Docker image for Loki, a simple IOC and YARA scanner (https://github.com/Neo23x0/Loki).

This image is built upon the official Alpine-based Python image.

docker run -it --rm mablanco/loki -h

docker volume create loki_signatures

docker run -it --rm -v loki_signatures:/app/signature-base -v <local_directory_to_scan>:/app/scan mablanco/loki -p ./scan

In order to be able to scan different directories in each invocation, it's advisable to use the --rm parameter to delete the container after its execution as it's not needed anymore. You can then scan another directory mounting it with the -v parameter. Don't forget to also mount the loki_signatures volume to prevent Loki from downloading the signatures each time a container is run.

docker run -it --rm -v loki_signatures:/app/signature-base mablanco/loki --update