Not sure how to do that in docker, I’ve run mine as a plain old PHP-FPM site for years and years. It might be something that can be tweaked using config files or environment variables, or might require building a custom image.

ClamAV is slow and doesn’t catch the nastiest of malware. Its entire approach is stuck in 2008. It’s better than nothing for screening emails, but for a private file store it won’t help much considering that you’ll already have the files on your system somewhere. And most importantly, it slows down file uploads 10x and increases CPU load substantially. The only good reason to use ClamAV for nextcloud is if you will be sued if you don’t!

ClamAV is good for detecting simple threats. However, I hear it eats ram.

It's in the config file. https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/config_sample_php_parameters.html

This has me curious, not to derail the topic, but I always hear that ClamAV is the best way to go for Linux. Is there a free solution that you would recommend in place of it?

For the 2nd point, see https://docs.docker.com/config/containers/resource_constraints/#limit-a-containers-access-to-memory