https://github.com/malwaredb/docker
Dockerfiles for MalwareDB, and Postgres with our similarity extensions
https://github.com/malwaredb/docker
dockerfile hacktoberfest postgres postgresql similarity-measures
Last synced: 4 months ago
JSON representation
Dockerfiles for MalwareDB, and Postgres with our similarity extensions
- Host: GitHub
- URL: https://github.com/malwaredb/docker
- Owner: malwaredb
- License: apache-2.0
- Created: 2023-07-17T04:36:54.000Z (over 2 years ago)
- Default Branch: main
- Last Pushed: 2025-09-09T02:06:46.000Z (5 months ago)
- Last Synced: 2025-09-09T04:00:44.339Z (5 months ago)
- Topics: dockerfile, hacktoberfest, postgres, postgresql, similarity-measures
- Language: Shell
- Homepage: https://malwaredb.net/
- Size: 58.6 KB
- Stars: 2
- Watchers: 2
- Forks: 2
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
- Funding: .github/FUNDING.yml
- License: LICENSE
- Codeowners: .github/CODEOWNERS
Awesome Lists containing this project
README
## Dockerfile for MalwareDB
There are two Dockerfiles:
* `MalwareDB/Dockerfile` builds a container with both Postgres with the extensions and MalwareDB.
* `Postgres/Dockerfile` builds Postgres only with the extensions. This is for installations where MalwareDB should be separate from the database, or by those who'd like to use the similarity extensions.
Both use Postgres 15 from Debian 12 Bookworm.
### Postgres Extensions
Postgres is installed, and extensions built with extensions for:
* [LZJD](https://github.com/malwaredb/LZJD)
* [SSDeep](https://github.com/malwaredb/ssdeep_psql)
* [SDHash](https://github.com/malwaredb/sdhash_psql)
* [TLSH](https://github.com/malwaredb/tlsh_pg)
To use the extensions, __you__ have to add them to __each__ database schema you wish to use them as the schema owner, or as the `postgres` user. SQL commands:
* `CREATE OR REPLACE FUNCTION lzjd_compare(TEXT, TEXT) RETURNS INTEGER AS 'lzjd_psql.so', 'pg_lzjd_compare' LANGUAGE 'c';`
* `CREATE OR REPLACE FUNCTION fuzzy_hash_compare(TEXT, TEXT) RETURNS INTEGER AS 'ssdeep_psql.so', 'pg_fuzzy_hash_compare' LANGUAGE 'c';`
* `CREATE OR REPLACE FUNCTION sdhash_compare(TEXT, TEXT) RETURNS INTEGER AS 'sdhash_psql.so', 'pg_sdhash_compare' LANGUAGE 'c';`
* `CREATE OR REPLACE FUNCTION tlsh_compare(TEXT, TEXT) RETURNS INTEGER AS 'tlsh_psql.so', 'pg_tlsh_compare' LANGUAGE 'c';`
Be sure to set the admin password for Postgres via the `POSTGRES_PASSWORD` environment variable, shown below.
```
$ git clone https://github.com/malwaredb/docker.git
$ cd docker/Postgres
$ docker build -t postgres-similarity/latest .
$ mkdir pg_data
$ docker run -v `pwd`/pg_data:/var/lib/postgresql/data -p 5432:5432 -e POSTGRES_PASSWORD=yoursecurepassword postgres-similarity/latest
```
### MalwareDB
The images are about ~4GB, could probably be smaller. The SQL commands for adding the fuzzy hash functions above are added by the `start.sh` script at container start. The Postgres server won't be accessible outside the container.
You should use this with an existing Postgres data instance so you can have the administrative settings in order (users, groups, sources). At present, the administrative functions aren't available over the HTTP API.
```
$ git clone https://github.com/malwaredb/docker.git
$ cd docker/MalwareDB
$ docker build -t malwaredb/latest .
$ mkdir mdb_data
$ mkdir mdb_data/db
$ mkdir mdb_data/samples
$ docker run -v `pwd`/mdb_data/db:/var/lib/postgresql/data -v `pwd`/samples:/malware_samples -p 8080:8080 malwaredb/latest
```