The self-hosted image CDN that keeps the dashboard.

Why self-host an image CDN at all?

Not just another bare transform server

If you have shopped for self-hosted image optimization, you have found imgproxy, Thumbor, and ipx. They are all solid transform engines — Keenpix actually implements the full ipx modifier vocabulary, so w, h, fit, quality, blur, and friends behave the way you expect. The difference is everything around the transform:

To be fair to imgproxy — and to correct a claim you will see repeated elsewhere — basic watermarks and basic smart crop are in its open-source version. What Pro adds is the advanced tier: object-detection cropping, dynamic watermarks, autoquality, automatic best-format selection, and video/PDF thumbnails. If all you need is a fast, headless resize proxy and you already run Prometheus, a cache tier, and your own dashboards, imgproxy is a genuinely great piece of software.

Keenpix is for the team that wants the whole thing — engine, cache, security model, and observability — working in the next five minutes, with a UI a teammate can use without reading env-var docs.

The 60-second Docker quickstart

Keenpix ships as a single Node container (sharp needs Node, not an edge runtime) plus Postgres:

git clone https://github.com/lord007tn/keenpix && cd keenpix
cp .env.example .env
# set a strong secret:
#   BETTER_AUTH_SECRET=$(openssl rand -hex 32)
# set POSTGRES_PASSWORD, KEENPIX_SUPER_ADMIN_EMAIL, and KEENPIX_SUPER_ADMIN_PASSWORD
docker compose up -d --build
# → http://localhost:3000

The container runs migrations, seeds your admin user, and serves both the dashboard and the transform endpoint. From there: sign in, create a project pointed at your image origin, add that origin to the allowlist, and request your first transform — no API key required in the URL. It also deploys as a one-click Coolify service if that is your platform. The deploy guide walks through every step.

Architecture: it sits behind your CDN

Keenpix is not trying to replace Cloudflare's cache — it is designed to be its origin shield:

Browser ──▶ Your CDN (Cloudflare, etc.) ──▶ Keenpix (Node + sharp) ──▶ your image origins
                cache /img/*                     │
                                                 ├── disk + memory cache (SWR)
                                                 └── Postgres (projects, request logs)

Transform responses are emitted public, max-age=31536000, immutable, so one Cloudflare Cache Rule on /img/* means the edge serves repeat traffic for free and Keenpix only works on cache misses. Between the edge cache and Keenpix's own two-tier cache with stale-while-revalidate, your actual origins see a small fraction of real traffic. The CDN setup guide has ready-made rules for Cloudflare, Nginx, and Caddy.

Security is deny-by-default: a project only fetches from origin hosts you have explicitly allowlisted, the fetcher is hardened against SSRF, and there are no public API keys to rotate or leak. If you want tamper-proof URLs on top, HMAC-signed URLs are available too.

Zero telemetry, AGPL, no rug-pull

The honest AGPL caveat: if you modify Keenpix and offer it to users over a network, the license requires you to share those modifications. Running it unmodified for your own sites — which is what almost everyone does — carries no such obligation.

Honest limitations

You should know what Keenpix is not before you deploy it:

• No video. Images only — if you need video transcoding, look at Cloudinary or Gumlet.
• No storage or DAM. Keenpix transforms and delivers from origins you already have — S3, R2, your app server. There is no upload API, no media library, no asset search.
• Young product. Keenpix is newer than everything in the table above and built by a solo founder. The flip side: it is small enough to read in an afternoon, and issues get answered by the person who wrote the code.
• Custom domains are not yet available on the managed cloud (self-hosters, of course, use whatever domain they want).

When something else is the better choice

• imgproxy — you want a headless MIT-licensed Go binary and you already own your cache, metrics, and dashboards — or you need Pro’s video/PDF thumbnails.
• Thumbor — you are invested in its Python plugin ecosystem.
• ipx — you are on Nuxt and want in-process optimization with no extra service.
• Cloudinary or ImageKit — you need DAM, video, and AI features under one roof and the pricing works for your volume.
• Bunny Optimizer — you want the lowest possible flat cost for a single site and can live without AVIF output, analytics, or self-hosting; at $9.50/mo per website plus ~$0.01/GB CDN bandwidth (as of July 2026) it is the one rival that can undercut Keenpix at scale.

Frequently asked questions

Is the self-hosted version really free?

Yes. The self-hosted engine is AGPL-3.0 — free forever, full-featured, no seat limits, no transform limits, no telemetry. You pay only for your own server. Our business is the managed cloud: the same engine, hosted, from $9/mo for 100 GB delivered with unlimited transformations (as of July 2026). Self-hosting is not a lead magnet with the good parts held back; it is the product.

How does Keenpix compare to imgproxy?

imgproxy is an excellent transform engine, and its open-source version includes more than people give it credit for — basic watermarks and basic smart crop are OSS, not Pro. What it deliberately does not include: a dashboard, analytics, or a cache layer — you assemble those yourself. Keenpix ships the assembled system: transforms plus two-tier caching, UI-managed per-project allowlists, and bandwidth, cache-hit, and latency analytics, in one container. If you want a headless building block, choose imgproxy. If you want the finished pipeline, choose Keenpix.

Does Keenpix replace my CDN?

No — it complements it. Keenpix is the origin shield that sits behind Cloudflare (or any CDN) and generates the optimized variants your edge then caches. Transform responses are emitted with long-lived immutable cache headers, so one cache rule on /img/* means the edge serves repeat traffic for free and Keenpix only works on cache misses.

Where do my images live?

Wherever they live now. Keenpix has no upload step and no storage — it fetches from your existing origins (only ones you have allowlisted), transforms, caches, and delivers. Removing Keenpix later means removing a URL prefix, not migrating a media library. That is deliberate: the easier we make leaving, the less you have to trust us.

Can I move to the managed cloud later?

Yes, in either direction. Self-host and managed cloud run the same engine with the same URL scheme, so switching is a DNS-and-prefix change, not a rewrite. Teams start self-hosted for cost or compliance and hand us the ops later, or start on cloud (with a 14-day trial and spend caps on by default) and bring it in-house once volume justifies it.