Skip to main content

picfit

picfit is available in the NetActuate Marketplace as a one-click, open-source appliance you can deploy into any NetActuate PoP. On-the-fly image resize, crop and thumbnail proxy over filesystem, S3 or GCS. It is grouped under the Media & Streaming category.

What It Does​

picfit is an open-source, self-hosted image-manipulation proxy written in Go. It resizes, crops and thumbnails images on the fly from simple HTTP URLs, acting as a proxy in front of your storage engine and sitting ideally behind an HTTP cache.

Key features

  • On-the-fly resize, thumbnail, fit and crop from clean URLs (e.g. /display/resize/300x200/photo.jpg)
  • Multiple storage backends: local filesystem, Amazon S3, DigitalOcean Spaces and Google Cloud Storage
  • Pluggable key/value stores (in-memory cache or Redis) so each transform is computed once and reused
  • Optional HMAC-signed URLs so only your application can request transforms
  • A /healthcheck endpoint and a tiny, stateless footprint, ideal behind a CDN or cache
  • Single self-contained service, no external database to run

Use cases

  • A self-hosted image CDN origin that generates responsive image variants on demand
  • Adding resize/thumbnail capability in front of an existing S3 or GCS media bucket
  • Media and publishing sites that need thumbnails and derivatives without a SaaS

Why run it on the NetActuate edge Running picfit in a PoP near your audience shortens the path for image delivery and keeps transformation and your source media on infrastructure you control. Pair it with a cache in front and it becomes a fast, private image CDN origin.

Deployed from the NetActuate marketplace, picfit boots ready to use: a filesystem storage backend, an in-memory key store and a bundled sample image are pre-configured, so a transform URL such as /display/resize/300x200/sample.jpg returns a resized image immediately. A co-located landing page at / shows you the endpoints; drop your own images into the storage directory, or reconfigure S3/GCS, to serve your library. URL signing is available (off by default so transforms work out of the box); put TLS termination in front for public use.

Vendor and Project​

picfit is an open-source project, offered here under the Open Source listing with best-effort community support.

NetActuate supports the underlying infrastructure. Application-level support follows the listing SLA class (open-source, best effort).

Sizing​

vCPURAMDisk
Minimum11 GB20 GB
Recommended22 GB40 GB

No VPU (hardware acceleration) is required for this appliance. Choose a size at deploy based on your expected load.

Configuration Fields​

When you deploy, you provide these fields. They are written into the appliance at first boot.

FieldRequiredDefaultNotes
HTTP portNo3001Published host port for the picfit appliance (default 3001).
Signing keyNononeOptional HMAC signing key (picfit secret_key). Blank = unsigned transform URLs allowed (the default, transforms work immediately). Set a value to require signed transform URLs. Printable non-whitespace, 8 to 128 chars. Stored in your secret list. Stored write-only in your account secret list

Using the Appliance​

Deploy in minutes

  1. Open the landing page. Browse to http://YOUR_VM_IP:3001/ for a live instructions page; it returns HTTP 200 when the appliance is serving. picfit also exposes http://YOUR_VM_IP:3001/healthcheck .
  2. Transform the bundled sample. A sample image ships as sample.jpg. Request http://YOUR_VM_IP:3001/display/resize/300x200/sample.jpg to get a resized image; other operations include thumbnail, fit and fill.
  3. Serve your own images. Drop images into /opt/picfit/images on the VM (mounted into the container as the filesystem source storage) and request them by filename, or edit /opt/picfit/config.json to point picfit at an S3/GCS bucket, then run docker compose up -d from /opt/picfit .

Exposure posture: the appliance serves plain HTTP on the seeded port. URL signing is off by default so transforms work immediately; set a signing key (the Signing key seed field, or secret_key in /opt/picfit/config.json) to require an HMAC-signed sig on every transform URL. For public/production use, put a TLS-terminating proxy (or a real hostname with a certificate) and ideally a cache in front.

FAQ​

Is there a software license fee? No. picfit is open source and free to run. You pay only for the NetActuate infrastructure and bandwidth.

Which port does the appliance serve on? The primary service is published on port 3001 by default; see the configuration fields for any adjustable ports.

Who supports it? NetActuate operates the underlying infrastructure. The application itself is community-supported open source (best-effort SLA class).

Version and Changelog​

VersionStatusReleased
0.16.1Current (default)2026-07-14

Deploy​

Need Help?​

Contact support@netactuate.com or open a support ticket from the portal.