[{"_1":2,"_163":-5,"_164":-5},"loaderData",{"_3":4,"_18":19,"_26":27,"_142":143},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16,"_17":11},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","dockerRebrandTour","routes/_layout",{"_20":-5,"_21":22,"_23":22,"_24":11,"_25":22},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_28":29,"_30":-5,"_31":11,"_32":11,"_33":34,"_35":36,"_37":-5,"_38":11,"_39":40,"_89":-5,"_90":91,"_130":-5,"_131":11,"_132":22,"_133":11,"_134":11,"_135":-5,"_136":11,"_137":-5,"_138":139,"_140":92,"_141":-7},"canonicalUrl","https://hub.docker.com/r/eranchetz/imageproxy/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","eranchetz","reponame","imageproxy","cloudBuildSource","isAutobuildsAvailable","repo",{"_41":42,"_43":44,"_46":47,"_48":49,"_50":11,"_51":52,"_53":54,"_55":56,"_58":36,"_33":34,"_59":60,"_61":45,"_62":63,"_64":65,"_66":67,"_68":-5,"_69":63,"_70":71,"_72":11,"_73":34,"_74":75,"_80":22,"_81":82,"_86":34,"_87":88},"categories",[],"content_types",[45],"image","date_registered","2018-01-25T13:59:29.741122Z","description","A caching, resizing image proxy, a fork of willnorris.com/go/imageproxy with more security in place ","is_private","last_updated","2018-01-25T14:06:10.25511Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[57],"application/vnd.docker.container.image.v1+json","name","pull_count",216,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# imageproxy [![Build Status](https://travis-ci.org/willnorris/imageproxy.svg?branch=master)](https://travis-ci.org/willnorris/imageproxy) [![GoDoc](https://godoc.org/willnorris.com/go/imageproxy?status.svg)](https://godoc.org/willnorris.com/go/imageproxy) [![Apache 2.0 License](https://img.shields.io/badge/license-Apache%202.0-blue.svg?style=flat)](LICENSE)\n\nimageproxy is a caching image proxy server written in go. It features:\n\n - basic image adjustments like resizing, cropping, and rotation\n - access control using host whitelists or request signing (HMAC-SHA256)\n - support for jpeg, png, webp (decode only), tiff, and gif image formats\n (including animated gifs)\n - caching in-memory, on disk, or with Amazon S3, Google Cloud Storage, Azure\n Storage, or Redis\n - easy deployment, since it's pure go\n\nPersonally, I use it primarily to dynamically resize images hosted on my own\nsite (read more in [this post][]). But you can also enable request signing and\nuse it as an SSL proxy for remote images, similar to [atmos/camo][] but with\nadditional image adjustment options.\n\n[this post]: https://willnorris.com/2014/01/a-self-hosted-alternative-to-jetpacks-photon-service\n[atmos/camo]: https://github.com/atmos/camo\n\n\n## URL Structure ##\n\nimageproxy URLs are of the form `http://localhost/{options}/{remote_url}`.\n\n### Options ###\n\nOptions are available for cropping, resizing, rotation, flipping, and digital\nsignatures among a few others. Options for are specified as a comma delimited\nlist of parameters, which can be supplied in any order. Duplicate parameters\noverwrite previous values.\n\nSee the full list of available options at\n.\n\n### Remote URL ###\n\nThe URL of the original image to load is specified as the remainder of the\npath, without any encoding. For example,\n`http://localhost/200/https://willnorris.com/logo.jpg`.\n\nIn order to [optimize caching][], it is recommended that URLs not contain query\nstrings.\n\n[optimize caching]: http://www.stevesouders.com/blog/2008/08/23/revving-filenames-dont-use-querystring/\n\n### Examples ###\n\nThe following live examples demonstrate setting different options on [this\nsource image][small-things], which measures 1024 by 678 pixels.\n\n[small-things]: https://willnorris.com/2013/12/small-things.jpg\n\nOptions | Meaning | Image\n--------|------------------------------------------|------\n200x | 200px wide, proportional height | $\"200x\"$ \nx0.15 | 15% original height, proportional width | $\"x0.15\"$ \n100x150 | 100 by 150 pixels, cropping as needed | $\"100x150\"$ \n100 | 100px square, cropping as needed | $\"100\"$ \n150,fit | scale to fit 150px square, no cropping | $\"150,fit\"$ \n100,r90 | 100px square, rotated 90 degrees | $\"100,r90\"$ \n100,fv,fh | 100px square, flipped horizontal and vertical | $\"100,fv,fh\"$ \n200x,q60 | 200px wide, proportional height, 60% quality | $\"200x,q60\"$ \n200x,png | 200px wide, converted to PNG format | $\"200x,png\"$ \ncx175,cw400,ch300,100x | crop to 400x300px starting at (175,0), scale to 100px wide | $\"cx175,cw400,ch300,100x\"$ \n\nTransformation also works on animated gifs. Here is [this source\nimage][material-animation] resized to 200px square and rotated 270 degrees:\n\n[material-animation]: https://willnorris.com/2015/05/material-animations.gif\n\n $\"200,r270\"$ \n\nThe smart crop feature can best be seen by comparing the following images, with and without smart crop.\n\n $\"200x400,sc\"$ \n $\"200x400\"$ \n\n## Getting Started ##\n\nInstall the package using:\n\n go get willnorris.com/go/imageproxy/cmd/imageproxy\n\nOnce installed, ensure `$GOPATH/bin` is in your `$PATH`, then run the proxy\nusing:\n\n imageproxy\n\nThis will start the proxy on port 8080, without any caching and with no host\nwhitelist (meaning any remote URL can be proxied). Test this by navigating to\n and\nyou should see a 500px square coder octocat.\n\n### Cache ###\n\nBy default, the imageproxy command does not cache responses, but caching can be\nenabled using the `-cache` flag. It supports the following values:\n\n - `memory` - uses an in-memory LRU cache. By default, this is limited to\n 100mb. To customize the size of the cache or the max age for cached items,\n use the format `memory:size:age` where size is measured in mb and age is a\n duration. For example, `memory:200:4h` will create a 200mb cache that will\n cache items no longer than 4 hours.\n - directory on local disk (e.g. `/tmp/imageproxy`) - will cache images\n on disk\n - s3 URL (e.g. `s3://region/bucket-name/optional-path-prefix`) - will cache\n images on Amazon S3. This requires either an IAM role and instance profile\n with access to your your bucket or `AWS_ACCESS_KEY_ID` and `AWS_SECRET_KEY`\n environmental variables be set. (Additional methods of loading credentials\n are documented in the [aws-sdk-go session\n package](https://docs.aws.amazon.com/sdk-for-go/api/aws/session/)).\n - gcs URL (e.g. `gcs://bucket-name/optional-path-prefix`) - will cache images\n on Google Cloud Storage. This requires `GCP_PRIVATE_KEY` environmental\n variable be set.\n - azure URL (e.g. `azure://container-name/`) - will cache images on\n Azure Storage. This requires `AZURESTORAGE_ACCOUNT_NAME` and\n - redis URL (e.g. `redis://hostname/`) - will cache images on\n the specified redis host. The full URL syntax is defined by the [redis URI\n registration](https://www.iana.org/assignments/uri-schemes/prov/redis).\n Rather than specify password in the URI, use the `REDIS_PASSWORD`\n environment variable.\n\nFor example, to cache files on disk in the `/tmp/imageproxy` directory:\n\n imageproxy -cache /tmp/imageproxy\n\nReload the [codercat URL][], and then inspect the contents of\n`/tmp/imageproxy`. Within the subdirectories, there should be two files, one\nfor the original full-size codercat image, and one for the resized 500px\nversion.\n\n[codercat URL]: http://localhost:8080/500/https://octodex.github.com/images/codercat.jpg\n\nIf the `-cache` flag is specified multiple times, multiple caches will be\ncreated in a [tiered fashion][]. Typically this is used to put a smaller and\nfaster in-memory cache in front of a larger but slower on-disk cache. For\nexample, the following will first check an in-memory cache for an image,\nfollowed by a gcs bucket:\n\n imageproxy -cache memory -cache gcs://my-bucket/\n\n[tiered fashion]: https://godoc.org/github.com/die-net/lrucache/twotier\n\n### Referrer Whitelist ###\n\nYou can limit images to only be accessible for certain hosts in the HTTP\nreferrer header, which can help prevent others from hotlinking to images. It can\nbe enabled by running:\n\n imageproxy -referrers example.com\n\n\nReload the [codercat URL][], and you should now get an error message. You can\nspecify multiple hosts as a comma separated list, or prefix a host value with\n`*.` to allow all sub-domains as well.\n\n### Host whitelist ###\n\nYou can limit the remote hosts that the proxy will fetch images from using the\n`whitelist` flag. This is useful, for example, for locking the proxy down to\nyour own hosts to prevent others from abusing it. Of course if you want to\nsupport fetching from any host, leave off the whitelist flag. Try it out by\nrunning:\n\n imageproxy -whitelist example.com\n\nReload the [codercat URL][], and you should now get an error message. You can\nspecify multiple hosts as a comma separated list, or prefix a host value with\n`*.` to allow all sub-domains as well.\n\n### Signed Requests ###\n\nInstead of a host whitelist, you can require that requests be signed. This is\nuseful in preventing abuse when you don't have just a static list of hosts you\nwant to allow. Signatures are generated using HMAC-SHA256 against the remote\nURL, and url-safe base64 encoding the result:\n\n base64urlencode(hmac.New(sha256, ).digest())\n\nThe HMAC key is specified using the `signatureKey` flag. If this flag\nbegins with an \"@\", the remainder of the value is interpreted as a file on disk\nwhich contains the HMAC key.\n\nTry it out by running:\n\n imageproxy -signatureKey \"secret key\"\n\nReload the [codercat URL][], and you should see an error message. Now load a\n[signed codercat URL][] and verify that it loads properly.\n\n[signed codercat URL]: http://localhost:8080/500,sXyMwWKIC5JPCtlYOQ2f4yMBTqpjtUsfI67Sp7huXIYY=/https://octodex.github.com/images/codercat.jpg\n\nSome simple code samples for generating signatures in various languages can be\nfound in [URL Signing](https://github.com/willnorris/imageproxy/wiki/URL-signing).\n\nIf both a whiltelist and signatureKey are specified, requests can match either.\nIn other words, requests that match one of the whitelisted hosts don't\nnecessarily need to be signed, though they can be.\n\n### Default Base URL ###\n\nTypically, remote images to be proxied are specified as absolute URLs.\nHowever, if you commonly proxy images from a single source, you can provide a\nbase URL and then specify remote images relative to that base. Try it out by\nrunning:\n\n imageproxy -baseURL https://octodex.github.com/\n\nThen load the codercat image, specified as a URL relative to that base:\n. Note that this is not an\neffective method to mask the true source of the images being proxied; it is\ntrivial to discover the base URL being used. Even when a base URL is\nspecified, you can always provide the absolute URL of the image to be proxied.\n\n### Scaling beyond original size ###\n\nBy default, the imageproxy won't scale images beyond their original size.\nHowever, you can use the `scaleUp` command-line flag to allow this to happen:\n\n imageproxy -scaleUp true\n\n### WebP and TIFF support ###\n\nImageproxy can proxy remote webp images, but they will be served in either jpeg\nor png format (this is because the golang webp library only supports webp\ndecoding) if any transformation is requested. If no format is specified,\nimageproxy will use jpeg by default. If no transformation is requested (for\nexample, if you are just using imageproxy as an SSL proxy) then the original\nwebp image will be served as-is without any format conversion.\n\nBecause so few browsers support tiff images, they will be converted to jpeg by\ndefault if any transformation is requested. To force encoding as tiff, pass the\n\"tiff\" option. Like webp, tiff images will be served as-is without any format\nconversion if no transformation is requested.\n\n\nRun `imageproxy -help` for a complete list of flags the command accepts. If\nyou want to use a different caching implementation, it's probably easiest to\njust make a copy of `cmd/imageproxy/main.go` and customize it to fit your\nneeds... it's a very simple command.\n\n## Deploying ##\n\nIn most cases, you can follow the normal procedure for building a deploying any\ngo application. For example, I build it directly on my production debian server\nusing:\n\n - `go build willnorris.com/go/imageproxy/cmd/imageproxy`\n - copy resulting binary to `/usr/local/bin`\n - copy [`etc/imageproxy.service`](etc/imageproxy.service) to\n `/lib/systemd/system` and enable using `systemctl`.\n\nInstructions have been contributed below for running on other platforms, but I\ndon't have much experience with them personally.\n\n### Heroku ###\n\nIt's easy to vendorize the dependencies with `Godep` and deploy to Heroku. Take\na look at [this GitHub repo](https://github.com/oreillymedia/prototype-imageproxy)\n\n### Docker ###\n\nA docker image is available at [`willnorris/imageproxy`](https://registry.hub.docker.com/u/willnorris/imageproxy/dockerfile/).\n\nYou can run it by\n```\ndocker run -p 8080:8080 willnorris/imageproxy -addr 0.0.0.0:8080\n```\n\nOr in your Dockerfile:\n\n```\nENTRYPOINT [\"/go/bin/imageproxy\", \"-addr 0.0.0.0:8080\"]\n```\n\n### nginx ###\n\nYou can use follow config to prevent URL overwritting:\n\n```\n location ~ ^/api/imageproxy/ {\n # pattern match to capture the original URL to prevent URL\n # canonicalization, which would strip double slashes\n if ($request_uri ~ \"/api/imageproxy/(.+)\") {\n set $path $1;\n rewrite .* /$path break;\n }\n proxy_pass http://localhost:8080;\n }\n```\n\n## License ##\n\nimageproxy is copyright Google, but is not an official Google product. It is\navailable under the [Apache 2.0 License](./LICENSE).\n","has_starred","hub_user","immutable_tags_settings",{"_76":11,"_77":78},"enabled","rules",[79],".*","is_automated","permissions",{"_83":22,"_84":11,"_85":11},"read","write","admin","user","storage_size",6433228,"orgData","recentTags",[92],{"_93":45,"_94":95,"_96":97,"_98":99,"_100":101,"_51":119,"_120":95,"_121":34,"_122":57,"_58":123,"_124":125,"_126":110,"_127":119,"_128":67,"_129":22},"content_type","creator",77773,"full_size",6429071,"id",21224728,"images",[102],{"_103":104,"_105":106,"_107":108,"_109":110,"_111":112,"_113":114,"_115":108,"_116":-5,"_117":97,"_64":67,"_118":-5},"architecture","amd64","digest","sha256:dd72f4c34b4b7edae952d9a4c08f04f9d7bf2db0920b53eb94bd89dae21387cc","features","","last_pulled","2026-10-28T14:45:53.547263368Z","last_pushed","2018-01-25T14:06:10Z","os","linux","os_features","os_version","size","variant","2018-01-25T14:06:09.885663Z","last_updater","last_updater_username","media_type","latest","repository",3695723,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxRunInCloud","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_39":144,"_151":152,"_138":161,"_162":11},{"_41":145,"_43":146,"_46":47,"_48":49,"_50":11,"_51":52,"_53":54,"_55":147,"_58":36,"_33":34,"_59":60,"_61":45,"_62":63,"_64":65,"_66":67,"_68":-5,"_69":63,"_70":71,"_72":11,"_73":34,"_74":148,"_80":22,"_81":150,"_86":34,"_87":88},[],[45],[57],{"_76":11,"_77":149},[79],{"_83":22,"_84":11,"_85":11},"tags",{"_153":65,"_154":-5,"_155":-5,"_156":157},"count","next","previous","results",[158],{"_93":45,"_94":95,"_96":97,"_98":99,"_100":159,"_51":119,"_120":95,"_121":34,"_122":57,"_58":123,"_124":125,"_126":110,"_127":119,"_128":67,"_129":22},[160],{"_103":104,"_105":106,"_107":108,"_109":110,"_111":112,"_113":114,"_115":108,"_116":-5,"_117":97,"_64":67,"_118":-5},[],"canDeleteTags","actionData","errors"]

eranchetz/imageproxy

Tags for eranchetz/imageproxy