imgproxy on Ubuntu 24.04 LTS

Azure Application Infrastructure

imgproxy, a fast and secure image processing server that resizes, crops and converts images on the fly from a source URL.

Base
Hardened build
minimal ports, security patches applied at build time
Access
Unique credentials
generated on first boot, readable only by root
Verified
Boots working
services pass a health gate before release
Support
24/7, 365 days
by email and live chat, 24 hour response SLA

Overview

imgproxy is an open source, standalone HTTP server that processes images on demand. Your application builds a URL that names a source image and the work you want done, such as resize, crop, rotate, watermark or convert, and imgproxy fetches that image, processes it and streams the result straight back. All of the image handling moves off your application servers, so they never spend CPU or memory on resizing, and you no longer need to pre generate and store every size you might need.

It is built on libvips, which is one of the fastest image processing libraries available and keeps a very low memory footprint, and it reads the formats the modern web relies on, including JPEG, PNG, GIF, WebP, AVIF and JPEG XL. Because it is a single stateless service with no database, it sits naturally behind a CDN or load balancer and scales out by simply adding instances. It suits anyone serving user uploaded or catalogue imagery who wants one consistent, fast path from an original file to the exact rendition each client needs.

Why the cloudimg image

An image proxy left open to the internet is an abuse target, so cloudimg ships this one locked down. Every deployment generates its own unique URL signing key and salt on first boot, held in a root only file, so unsigned requests are refused, no two deployments ever share a secret and the image can never start as an open proxy. Source loading is hardened further than the upstream default: link local, loopback and private addresses are all refused, so the service cannot be used to read your instance metadata or reach other hosts inside your network, and limits on source resolution, file size, redirects and timeouts guard against decompression bombs. A signed URL helper is installed so you can mint a working URL in one command, the service runs unprivileged behind nginx, and a paired deployment guide plus 24/7 cloudimg support get you from launch to first processed image in minutes.

Common uses

  • Resize and convert catalogue imagery on demand
  • Serve responsive images to web and mobile clients
  • Offload thumbnail generation from application servers