diff --git a/docker/amavis/rootfs/etc/amavisd/amavisd.conf b/docker/amavis/rootfs/etc/amavisd/amavisd.conf
index 23d076ce..9f9f1e32 100644
--- a/docker/amavis/rootfs/etc/amavisd/amavisd.conf
+++ b/docker/amavis/rootfs/etc/amavisd/amavisd.conf
@@ -1,437 +1,436 @@
 use strict;
 
 # a minimalistic configuration file for amavisd-new with all necessary settings
 #
 #   see amavisd.conf-default for a list of all variables with their defaults;
 #   see amavisd.conf-sample for a traditional-style commented file;
 #   for more details see documentation in INSTALL, README_FILES/*
 #   and at http://www.ijs.si/software/amavisd/amavisd-new-docs.html
 
 
 # COMMONLY ADJUSTED SETTINGS:
 
 # @bypass_virus_checks_maps = (1);  # controls running of anti-virus code
 # @bypass_spam_checks_maps  = (1);  # controls running of anti-spam code
 # $bypass_decode_parts = 1;         # controls running of decoders&dearchivers
 
 $max_servers = 2;            # num of pre-forked children (2..30 is common), -m
 $daemon_user  = 'amavis';     # (no default;  customary: vscan or amavis), -u
 $daemon_group = 'amavis';     # (no default;  customary: vscan or amavis), -g
 
 $mydomain = 'APP_DOMAIN';   # a convenient default for other settings
 $myhostname = 'APP_DOMAIN';   # a convenient default for other settings
 
 $MYHOME = '/var/spool/amavisd';   # a convenient default for other settings, -H
 $TEMPBASE = "$MYHOME/tmp";   # working directory, needs to exist, -T
 $ENV{TMPDIR} = $TEMPBASE;    # environment variable TMPDIR, used by SA, etc.
 $QUARANTINEDIR = undef;      # -Q
 # $quarantine_subdir_levels = 1;  # add level of subdirs to disperse quarantine
 # $release_format = 'resend';     # 'attach', 'plain', 'resend'
 # $report_format  = 'arf';        # 'attach', 'plain', 'resend', 'arf'
 
 # $daemon_chroot_dir = $MYHOME;   # chroot directory or undef, -R
 
 $db_home   = "$MYHOME/db";        # dir for bdb nanny/cache/snmp databases, -D
 # $helpers_home = "$MYHOME/var";  # working directory for SpamAssassin, -S
 $lock_file = "/var/run/amavisd/amavisd.lock";  # -L
 $pid_file  = "/var/run/amavisd/amavisd.pid";   # -P
 #NOTE: create directories $MYHOME/tmp, $MYHOME/var, $MYHOME/db manually
 
 $log_level = 9;              # verbosity 0..5, -d
 $log_recip_templ = undef;    # disable by-recipient level-0 log entries
            # choose from: emerg, alert, crit, err, warning, notice, info, debug
 
 $enable_db = 1;              # enable use of BerkeleyDB/libdb (SNMP and nanny)
 $enable_global_cache = 1;    # enable use of libdb-based cache if $enable_db=1
 $nanny_details_level = 2;    # nanny verbosity: 1: traditional, 2: detailed
 $enable_dkim_verification = 1;  # enable DKIM signatures verification
 $enable_dkim_signing = 1;    # load DKIM signing code, keys defined by dkim_key
 
 
 dkim_key(
     'APP_DOMAIN',
     'DKIM_KEY',
     '/var/dkim/APP_DOMAIN.DKIM_KEY.pem'
     );
   @dkim_signature_options_bysender_maps = ( {
     "APP_DOMAIN" => {
       d   => 'APP_DOMAIN',
       a   => 'rsa-sha256',
       c   => 'relaxed/simple',
       ttl => 10*24*3600
       }
     } );
 
 # $enable_ldap = 1;
 # $default_ldap = {
 # 		hostname => [ 'localhost' ],
 # 		version => 3,
 # 		timeout => 5,
 # 		tls => 0,
 # 		base => '$ldap_base_dn',
 # 		query_filter => '$ldap_filter',
 # 		bind_dn => '$ldap_bind_dn',
 # 		bind_password => '$ldap_bind_pw'
 # 	};
 #
 #FIXME
 # @lookup_sql_dsn = (
 #     ['DBI:mysql:database=vimbadmin;host=127.0.0.1;port=3306',
 #      'vimbadmin',
 #      'password']);
 
 # $sql_select_policy = 'SELECT domain FROM domain WHERE CONCAT("@",domain) IN (%k)';
 
 @local_domains_maps = ( [".$mydomain"] );  # list of all local domains
 
 @mynetworks = qw( 127.0.0.0/8 [::1] [FE80::]/10 [FEC0::]/10
                   10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 );
 
 $unix_socketname = "$MYHOME/amavisd.sock";  # amavisd-release or amavis-milter
                # option(s) -p overrides $inet_socket_port and $unix_socketname
 
 $inet_socket_port = [13024,13026];   # listen on this local TCP port(s)
 $inet_socket_bind = '0.0.0.0';
 
 @inet_acl = qw(127.0.0.1 [::1] 172.16.0.0/12);
 
 $policy_bank{'MYNETS'} = {   # mail originating from @mynetworks
   originating => 1,  # is true in MYNETS by default, but let's make it explicit
   os_fingerprint_method => undef,  # don't query p0f for internal clients
 };
 
 # it is up to MTA to re-route mail from authenticated roaming users or
 # from internal hosts to a dedicated TCP port (such as 10026) for filtering
 $interface_policy{'13026'} = 'ORIGINATING';
 $policy_bank{'ORIGINATING'} = {  # mail supposedly originating from our users
   originating => 1,  # declare that mail was submitted by our smtp client
   allow_disclaimers => 1,  # enables disclaimer insertion if available
   # notify administrator of locally originating malware
   #virus_admin_maps => ["admin\@$mydomain"],
   #spam_admin_maps  => ["admin\@$mydomain"],
   virus_admin_maps => undef,
   spam_admin_maps  => undef,
   warnbadhsender   => 1,
   # forward to a smtpd service providing DKIM signing service
   forward_method => 'smtp:[postfix]:13025',
   # force MTA conversion to 7-bit (e.g. before DKIM signing)
   smtpd_discard_ehlo_keywords => ['8BITMIME'],
   bypass_banned_checks_maps => [1],  # allow sending any file names and types
   terminate_dsn_on_notify_success => 0,  # don't remove NOTIFY=SUCCESS option
 };
 
 $interface_policy{'SOCK'} = 'AM.PDP-SOCK'; # only applies with $unix_socketname
 
 # Use with amavis-release over a socket or with Petr Rehor's amavis-milter.c
 # (with amavis-milter.c from this package or old amavis.c client use 'AM.CL'):
 $policy_bank{'AM.PDP-SOCK'} = {
   protocol => 'AM.PDP',
   auth_required_release => 0,  # do not require secret_id for amavisd-release
 };
 
 $sa_tag_level_deflt  = -999;  # add spam info headers if at, or above that level. We always add spam headers, since that includes our dkim validation results
 $sa_tag2_level_deflt = 6.2;  # add 'spam detected' headers at that level
 $sa_kill_level_deflt = 6.9;  # triggers spam evasive actions (e.g. blocks mail)
 $sa_dsn_cutoff_level = 10;   # spam level beyond which a DSN is not sent
 $sa_crediblefrom_dsn_cutoff_level = 18; # likewise, but for a likely valid From
 # $sa_quarantine_cutoff_level = 25; # spam level beyond which quarantine is off
 $penpals_bonus_score = 8;    # (no effect without a @storage_sql_dsn database)
 $penpals_threshold_high = $sa_kill_level_deflt;  # don't waste time on hi spam
 $bounce_killer_score = 100;  # spam score points to add for joe-jobbed bounces
 
 $sa_mail_body_size_limit = 400*1024; # don't waste time on SA if mail is larger
 $sa_local_tests_only = 0;    # only tests which do not require internet access?
 
 # @lookup_sql_dsn =
 #   ( ['DBI:mysql:database=mail;host=127.0.0.1;port=3306', 'user1', 'passwd1'],
 #     ['DBI:mysql:database=mail;host=host2', 'username2', 'password2'],
 #     ["DBI:SQLite:dbname=$MYHOME/sql/mail_prefs.sqlite", '', ''] );
 # @storage_sql_dsn = @lookup_sql_dsn;  # none, same, or separate database
 
 # $timestamp_fmt_mysql = 1; # if using MySQL *and* msgs.time_iso is TIMESTAMP;
 #   defaults to 0, which is good for non-MySQL or if msgs.time_iso is CHAR(16)
 
 $virus_admin               = undef;                    # notifications recip.
 
 $mailfrom_notify_admin     = undef;                    # notifications sender
 $mailfrom_notify_recip     = undef;                    # notifications sender
 $mailfrom_notify_spamadmin = undef;                    # notifications sender
 $mailfrom_to_quarantine = ''; # null return path; uses original sender if undef
 
 @addr_extension_virus_maps      = ('virus');
 @addr_extension_banned_maps     = ('banned');
 @addr_extension_spam_maps       = ('spam');
 @addr_extension_bad_header_maps = ('badh');
 # $recipient_delimiter = '+';  # undef disables address extensions altogether
 # when enabling addr extensions do also Postfix/main.cf: recipient_delimiter=+
 
 $path = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin';
 # $dspam = 'dspam';
 
 $MAXLEVELS = 14;
 $MAXFILES = 1500;
 $MIN_EXPANSION_QUOTA =      100*1024;  # bytes  (default undef, not enforced)
 $MAX_EXPANSION_QUOTA = 300*1024*1024;  # bytes  (default undef, not enforced)
 
 $sa_spam_subject_tag = '***SPAM*** ';
 $defang_virus  = 1;  # MIME-wrap passed infected mail
 $defang_banned = 1;  # MIME-wrap passed mail containing banned name
 # for defanging bad headers only turn on certain minor contents categories:
 $defang_by_ccat{+CC_BADH.",3"} = 1;  # NUL or CR character in header
 $defang_by_ccat{+CC_BADH.",5"} = 1;  # header line longer than 998 characters
 $defang_by_ccat{+CC_BADH.",6"} = 1;  # header field syntax error
 
 
 # OTHER MORE COMMON SETTINGS (defaults may suffice):
 
 # $myhostname = 'host.example.com';  # must be a fully-qualified domain name!
 
 $notify_method  = 'smtp:[postfix]:13025';
 $forward_method = 'smtp:[postfix]:13025';  # set to undef with milter!
 
 $final_virus_destiny      = D_DISCARD;
 $final_banned_destiny     = D_BOUNCE;
 $final_spam_destiny       = D_DISCARD;
 $final_bad_header_destiny = D_BOUNCE;
 # $bad_header_quarantine_method = undef;
 
 # $os_fingerprint_method = 'p0f:*:2345';  # to query p0f-analyzer.pl
 
 ## hierarchy by which a final setting is chosen:
 ##   policy bank (based on port or IP address) -> *_by_ccat
 ##   *_by_ccat (based on mail contents) -> *_maps
 ##   *_maps (based on recipient address) -> final configuration value
 
 
 # SOME OTHER VARIABLES WORTH CONSIDERING (see amavisd.conf-default for all)
 
 # $warnbadhsender,
 # $warnvirusrecip, $warnbannedrecip, $warnbadhrecip, (or @warn*recip_maps)
 #
 # @bypass_virus_checks_maps, @bypass_spam_checks_maps,
 # @bypass_banned_checks_maps, @bypass_header_checks_maps,
 #
 # @virus_lovers_maps, @spam_lovers_maps,
 # @banned_files_lovers_maps, @bad_header_lovers_maps,
 #
 # @blacklist_sender_maps, @score_sender_maps,
 #
 # $clean_quarantine_method, $virus_quarantine_to, $banned_quarantine_to,
 # $bad_header_quarantine_to, $spam_quarantine_to,
 #
 # $defang_bad_header, $defang_undecipherable, $defang_spam
 
 
 # REMAINING IMPORTANT VARIABLES ARE LISTED HERE BECAUSE OF LONGER ASSIGNMENTS
 
 @keep_decoded_original_maps = (new_RE(
   qr'^MAIL\$',   # retain full original message for virus checking
   qr'^MAIL-UNDECIPHERABLE\$', # recheck full mail if it contains undecipherables
   qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i,
 # qr'^Zip archive data',     # don't trust Archive::Zip
 ));
 
 
 # for $banned_namepath_re (a new-style of banned table) see amavisd.conf-sample
 
 $banned_filename_re = new_RE(
 
 ### BLOCKED ANYWHERE
 # qr'^UNDECIPHERABLE\$',  # is or contains any undecipherable components
   qr'^\.(exe-ms|dll)\$',                   # banned file(1) types, rudimentary
 # qr'^\.(exe|lha|tnef|cab|dll)\$',         # banned file(1) types
 
 ### BLOCK THE FOLLOWING, EXCEPT WITHIN UNIX ARCHIVES:
 # [ qr'^\.(gz|bz2)$'             => 0 ],  # allow any in gzip or bzip2
   [ qr'^\.(rpm|cpio|tar)\$'       => 0 ],  # allow any in Unix-type archives
 
   qr'.\.(pif|scr)$'i,                     # banned extensions - rudimentary
 # qr'^\.zip$',                            # block zip type
 
 ### BLOCK THE FOLLOWING, EXCEPT WITHIN ARCHIVES:
 # [ qr'^\.(zip|rar|arc|arj|zoo)$'=> 0 ],  # allow any within these archives
 
   qr'^application/x-msdownload\$'i,        # block these MIME types
   qr'^application/x-msdos-program\$'i,
   qr'^application/hta\$'i,
 
 # qr'^message/partial$'i,         # rfc2046 MIME type
 # qr'^message/external-body$'i,   # rfc2046 MIME type
 
 # qr'^(application/x-msmetafile|image/x-wmf)$'i,  # Windows Metafile MIME type
 # qr'^\.wmf$',                            # Windows Metafile file(1) type
 
   # block certain double extensions in filenames
   qr'\.[^./]*[A-Za-z][^./]*\.\s*(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)[.\s]*\$'i,
 
 # qr'\{[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}\}?'i, # Class ID CLSID, strict
 # qr'\{[0-9a-z]{4,}(-[0-9a-z]{4,}){0,7}\}?'i, # Class ID extension CLSID, loose
 
   qr'.\.(exe|vbs|pif|scr|cpl)\$'i,             # banned extension - basic
 # qr'.\.(exe|vbs|pif|scr|cpl|bat|cmd|com)$'i, # banned extension - basic+cmd
 # qr'.\.(ade|adp|app|bas|bat|chm|cmd|com|cpl|crt|emf|exe|fxp|grp|hlp|hta|
 #        inf|ins|isp|js|jse|lnk|mda|mdb|mde|mdw|mdt|mdz|msc|msi|msp|mst|
 #        ops|pcd|pif|prg|reg|scr|sct|shb|shs|vb|vbe|vbs|
 #        wmf|wsc|wsf|wsh)$'ix,  # banned ext - long
 # qr'.\.(ani|cur|ico)$'i,                 # banned cursors and icons filename
 # qr'^\.ani$',                            # banned animated cursor file(1) type
 
 # qr'.\.(mim|b64|bhx|hqx|xxe|uu|uue)$'i,  # banned extension - WinZip vulnerab.
 );
 # See http://support.microsoft.com/default.aspx?scid=kb;EN-US;q262631
 # and http://www.cknow.com/vtutor/vtextensions.htm
 
 
 # ENVELOPE SENDER SOFT-WHITELISTING / SOFT-BLACKLISTING
 
 @score_sender_maps = ({ # a by-recipient hash lookup table,
                         # results from all matching recipient tables are summed
 
 # ## per-recipient personal tables  (NOTE: positive: black, negative: white)
 # 'user1@example.com'  => [{'bla-mobile.press@example.com' => 10.0}],
 # 'user3@example.com'  => [{'.ebay.com'                 => -3.0}],
 # 'user4@example.com'  => [{'cleargreen@cleargreen.com' => -7.0,
 #                           '.cleargreen.com'           => -5.0}],
 
   ## site-wide opinions about senders (the '.' matches any recipient)
   '.' => [  # the _first_ matching sender determines the score boost
 
    new_RE(  # regexp-type lookup table, just happens to be all soft-blacklist
     [qr'^(bulkmail|offers|cheapbenefits|earnmoney|foryou)@'i         => 5.0],
     [qr'^(greatcasino|investments|lose_weight_today|market\.alert)@'i=> 5.0],
     [qr'^(money2you|MyGreenCard|new\.tld\.registry|opt-out|opt-in)@'i=> 5.0],
     [qr'^(optin|saveonlsmoking2002k|specialoffer|specialoffers)@'i   => 5.0],
     [qr'^(stockalert|stopsnoring|wantsome|workathome|yesitsfree)@'i  => 5.0],
     [qr'^(your_friend|greatoffers)@'i                                => 5.0],
     [qr'^(inkjetplanet|marketopt|MakeMoney)\d*@'i                    => 5.0],
    ),
 
 #  read_hash("/var/amavis/sender_scores_sitewide"),
 
    { # a hash-type lookup table (associative array)
      'nobody@cert.org'                        => -3.0,
      'cert-advisory@us-cert.gov'              => -3.0,
      'owner-alert@iss.net'                    => -3.0,
      'slashdot@slashdot.org'                  => -3.0,
      'securityfocus.com'                      => -3.0,
      'ntbugtraq@listserv.ntbugtraq.com'       => -3.0,
      'security-alerts@linuxsecurity.com'      => -3.0,
      'mailman-announce-admin@python.org'      => -3.0,
      'amavis-user-admin@lists.sourceforge.net'=> -3.0,
      'amavis-user-bounces@lists.sourceforge.net' => -3.0,
      'spamassassin.apache.org'                => -3.0,
      'notification-return@lists.sophos.com'   => -3.0,
      'owner-postfix-users@postfix.org'        => -3.0,
      'owner-postfix-announce@postfix.org'     => -3.0,
      'owner-sendmail-announce@lists.sendmail.org'   => -3.0,
      'sendmail-announce-request@lists.sendmail.org' => -3.0,
      'donotreply@sendmail.org'                => -3.0,
      'ca+envelope@sendmail.org'               => -3.0,
      'noreply@freshmeat.net'                  => -3.0,
      'owner-technews@postel.acm.org'          => -3.0,
      'ietf-123-owner@loki.ietf.org'           => -3.0,
      'cvs-commits-list-admin@gnome.org'       => -3.0,
      'rt-users-admin@lists.fsck.com'          => -3.0,
      'clp-request@comp.nus.edu.sg'            => -3.0,
      'surveys-errors@lists.nua.ie'            => -3.0,
      'emailnews@genomeweb.com'                => -5.0,
      'yahoo-dev-null@yahoo-inc.com'           => -3.0,
      'returns.groups.yahoo.com'               => -3.0,
      'clusternews@linuxnetworx.com'           => -3.0,
      lc('lvs-users-admin@LinuxVirtualServer.org')    => -3.0,
      lc('owner-textbreakingnews@CNNIMAIL12.CNN.COM') => -5.0,
 
      # soft-blacklisting (positive score)
      'sender@example.net'                     =>  3.0,
      '.example.net'                           =>  1.0,
 
    },
   ],  # end of site-wide tables
 });
 
 
 @decoders = (
   ['mail', \&do_mime_decode],
   ['asc',  \&do_ascii],
   ['uue',  \&do_ascii],
   ['hqx',  \&do_ascii],
   ['ync',  \&do_ascii],
   ['F',    \&do_uncompress, ['unfreeze','freeze -d','melt','fcat'] ],
   ['Z',    \&do_uncompress, ['uncompress','gzip -d','zcat'] ],
   ['gz',   \&do_uncompress,  'gzip -d'],
   ['gz',   \&do_gunzip],
   ['bz2',  \&do_uncompress,  'bzip2 -d'],
   ['lzo',  \&do_uncompress,  'lzop -d'],
   ['rpm',  \&do_uncompress, ['rpm2cpio.pl','rpm2cpio'] ],
   ['cpio', \&do_pax_cpio,   ['pax','gcpio','cpio'] ],
   ['tar',  \&do_pax_cpio,   ['pax','gcpio','cpio'] ],
   ['deb',  \&do_ar,          'ar'],
 # ['a',    \&do_ar,          'ar'],  # unpacking .a seems an overkill
   ['zip',  \&do_unzip],
   ['7z',   \&do_7zip,       ['7zr','7za','7z'] ],
   ['rar',  \&do_unrar,      ['rar','unrar'] ],
   ['arj',  \&do_unarj,      ['arj','unarj'] ],
   ['arc',  \&do_arc,        ['nomarch','arc'] ],
   ['zoo',  \&do_zoo,        ['zoo','unzoo'] ],
   ['lha',  \&do_lha,         'lha'],
 # ['doc',  \&do_ole,         'ripole'],
   ['cab',  \&do_cabextract,  'cabextract'],
   ['tnef', \&do_tnef_ext,    'tnef'],
   ['tnef', \&do_tnef],
 # ['sit',  \&do_unstuff,     'unstuff'],  # broken/unsafe decoder
   ['exe',  \&do_executable, ['rar','unrar'], 'lha', ['arj','unarj'] ],
 );
 
 
 @av_scanners = (
 
-#FIXME setup clamav
-# ### http://www.clamav.net/
-# ['ClamAV-clamd',
-#   \&ask_daemon, ["CONTSCAN {}\n", "$clamdsock"],
-#   qr/\bOK$/m, qr/\bFOUND$/m,
-#   qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
-# # NOTE: run clamd under the same user as amavisd, or run it under its own
-# #   uid such as clamav, add user clamav to the amavis group, and then add
-# #   AllowSupplementaryGroups to clamd.conf;
-# # NOTE: match socket name (LocalSocket) in clamav.conf to the socket name in
-# #   this entry; when running chrooted one may prefer socket "$MYHOME/clamd".
+### http://www.clamav.net/
+['ClamAV-clamd',
+  \&ask_daemon, ["CONTSCAN {}\n", "/var/spool/amavisd/clamd.sock"],
+  qr/\bOK$/m, qr/\bFOUND$/m,
+  qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
+# NOTE: run clamd under the same user as amavisd, or run it under its own
+#   uid such as clamav, add user clamav to the amavis group, and then add
+#   AllowSupplementaryGroups to clamd.conf;
+# NOTE: match socket name (LocalSocket) in clamav.conf to the socket name in
+#   this entry; when running chrooted one may prefer socket "$MYHOME/clamd".
 
 # ### http://www.clamav.net/ and CPAN  (memory-hungry! clamd is preferred)
 # # note that Mail::ClamAV requires perl to be build with threading!
 # ['Mail::ClamAV', \&ask_clamav, "*", [0], [1], qr/^INFECTED: (.+)/m ],
 
 # ['File::Scan', sub {Amavis::AV::ask_av(sub{
 #   use File::Scan; my($fn)=@_;
 #   my($f)=File::Scan->new(max_txt_size=>0, max_bin_size=>0);
 #   my($vname) = $f->scan($fn);
 #   $f->error ? (2,"Error: ".$f->error)
 #   : ($vname ne '') ? (1,"$vname FOUND") : (0,"Clean")}, @_) },
 #   ["{}/*"], [0], [1], qr/^(.*) FOUND$/m ],
 
 # ### fully-fledged checker for JPEG marker segments of invalid length
 # ['check-jpeg',
 #   sub { use JpegTester (); Amavis::AV::ask_av(\&JpegTester::test_jpeg, @_) },
 #   ["{}/*"], undef, [1], qr/^(bad jpeg: .*)$/m ],
 # # NOTE: place file JpegTester.pm somewhere where Perl can find it,
 # #       for example in /usr/local/lib/perl5/site_perl
 
 );
 
 
 @av_scanners_backup = (
 
   ### http://www.clamav.net/   - backs up clamd or Mail::ClamAV
   ['ClamAV-clamscan', 'clamscan',
     "--stdout --no-summary -r --tempdir=$TEMPBASE {}",
     [0], qr/:.*\sFOUND$/m, qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
 
 # Always succeeds and considers mail clean.
 # Potentially useful when all other scanners fail and it is desirable
 # to let mail continue to flow with no virus checking (when uncommented).
 # ['always-clean', sub {0}],
 
 );
 
 
 1;  # insure a defined return value
diff --git a/docker/amavis/rootfs/etc/clamd.d/amavisd.conf b/docker/amavis/rootfs/etc/clamd.d/amavisd.conf
new file mode 100644
index 00000000..7e1e11ec
--- /dev/null
+++ b/docker/amavis/rootfs/etc/clamd.d/amavisd.conf
@@ -0,0 +1,20 @@
+# Use system logger.
+LogSyslog yes
+
+# Specify the type of syslog messages - please refer to 'man syslog'
+# for facility names.
+LogFacility LOG_MAIL
+
+# This option allows you to save a process identifier of the listening
+# daemon (main thread).
+PidFile /var/run/amavisd/clamd.pid
+
+# Remove stale socket after unclean shutdown.
+# Default: disabled
+FixStaleSocket yes
+
+# Run as a selected user (clamd must be started by root).
+User amavis
+
+# Path to a local socket file the daemon will listen on.
+LocalSocket /var/run/amavisd/clamd.sock
diff --git a/docker/amavis/rootfs/etc/clamd.d/scan.conf b/docker/amavis/rootfs/etc/clamd.d/scan.conf
new file mode 100644
index 00000000..2910ecca
--- /dev/null
+++ b/docker/amavis/rootfs/etc/clamd.d/scan.conf
@@ -0,0 +1,794 @@
+##
+## Example config file for the Clam AV daemon
+## Please read the clamd.conf(5) manual before editing this file.
+##
+
+
+# Comment or remove the line below.
+#Example
+
+# Uncomment this option to enable logging.
+# LogFile must be writable for the user running daemon.
+# A full path is required.
+# Default: disabled
+#LogFile /var/log/clamd.scan
+
+# By default the log file is locked for writing - the lock protects against
+# running clamd multiple times (if want to run another clamd, please
+# copy the configuration file, change the LogFile variable, and run
+# the daemon with --config-file option).
+# This option disables log file locking.
+# Default: no
+#LogFileUnlock yes
+
+# Maximum size of the log file.
+# Value of 0 disables the limit.
+# You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
+# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
+# in bytes just don't use modifiers. If LogFileMaxSize is enabled, log
+# rotation (the LogRotate option) will always be enabled.
+# Default: 1M
+#LogFileMaxSize 2M
+
+# Log time with each message.
+# Default: no
+#LogTime yes
+
+# Also log clean files. Useful in debugging but drastically increases the
+# log size.
+# Default: no
+#LogClean yes
+
+# Use system logger (can work together with LogFile).
+# Default: no
+LogSyslog yes
+
+# Specify the type of syslog messages - please refer to 'man syslog'
+# for facility names.
+# Default: LOG_LOCAL6
+#LogFacility LOG_MAIL
+
+# Enable verbose logging.
+# Default: no
+#LogVerbose yes
+
+# Enable log rotation. Always enabled when LogFileMaxSize is enabled.
+# Default: no
+#LogRotate yes
+
+# Enable Prelude output.
+# Default: no
+#PreludeEnable yes
+#
+# Set the name of the analyzer used by prelude-admin.
+# Default: ClamAV
+#PreludeAnalyzerName ClamAV
+
+# Log additional information about the infected file, such as its
+# size and hash, together with the virus name.
+#ExtendedDetectionInfo yes
+
+# This option allows you to save a process identifier of the listening
+# daemon (main thread).
+# This file will be owned by root, as long as clamd was started by root.
+# It is recommended that the directory where this file is stored is
+# also owned by root to keep other users from tampering with it.
+# Default: disabled
+#PidFile /run/clamd.scan/clamd.pid
+
+# Optional path to the global temporary directory.
+# Default: system specific (usually /tmp or /var/tmp).
+#TemporaryDirectory /var/tmp
+
+# Path to the database directory.
+# Default: hardcoded (depends on installation options)
+#DatabaseDirectory /var/lib/clamav
+
+# Only load the official signatures published by the ClamAV project.
+# Default: no
+#OfficialDatabaseOnly no
+
+# The daemon can work in local mode, network mode or both.
+# Due to security reasons we recommend the local mode.
+
+# Path to a local socket file the daemon will listen on.
+# Default: disabled (must be specified by a user)
+#LocalSocket /run/clamd.scan/clamd.sock
+
+# Sets the group ownership on the unix socket.
+# Default: disabled (the primary group of the user running clamd)
+#LocalSocketGroup virusgroup
+
+# Sets the permissions on the unix socket to the specified mode.
+# Default: disabled (socket is world accessible)
+#LocalSocketMode 660
+
+# Remove stale socket after unclean shutdown.
+# Default: yes
+#FixStaleSocket yes
+
+# TCP port address.
+# Default: no
+#TCPSocket 3310
+
+# TCP address.
+# By default we bind to INADDR_ANY, probably not wise.
+# Enable the following to provide some degree of protection
+# from the outside world. This option can be specified multiple
+# times if you want to listen on multiple IPs. IPv6 is now supported.
+# Default: no
+#TCPAddr 127.0.0.1
+
+# Maximum length the queue of pending connections may grow to.
+# Default: 200
+#MaxConnectionQueueLength 30
+
+# Clamd uses FTP-like protocol to receive data from remote clients.
+# If you are using clamav-milter to balance load between remote clamd daemons
+# on firewall servers you may need to tune the options below.
+
+# Close the connection when the data size limit is exceeded.
+# The value should match your MTA's limit for a maximum attachment size.
+# Default: 25M
+#StreamMaxLength 10M
+
+# Limit port range.
+# Default: 1024
+#StreamMinPort 30000
+# Default: 2048
+#StreamMaxPort 32000
+
+# Maximum number of threads running at the same time.
+# Default: 10
+#MaxThreads 20
+
+# Waiting for data from a client socket will timeout after this time (seconds).
+# Default: 120
+#ReadTimeout 300
+
+# This option specifies the time (in seconds) after which clamd should
+# timeout if a client doesn't provide any initial command after connecting.
+# Default: 30
+#CommandReadTimeout 30
+
+# This option specifies how long to wait (in milliseconds) if the send buffer
+# is full.
+# Keep this value low to prevent clamd hanging.
+#
+# Default: 500
+#SendBufTimeout 200
+
+# Maximum number of queued items (including those being processed by
+# MaxThreads threads).
+# It is recommended to have this value at least twice MaxThreads if possible.
+# WARNING: you shouldn't increase this too much to avoid running out  of file
+# descriptors, the following condition should hold:
+# MaxThreads*MaxRecursion + (MaxQueue - MaxThreads) + 6< RLIMIT_NOFILE (usual
+# max is 1024).
+#
+# Default: 100
+#MaxQueue 200
+
+# Waiting for a new job will timeout after this time (seconds).
+# Default: 30
+#IdleTimeout 60
+
+# Don't scan files and directories matching regex
+# This directive can be used multiple times
+# Default: scan all
+#ExcludePath ^/proc/
+#ExcludePath ^/sys/
+
+# Maximum depth directories are scanned at.
+# Default: 15
+#MaxDirectoryRecursion 20
+
+# Follow directory symlinks.
+# Default: no
+#FollowDirectorySymlinks yes
+
+# Follow regular file symlinks.
+# Default: no
+#FollowFileSymlinks yes
+
+# Scan files and directories on other filesystems.
+# Default: yes
+#CrossFilesystems yes
+
+# Perform a database check.
+# Default: 600 (10 min)
+#SelfCheck 600
+
+# Enable non-blocking (multi-threaded/concurrent) database reloads.
+# This feature will temporarily load a second scanning engine while scanning
+# continues using the first engine. Once loaded, the new engine takes over.
+# The old engine is removed as soon as all scans using the old engine have
+# completed.
+# This feature requires more RAM, so this option is provided in case users are
+# willing to block scans during reload in exchange for lower RAM requirements.
+# Default: yes
+#ConcurrentDatabaseReload no
+
+# Execute a command when virus is found. In the command string %v will
+# be replaced with the virus name.
+# Default: no
+#VirusEvent /usr/local/bin/send_sms 123456789 "VIRUS ALERT: %v"
+
+# Run as another user (clamd must be started by root for this option to work)
+# Default: don't drop privileges
+User clamscan
+
+# Stop daemon when libclamav reports out of memory condition.
+#ExitOnOOM yes
+
+# Don't fork into background.
+# Default: no
+#Foreground yes
+
+# Enable debug messages in libclamav.
+# Default: no
+#Debug yes
+
+# Do not remove temporary files (for debug purposes).
+# Default: no
+#LeaveTemporaryFiles yes
+
+# Permit use of the ALLMATCHSCAN command. If set to no, clamd will reject
+# any ALLMATCHSCAN command as invalid.
+# Default: yes
+#AllowAllMatchScan no
+
+# Detect Possibly Unwanted Applications.
+# Default: no
+#DetectPUA yes
+
+# Exclude a specific PUA category. This directive can be used multiple times.
+# See https://github.com/vrtadmin/clamav-faq/blob/master/faq/faq-pua.md for
+# the complete list of PUA categories.
+# Default: Load all categories (if DetectPUA is activated)
+#ExcludePUA NetTool
+#ExcludePUA PWTool
+
+# Only include a specific PUA category. This directive can be used multiple
+# times.
+# Default: Load all categories (if DetectPUA is activated)
+#IncludePUA Spy
+#IncludePUA Scanner
+#IncludePUA RAT
+
+# This option causes memory or nested map scans to dump the content to disk.
+# If you turn on this option, more data is written to disk and is available
+# when the LeaveTemporaryFiles option is enabled.
+#ForceToDisk yes
+
+# This option allows you to disable the caching feature of the engine. By
+# default, the engine will store an MD5 in a cache of any files that are
+# not flagged as virus or that hit limits checks. Disabling the cache will
+# have a negative performance impact on large scans.
+# Default: no
+#DisableCache yes
+
+# In some cases (eg. complex malware, exploits in graphic files, and others),
+# ClamAV uses special algorithms to detect abnormal patterns and behaviors that
+# may be malicious.  This option enables alerting on such heuristically
+# detected potential threats.
+# Default: yes
+#HeuristicAlerts yes
+
+# Allow heuristic alerts to take precedence.
+# When enabled, if a heuristic scan (such as phishingScan) detects
+# a possible virus/phish it will stop scan immediately. Recommended, saves CPU
+# scan-time.
+# When disabled, virus/phish detected by heuristic scans will be reported only
+# at the end of a scan. If an archive contains both a heuristically detected
+# virus/phish, and a real malware, the real malware will be reported
+#
+# Keep this disabled if you intend to handle "Heuristics.*" viruses
+# differently from "real" malware.
+# If a non-heuristically-detected virus (signature-based) is found first,
+# the scan is interrupted immediately, regardless of this config option.
+#
+# Default: no
+#HeuristicScanPrecedence yes
+
+
+##
+## Heuristic Alerts
+##
+
+# With this option clamav will try to detect broken executables (both PE and
+# ELF) and alert on them with the Broken.Executable heuristic signature.
+# Default: no
+#AlertBrokenExecutables yes
+
+# With this option clamav will try to detect broken media file (JPEG,
+# TIFF, PNG, GIF) and alert on them with a Broken.Media heuristic signature.
+# Default: no
+#AlertBrokenMedia yes
+
+# Alert on encrypted archives _and_ documents with heuristic signature
+# (encrypted .zip, .7zip, .rar, .pdf).
+# Default: no
+#AlertEncrypted yes
+
+# Alert on encrypted archives with heuristic signature (encrypted .zip, .7zip,
+# .rar).
+# Default: no
+#AlertEncryptedArchive yes
+
+# Alert on encrypted archives with heuristic signature (encrypted .pdf).
+# Default: no
+#AlertEncryptedDoc yes
+
+# With this option enabled OLE2 files containing VBA macros, which were not
+# detected by signatures will be marked as "Heuristics.OLE2.ContainsMacros".
+# Default: no
+#AlertOLE2Macros yes
+
+# Alert on SSL mismatches in URLs, even if the URL isn't in the database.
+# This can lead to false positives.
+# Default: no
+#AlertPhishingSSLMismatch yes
+
+# Alert on cloaked URLs, even if URL isn't in database.
+# This can lead to false positives.
+# Default: no
+#AlertPhishingCloak yes
+
+# Alert on raw DMG image files containing partition intersections
+# Default: no
+#AlertPartitionIntersection yes
+
+
+##
+## Executable files
+##
+
+# PE stands for Portable Executable - it's an executable file format used
+# in all 32 and 64-bit versions of Windows operating systems. This option
+# allows ClamAV to perform a deeper analysis of executable files and it's also
+# required for decompression of popular executable packers such as UPX, FSG,
+# and Petite. If you turn off this option, the original files will still be
+# scanned, but without additional processing.
+# Default: yes
+#ScanPE yes
+
+# Certain PE files contain an authenticode signature. By default, we check
+# the signature chain in the PE file against a database of trusted and
+# revoked certificates if the file being scanned is marked as a virus.
+# If any certificate in the chain validates against any trusted root, but
+# does not match any revoked certificate, the file is marked as whitelisted.
+# If the file does match a revoked certificate, the file is marked as virus.
+# The following setting completely turns off authenticode verification.
+# Default: no
+#DisableCertCheck yes
+
+# Executable and Linking Format is a standard format for UN*X executables.
+# This option allows you to control the scanning of ELF files.
+# If you turn off this option, the original files will still be scanned, but
+# without additional processing.
+# Default: yes
+#ScanELF yes
+
+
+##
+## Documents
+##
+
+# This option enables scanning of OLE2 files, such as Microsoft Office
+# documents and .msi files.
+# If you turn off this option, the original files will still be scanned, but
+# without additional processing.
+# Default: yes
+#ScanOLE2 yes
+
+# This option enables scanning within PDF files.
+# If you turn off this option, the original files will still be scanned, but
+# without decoding and additional processing.
+# Default: yes
+#ScanPDF yes
+
+# This option enables scanning within SWF files.
+# If you turn off this option, the original files will still be scanned, but
+# without decoding and additional processing.
+# Default: yes
+#ScanSWF yes
+
+# This option enables scanning xml-based document files supported by libclamav.
+# If you turn off this option, the original files will still be scanned, but
+# without additional processing.
+# Default: yes
+#ScanXMLDOCS yes
+
+# This option enables scanning of HWP3 files.
+# If you turn off this option, the original files will still be scanned, but
+# without additional processing.
+# Default: yes
+#ScanHWP3 yes
+
+
+##
+## Mail files
+##
+
+# Enable internal e-mail scanner.
+# If you turn off this option, the original files will still be scanned, but
+# without parsing individual messages/attachments.
+# Default: yes
+#ScanMail yes
+
+# Scan RFC1341 messages split over many emails.
+# You will need to periodically clean up $TemporaryDirectory/clamav-partial
+# directory.
+# WARNING: This option may open your system to a DoS attack.
+#          Never use it on loaded servers.
+# Default: no
+#ScanPartialMessages yes
+
+# With this option enabled ClamAV will try to detect phishing attempts by using
+# HTML.Phishing and Email.Phishing NDB signatures.
+# Default: yes
+#PhishingSignatures no
+
+# With this option enabled ClamAV will try to detect phishing attempts by
+# analyzing URLs found in emails using WDB and PDB signature databases.
+# Default: yes
+#PhishingScanURLs no
+
+
+##
+## Data Loss Prevention (DLP)
+##
+
+# Enable the DLP module
+# Default: No
+#StructuredDataDetection yes
+
+# This option sets the lowest number of Credit Card numbers found in a file
+# to generate a detect.
+# Default: 3
+#StructuredMinCreditCardCount 5
+
+# With this option enabled the DLP module will search for valid Credit Card
+# numbers only. Debit and Private Label cards will not be searched.
+# Default: no
+#StructuredCCOnly yes
+
+# This option sets the lowest number of Social Security Numbers found
+# in a file to generate a detect.
+# Default: 3
+#StructuredMinSSNCount 5
+
+# With this option enabled the DLP module will search for valid
+# SSNs formatted as xxx-yy-zzzz
+# Default: yes
+#StructuredSSNFormatNormal yes
+
+# With this option enabled the DLP module will search for valid
+# SSNs formatted as xxxyyzzzz
+# Default: no
+#StructuredSSNFormatStripped yes
+
+
+##
+## HTML
+##
+
+# Perform HTML normalisation and decryption of MS Script Encoder code.
+# Default: yes
+# If you turn off this option, the original files will still be scanned, but
+# without additional processing.
+#ScanHTML yes
+
+
+##
+## Archives
+##
+
+# ClamAV can scan within archives and compressed files.
+# If you turn off this option, the original files will still be scanned, but
+# without unpacking and additional processing.
+# Default: yes
+#ScanArchive yes
+
+
+##
+## Limits
+##
+
+# The options below protect your system against Denial of Service attacks
+# using archive bombs.
+
+# This option sets the maximum amount of time to a scan may take.
+# In this version, this field only affects the scan time of ZIP archives.
+# Value of 0 disables the limit.
+# Note: disabling this limit or setting it too high may result allow scanning
+# of certain files to lock up the scanning process/threads resulting in a
+# Denial of Service.
+# Time is in milliseconds.
+# Default: 120000
+#MaxScanTime 300000
+
+# This option sets the maximum amount of data to be scanned for each input
+# file. Archives and other containers are recursively extracted and scanned
+# up to this value.
+# Value of 0 disables the limit
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Default: 100M
+#MaxScanSize 150M
+
+# Files larger than this limit won't be scanned. Affects the input file itself
+# as well as files contained inside it (when the input file is an archive, a
+# document or some other kind of container).
+# Value of 0 disables the limit.
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Technical design limitations prevent ClamAV from scanning files greater than
+# 2 GB at this time.
+# Default: 25M
+#MaxFileSize 30M
+
+# Nested archives are scanned recursively, e.g. if a Zip archive contains a RAR
+# file, all files within it will also be scanned. This options specifies how
+# deeply the process should be continued.
+# Note: setting this limit too high may result in severe damage to the system.
+# Default: 17
+#MaxRecursion 10
+
+# Number of files to be scanned within an archive, a document, or any other
+# container file.
+# Value of 0 disables the limit.
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Default: 10000
+#MaxFiles 15000
+
+# Maximum size of a file to check for embedded PE. Files larger than this value
+# will skip the additional analysis step.
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Default: 10M
+#MaxEmbeddedPE 10M
+
+# Maximum size of a HTML file to normalize. HTML files larger than this value
+# will not be normalized or scanned.
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Default: 10M
+#MaxHTMLNormalize 10M
+
+# Maximum size of a normalized HTML file to scan. HTML files larger than this
+# value after normalization will not be scanned.
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Default: 2M
+#MaxHTMLNoTags 2M
+
+# Maximum size of a script file to normalize. Script content larger than this
+# value will not be normalized or scanned.
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Default: 5M
+#MaxScriptNormalize 5M
+
+# Maximum size of a ZIP file to reanalyze type recognition. ZIP files larger
+# than this value will skip the step to potentially reanalyze as PE.
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Default: 1M
+#MaxZipTypeRcg 1M
+
+# This option sets the maximum number of partitions of a raw disk image to be
+# scanned.
+# Raw disk images with more partitions than this value will have up to
+# the value number partitions scanned. Negative values are not allowed.
+# Note: setting this limit too high may result in severe damage or impact
+# performance.
+# Default: 50
+#MaxPartitions 128
+
+# This option sets the maximum number of icons within a PE to be scanned.
+# PE files with more icons than this value will have up to the value number
+# icons scanned.
+# Negative values are not allowed.
+# WARNING: setting this limit too high may result in severe damage or impact
+# performance.
+# Default: 100
+#MaxIconsPE 200
+
+# This option sets the maximum recursive calls for HWP3 parsing during
+# scanning. HWP3 files using more than this limit will be terminated and
+# alert the user.
+# Scans will be unable to scan any HWP3 attachments if the recursive limit
+# is reached.
+# Negative values are not allowed.
+# WARNING: setting this limit too high may result in severe damage or impact
+# performance.
+# Default: 16
+#MaxRecHWP3 16
+
+# This option sets the maximum calls to the PCRE match function during
+# an instance of regex matching.
+# Instances using more than this limit will be terminated and alert the user
+# but the scan will continue.
+# For more information on match_limit, see the PCRE documentation.
+# Negative values are not allowed.
+# WARNING: setting this limit too high may severely impact performance.
+# Default: 100000
+#PCREMatchLimit 20000
+
+# This option sets the maximum recursive calls to the PCRE match function
+# during an instance of regex matching.
+# Instances using more than this limit will be terminated and alert the user
+# but the scan will continue.
+# For more information on match_limit_recursion, see the PCRE documentation.
+# Negative values are not allowed and values > PCREMatchLimit are superfluous.
+# WARNING: setting this limit too high may severely impact performance.
+# Default: 2000
+#PCRERecMatchLimit 10000
+
+# This option sets the maximum filesize for which PCRE subsigs will be
+# executed. Files exceeding this limit will not have PCRE subsigs executed
+# unless a subsig is encompassed to a smaller buffer.
+# Negative values are not allowed.
+# Setting this value to zero disables the limit.
+# WARNING: setting this limit too high or disabling it may severely impact
+# performance.
+# Default: 25M
+#PCREMaxFileSize 100M
+
+# When AlertExceedsMax is set, files exceeding the MaxFileSize, MaxScanSize, or
+# MaxRecursion limit will be flagged with the virus name starting with
+# "Heuristics.Limits.Exceeded".
+# Default: no
+#AlertExceedsMax yes
+
+##
+## On-access Scan Settings
+##
+
+# Don't scan files larger than OnAccessMaxFileSize
+# Value of 0 disables the limit.
+# Default: 5M
+#OnAccessMaxFileSize 10M
+
+# Max number of scanning threads to allocate to the OnAccess thread pool at
+# startup. These threads are the ones responsible for creating a connection
+# with the daemon and kicking off scanning after an event has been processed.
+# To prevent clamonacc from consuming all clamd's resources keep this lower
+# than clamd's max threads.
+# Default: 5
+#OnAccessMaxThreads 10
+
+# Max amount of time (in milliseconds) that the OnAccess client should spend
+# for every connect, send, and recieve attempt when communicating with clamd
+# via curl.
+# Default: 5000 (5 seconds)
+# OnAccessCurlTimeout 10000
+
+# Toggles dynamic directory determination. Allows for recursively watching
+# include paths.
+# Default: no
+#OnAccessDisableDDD yes
+
+# Set the include paths (all files inside them will be scanned). You can have
+# multiple OnAccessIncludePath directives but each directory must be added
+# in a separate line.
+# Default: disabled
+#OnAccessIncludePath /home
+#OnAccessIncludePath /students
+
+# Set the exclude paths. All subdirectories are also excluded.
+# Default: disabled
+#OnAccessExcludePath /home/user
+
+# Modifies fanotify blocking behaviour when handling permission events.
+# If off, fanotify will only notify if the file scanned is a virus,
+# and not perform any blocking.
+# Default: no
+#OnAccessPrevention yes
+
+# When using prevention, if this option is turned on, any errors that occur
+# during scanning will result in the event attempt being denied. This could
+# potentially lead to unwanted system behaviour with certain configurations,
+# so the client defaults this to off and prefers allowing access events in
+# case of scan or connection error.
+# Default: no
+#OnAccessDenyOnError yes
+
+# Toggles extra scanning and notifications when a file or directory is
+# created or moved.
+# Requires the  DDD system to kick-off extra scans.
+# Default: no
+#OnAccessExtraScanning yes
+
+# Set the  mount point to be scanned. The mount point specified, or the mount
+# point containing the specified directory will be watched. If any directories
+# are specified, this option will preempt (disable and ignore all options
+# related to) the DDD system. This option will result in verdicts only.
+# Note that prevention is explicitly disallowed to prevent common, fatal
+# misconfigurations. (e.g. watching "/" with prevention on and no exclusions
+# made on vital system directories)
+# It can be used multiple times.
+# Default: disabled
+#OnAccessMountPath /
+#OnAccessMountPath /home/user
+
+# With this option you can whitelist the root UID (0). Processes run under
+# root with be able to access all files without triggering scans or
+# permission denied events.
+# Note that if clamd cannot check the uid of the process that generated an
+# on-access scan event (e.g., because OnAccessPrevention was not enabled, and
+# the process already exited), clamd will perform a scan.  Thus, setting
+# OnAccessExcludeRootUID is not *guaranteed* to prevent every access by the
+# root user from triggering a scan (unless OnAccessPrevention is enabled).
+# Default: no
+#OnAccessExcludeRootUID no
+
+# With this option you can whitelist specific UIDs. Processes with these UIDs
+# will be able to access all files without triggering scans or permission
+# denied events.
+# This option can be used multiple times (one per line).
+# Using a value of 0 on any line will disable this option entirely.
+# To whitelist the root UID (0) please enable the OnAccessExcludeRootUID
+# option.
+# Also note that if clamd cannot check the uid of the process that generated an
+# on-access scan event (e.g., because OnAccessPrevention was not enabled, and
+# the process already exited), clamd will perform a scan.  Thus, setting
+# OnAccessExcludeUID is not *guaranteed* to prevent every access by the
+# specified uid from triggering a scan (unless OnAccessPrevention is enabled).
+# Default: disabled
+#OnAccessExcludeUID -1
+
+# This option allows exclusions via user names when using the on-access
+# scanning client. It can be used multiple times.
+# It has the same potential race condition limitations of the
+# OnAccessExcludeUID option.
+# Default: disabled
+#OnAccessExcludeUname clamav
+
+# Number of times the OnAccess client will retry a failed scan due to
+# connection problems (or other issues).
+# Default: 0
+#OnAccessRetryAttempts 3
+
+##
+## Bytecode
+##
+
+# With this option enabled ClamAV will load bytecode from the database.
+# It is highly recommended you keep this option on, otherwise you'll miss
+# detections for many new viruses.
+# Default: yes
+#Bytecode yes
+
+# Set bytecode security level.
+# Possible values:
+#   None -      No security at all, meant for debugging.
+#               DO NOT USE THIS ON PRODUCTION SYSTEMS.
+#               This value is only available if clamav was built
+#               with --enable-debug!
+#   TrustSigned - Trust bytecode loaded from signed .c[lv]d files, insert
+#               runtime safety checks for bytecode loaded from other sources.
+#   Paranoid -  Don't trust any bytecode, insert runtime checks for all.
+# Recommended: TrustSigned, because bytecode in .cvd files already has these
+# checks.
+# Note that by default only signed bytecode is loaded, currently you can only
+# load unsigned bytecode in --enable-debug mode.
+#
+# Default: TrustSigned
+#BytecodeSecurity TrustSigned
+
+# Allow loading bytecode from outside digitally signed .c[lv]d files.
+# **Caution**: You should NEVER run bytecode signatures from untrusted sources.
+# Doing so may result in arbitrary code execution.
+# Default: no
+#BytecodeUnsigned yes
+
+# Set bytecode timeout in milliseconds.
+#
+# Default: 5000
+# BytecodeTimeout 1000
+
+
diff --git a/docker/amavis/rootfs/init.sh b/docker/amavis/rootfs/init.sh
index ba2fdc94..0561fb2f 100755
--- a/docker/amavis/rootfs/init.sh
+++ b/docker/amavis/rootfs/init.sh
@@ -1,41 +1,44 @@
 #!/bin/sh
 
 CONFIG="/etc/amavisd/amavisd.conf"
 sed -i -r \
     -e "s|APP_DOMAIN|$APP_DOMAIN|g" \
     $CONFIG
 
 DKIM_KEY="dkim20240318"
 DKIMKEYFILE="/var/dkim/$APP_DOMAIN.$DKIM_KEY.pem"
 if ! [ -f $DKIMKEYFILE ]; then
     echo "Generating the DKIM keys at: $DKIMKEYFILE"
     amavisd -c $CONFIG genrsa $DKIMKEYFILE 2048
     chmod g+r $DKIMKEYFILE
     chgrp amavis $DKIMKEYFILE
 fi
 sed -i -r \
     -e "s|DKIM_KEY|$DKIM_KEY|g" \
     $CONFIG
 
 mkdir -p /var/run/amavisd
 chmod 777 /var/run/amavisd
 
 echo "DKIM keys:"
 amavisd -c $CONFIG showkeys
 
 # Initialize the clamav db
 /usr/bin/freshclam --quiet --datadir=/var/lib/clamav
 # Update once per day via daemon
 /usr/bin/freshclam -d -c 1
 
 # Update the spam db every 30h
 sa-update -v
 (
 while true; do
 	sleep 30h
 	sa-update -v
 done
 ) &
 
+# Run clamd
+clamd --config-file=/etc/clamd.d/amavisd.conf
+
 echo "Starting amavis"
 exec amavisd -c $CONFIG foreground