The self-hosted image CDN that keeps the dashboard.

Why self-host an image CDN at all?

Not just another bare transform server

If you have shopped for self-hosted image optimization, you have found imgproxy, Thumbor, and ipx. They are all solid transform engines — Keenpix actually implements the full ipx modifier vocabulary, so w, h, fit, quality, blur, and friends behave the way you expect. The difference is everything around the transform:

To be fair to imgproxy — and to correct a claim you will see repeated elsewhere — basic watermarks and basic smart crop are in its open-source version. What Pro adds is the advanced tier: object-detection cropping, dynamic watermarks, autoquality, automatic best-format selection, and video/PDF thumbnails. If all you need is a fast, headless resize proxy and you already run Prometheus, a cache tier, and your own dashboards, imgproxy is a genuinely great piece of software.

Keenpix is for the team that wants the whole thing — engine, cache, security model, and observability — in one deployment, with a UI for normal project operations. Production readiness still requires secrets, backups, capacity checks, and the deployment validation described in the docs.

Docker quickstart

Keenpix ships as a single Node container (sharp needs Node, not an edge runtime) plus Postgres:

git clone https://github.com/lord007tn/keenpix && cd keenpix
cp .env.example .env
# set a strong secret:
#   BETTER_AUTH_SECRET=$(openssl rand -hex 32)
# set POSTGRES_PASSWORD, KEENPIX_SUPER_ADMIN_EMAIL, and KEENPIX_SUPER_ADMIN_PASSWORD
docker compose up -d --build
# → http://localhost:3000

The container runs migrations, seeds your admin user, and serves both the dashboard and the transform endpoint. From there: sign in, create a project pointed at your image origin, add that origin to the allowlist, and request your first transform — no API key required in the URL. The repository also includes a Coolify deployment path. The deploy guide walks through every step.

Architecture: it sits behind your CDN

Keenpix is not trying to replace Cloudflare's cache — it is designed to be its origin shield:

Browser ──▶ Your CDN (Cloudflare, etc.) ──▶ Keenpix (Node + sharp) ──▶ your image origins
                cache /img/*                     │
                                                 ├── disk + memory cache (SWR)
                                                 └── Postgres (projects, request logs)

Transform responses are emitted public, max-age=31536000, immutable, so one Cloudflare Cache Rule on /img/* lets the edge answer cached repeat requests without reaching Keenpix. Keenpix's two-tier cache with stale-while-revalidate can also avoid repeated origin fetches. The actual edge, Keenpix, and origin hit rates depend on your traffic and cache configuration and should be measured in your environment. The CDN setup guide has ready-made rules for Cloudflare, Nginx, and Caddy.

Security is deny-by-default: a project only fetches from origin hosts you have explicitly allowlisted, the fetcher is hardened against SSRF, and there are no public API keys to rotate or leak. If you want tamper-proof URLs on top, HMAC-signed URLs are available too.

Zero telemetry and published license terms

AGPL-3.0 generally requires operators who modify the program and offer it over a network to provide the corresponding source to those users. Review the license itself and obtain legal advice for your deployment; this page is not legal guidance.

Honest limitations

You should know what Keenpix is not before you deploy it:

• No video. Images only — if you need video transcoding, look at Cloudinary or Gumlet.
• No storage or DAM. Keenpix transforms and delivers from origins you already have — S3, R2, your app server. There is no upload API, no media library, no asset search.
• Young product. Keenpix is newer than the alternatives in the table above and built by a solo founder. The repository is available for teams to audit directly, but maturity and support depth should be evaluated against your own requirements.
• Managed custom delivery domains require Pro or Business; self-hosters use whatever domains their reverse proxy supports.

When something else is the better choice

• imgproxy — you want a headless Apache-2.0-licensed Go binary and you already own your cache, metrics, and dashboards — or you need Pro’s video/PDF thumbnails.
• Thumbor — you are invested in its Python plugin ecosystem.
• ipx — you are on Nuxt and want in-process optimization with no extra service.
• Cloudinary or ImageKit — you need DAM, video, and AI features under one roof and the pricing works for your volume.
• Bunny Optimizer — you want a $9.50/month per-website optimizer fee plus separately billed CDN bandwidth. Bunny Optimizer added GA AVIF output in June 2026 and has no self-host path; compare its region-specific bandwidth price with your own traffic rather than assuming a universal lowest cost.

Frequently asked questions

Is the self-hosted version really free?

The current v0.3.0 source is AGPL-3.0, with no Keenpix license fee, team-member limit, transform limit, or telemetry. You operate and pay for the infrastructure. Managed cloud starts at $9/month for 100 GB of managed image delivery with unlimited transformations and team members (as of August 2026).

How does Keenpix compare to imgproxy?

imgproxy is an excellent transform engine, and its open-source version includes more than people give it credit for — basic watermarks and basic smart crop are OSS, not Pro. What it deliberately does not include: a dashboard, analytics, or a cache layer — you assemble those yourself. Keenpix ships the assembled system as four focused services: transforms plus tiered caching, UI-managed per-project allowlists, and bandwidth, cache-hit, and latency analytics. If you want a headless building block, choose imgproxy. If you want the finished pipeline, choose Keenpix.

Does Keenpix replace my CDN?

No — it complements it. Keenpix is the origin shield that sits behind Cloudflare (or any CDN) and generates the optimized variants your edge then caches. Transform responses are emitted with long-lived immutable cache headers, so a cache rule on /img/* lets the edge handle repeat requests without reaching Keenpix. Your CDN may still charge for its own delivery.

Where do my images live?

Wherever they live now. Keenpix has no upload step and no storage — it fetches from your existing origins (only ones you have allowlisted), transforms, caches, and delivers. Removing Keenpix later means removing a URL prefix, not migrating a media library. That is deliberate: the easier we make leaving, the less you have to trust us.

Can I move to the managed cloud later?

The v0.3.0 cloud and self-host deployment paths share the transform URL grammar. Moving still requires a planned hostname, configuration, cache, database, and traffic migration; it is not only a DNS switch. Validate both directions with canary traffic before cutover.