An editor uploads a photo. The frontend asks for exactly the variant it needs — 600 pixels wide, 2x for retina, as AVIF if the browser supports it. RustyCMS renders it on first request, caches it, and serves it from memory after that. No Cloudinary, no imgproxy, no build step.
One endpoint, every variant
# 600px wide, retina, format negotiated from the Accept header
GET /api/transform?url=/api/assets/hero.jpg&w=600&dpr=2&format=auto
# Square crop around the focal point
GET /api/transform?url=/api/assets/portrait.jpg&w=400&h=400&fx=0.3&fy=0.2
# Ready-made <picture> sources for responsive images
GET /api/transform/srcset?url=/api/assets/hero.jpg&widths=400,800,1200&formats=avif,webp,jpegParameters: width, height, aspect ratio, fit (fill/contain/cover), focal point or anchor, format, quality, rotation, flip, grayscale. EXIF orientation is corrected automatically — the phone photo comes out the right way up without anyone thinking about it.
Format by browser, not by guesswork
format=auto reads the Accept header: AVIF if the browser can handle it, WebP otherwise, JPEG as the fallback. The cache key is bound to the format actually delivered and the response carries Vary: Accept — a Safari user never receives the AVIF that was rendered for Chrome.
Placeholders before the image arrives
/api/transform/metadata returns width, height, aspect ratio, dominant color and a blurhash. The frontend reserves the space and shows a blurred preview before a single byte of the real image has loaded. The blurhash can be fetched as a tiny JPEG — cache-immutable, one request for the whole site.
Two-tier cache, render once
An in-memory LRU with a byte budget first, a disk layer behind it that survives a restart. If ten visitors request the same not-yet-rendered variant at once, only one decode runs — the others wait for its result. Responses carry an ETag and Cache-Control: immutable, so a reverse proxy or CDN in front keeps the load off the process.
What doesn’t happen
External URLs are only processed if the host is explicitly allowlisted — the endpoint is not an open proxy. Redirects are not followed, source images over 64 megapixels are rejected. The pipeline is yours, not the internet’s.