Image delivery
An on-the-fly image service that resizes and re-encodes from signed URLs, caches aggressively, and cannot be turned into an open proxy.
The problem
Product photos and article images are often far larger than the phone that shows them. It lets a site keep its originals where they are and ask for the size and format each page needs. The image is fetched, resized, re-encoded to a modern format and cached, so the next visitor gets it instantly.
Challenges
Not becoming an open proxy
A service that fetches any URL and returns an image is an abuse magnet. It only fetches from an exact allow-list of hosts with no wildcards, and every URL is HMAC-signed over the key, the transform and the source, so nobody can mint new transforms or point it at someone else’s images.
Caching that is safe forever
Because a different image or transform always means a different URL, every result can be cached for a year. Format negotiation varies on what the browser accepts, conditional requests return "not modified", and the disk cache writes to a temporary file and renames it, so a reader never sees a half-written image.
Keeping the machine up
Image decoding is memory-hungry, and one enormous upload can take a server down. The image engine runs behind a concurrency cap with a hard dimension ceiling, and phone photos are rotated from their orientation metadata before resizing.
Implementation
Separate control and data planes
The image server is its own binary that knows nothing about accounts; it asks the account service for permission with a token. That keeps the hot path small and lets image serving scale on its own machines.
Why this stack
- Go
- A small, fast data-plane binary with predictable memory use under concurrent load.
- libvips
- Streaming, low-memory image processing that is far faster than general-purpose libraries for resize-and-encode work.
What it does
- Width, height, quality, format and fit from the URL
- WebP, AVIF, JPEG and PNG output with browser negotiation
- HMAC-signed URLs with key rotation
- Year-long caching with atomic disk writes
- Usage metering per organisation
- Image processing on its own machines once traffic justifies it