The last question you ask is essentially also what I meant to ask.
So is the /uploads folder where the upload file tree is located in the [persistent?] docker image or is it volume mounted? I forgot how things work with Docker and unclear on what Discourse does to store the upload files.
My sys admin is considering installing ClamAv, but we are unclear if we would need to install that just in our EC2 instance, or if it needs to be installed in the docker image itself (by editing the image to add the ClamAv and rebuilding???).