or virtualized system, the process of file scanning can take some time and possibly impact workload performance. But malware scanning can pose an even greater performance impact for a system hosting containers.
The problem is shared components. Containers are built from a series of components or layers, such as the Windows base OS package. Those components or layers are typically shared between containers using placeholders -- called reparse points -- to compose each isolated container. When placeholders are read, the reads are redirected to the underlying component. If a container modifies a component, the placeholder is replaced with the modified component.
However, most antimalware tools operate above this level and never see the redirection taking place. Therefore, they have no way of knowing which container components are placeholders and which are modified. As a result, a scanning process can wind up rescanning the same underlying components for every container. This can cause a significant amount of redundant scanning on a host system with many containers. The result is reduced container performance because the same components are getting scanned far more often than they need to be.
It might be possible to avoid redundant scanning by helping antimalware tools "see" whether the container components are placeholders or modified -- new -- elements. Administrators can modify a container volume by attaching a specific extra create parameter to the Create CallbackData flag that receives placeholder information and then checking the ECP redirection flags. If the ECP indicates that a file was opened from a remote or registered layer, antimalware tools can skip the scan. If the ECP indicates that a file was opened from a local package or scratch layer, antimalware tools can scan normally.
Microsoft documentation provides additional details and instructions for this antimalware scanning workaround.
Learn about antimalware protection and endpoint security
Dig Deeper on Application virtualization
Related Q&A from Stephen J. Bigelow
Once part of the gaming industry, GPUs are gaining traction in data center infrastructures. Learn why the power of GPUs makes them fit virtualization... Continue Reading
It's perfectly viable to approach API development using either in-house or SaaS-provided tooling, but each path has its place. Learn how to choose ... Continue Reading
Thinking about applying the OpenAPI Specification to API development? Analyze OpenAPI's automation and standardization benefits and see if it will ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.