One of the SOC 2 controls is apparently around ensuring antivirus/anti-spam/anti-malware is running on production servers. I've been googling to see if there are any recommendation/best practices for this in the container world. I'm not sure if it's a good practice to run AV on the host OS? Some materials I found in my Googling seem to indicate that if you do something like that, you would need to exclude the files used by the container to avoid locking up the container. Which sounds like it would defeat the purpose.
In our particular case, we're running on GKE using Google's pre-made container OS. Anyone have experience with this?