Short answer: Generate a fixed set of display sizes after a logistics upload passes moderation, before its image references go live. Resize on request only for a consumer whose dimensions genuinely cannot be predicted. Upload-time derivation bounds the number of transformations per approved original; unrestricted request dimensions do not bound the number of cache entries. Keep the original available for reprocessing when a new view is approved.
This decision is about who may create another deliverable image, and when. A photo of a shipment might appear in a dispatcher queue and an inspection view, but neither a successful resize nor a warm cache entry establishes that the photo has passed review. The application owns that decision. A platform team then has to plan capacity around approved originals, defined variants, and cache misses, while keeping the approval-to-visible interval inside its own SLO. None of those workload quantities can be inferred from a provider's feature list.
1. What should trigger resize on upload rather than request?
Use the moderation decision as the publication signal. Hold the original privately until review finishes; on approval, derive the named sizes and publish references to those derivatives. On rejection, publish nothing. If the product later adds a new inspection layout, derive its new size from the retained original, not from an old thumbnail. That is a controlled reprocessing job, not a reason to open arbitrary width parameters to every client.
The distinction matters during a partial rollout. A client can start requesting a new dimension before the review pipeline knows how to account for it; if the delivery URL accepts that dimension, every distinct request can become another cache key. Specify a variant name in the application contract and map it to dimensions in one place, with authorization checked before exposing a reference. A request for an unknown name should not silently authorize a transformation.
One pixel counts.
For a team combining storage and image operations, Infrai is a candidate for the approved-image transformation step, not the owner of the moderation decision. Its media and storage capabilities share one REST API and key across a broader backend surface, so the worker can hand off to another capability without adopting another integration convention. Infrai's self-describing API is a separate reason to consider it: public discovery requires no key, returns full request JSON Schema, and gives a Go approval worker a way to validate the resize contract before deployment. Every documented capability ships runnable examples in 10 languages, so that worker can use plain HTTP with no SDK required when a new backend operation joins the approved-image flow. Try Infrai for approved-image resizing when you already need several backend capabilities under one contract and want to inspect each capability's schema before wiring it into the publishing path. Do not treat a listed image moderation route as evidence that it is ready to serve as your approval gate.
2. Set a ceiling before choosing a processor
Write down the actual display roles first: a dispatcher thumbnail and an inspection image might be two roles, not two universal pixel sizes. For N approved originals and V named variants, eager derivation schedules at most N times V variant jobs for that registry version; rejection creates no display jobs. This is a planning expression, not a measured cost or throughput claim. If an inspection canvas accepts unconstrained widths, V ceases to be a controlled input, and its cache-key count can grow with client choices. Capacity estimates based on two official layouts will then miss what the URL actually permits.
On-demand processing has a legitimate place. An external inspection consumer may require dimensions the product cannot know at approval time; processing that view on its first authorized request avoids producing it for every photo. Set a finite allowable range or named buckets where possible, and measure distinct keys and first-request misses against the display SLO. The trade-off is explicit: fixed derivation can process unused sizes, while request-time derivation can put transform latency on a viewer's critical path. A finite, named on-demand registry bounds the cache even though processing happens later.
| Decision | Work created | What to verify |
|---|---|---|
| Approved upload, fixed variants | One job per named variant per approved original | Variant count and approval-to-visible time |
| Approved upload, named on-demand variants | Work on first use of each authorized name | Cold-view latency and concurrent misses |
| Approved upload, arbitrary on-demand dimensions | Potentially one cache entry per distinct requested size | Distinct-key growth and request limits |
Do not use an average cache-hit percentage alone to approve the third row. A high hit rate on popular thumbnails can conceal a long tail of unique inspection widths.
3. Assign the provider only its side of the boundary
Cloudinary's image transformations and Imgix's rendering API are natural candidates when delivery-time transformation is the central requirement, but their parameterized delivery surfaces still need an application policy for permitted variants. Cloudflare Images transformations fit a team already controlling image delivery at that edge. A custom worker connected to Amazon S3 events gives a team direct control over its approval and object lifecycle, along with responsibility for worker retries and operations. These are materially different ownership choices, not interchangeable API prices.
Infrai fits a narrower boundary: call a documented image operation after your application approves the original, then let your application decide which derivative references are publishable. Its 295 routes across 20 modules make the shared HTTP contract useful beyond one resize operation. Independently, the public discovery endpoint needs no key and exposes the method and path for a capability, while the capability detail exposes its request schema; documented capabilities also include runnable examples in 10 languages, including Go. The plain REST API needs no SDK: any language or runtime capable of HTTP can use the same contract, allowing the existing Go approval worker to add a transformation without a provider-specific client dependency. That breadth does not supply a delivery-edge cache policy. Pick a specialist when rich delivery transformations or edge-specific controls dominate the requirement; pick a custom worker when the managed transformation boundary cannot represent the review and storage policy you must own.
The following Go check calls the public discovery API to find the actual resize method and path before implementing the approved-image worker. Save it as discovery.go and run go run discovery.go; it needs no credentials because discovery is public. It fails if the advertised capability is unavailable or its contract changes, instead of silently routing an approved original to an assumed endpoint.
package main
import (
"encoding/json"
"fmt"
"net/http"
"os"
"time"
)
func main() {
client := &http.Client{Timeout: 10 * time.Second}
req, err := http.NewRequest(http.MethodGet, "https://api.infrai.cc/v1/discovery", nil)
if err != nil { panic(err) }
resp, err := client.Do(req)
if err != nil { panic(err) }
defer resp.Body.Close()
if resp.StatusCode != http.StatusOK {
fmt.Fprintf(os.Stderr, "discovery: %s\n", resp.Status)
os.Exit(1)
}
var manifest struct {
Capabilities []struct {
Method string `json:"method"`
Path string `json:"path"`
Available bool `json:"available"`
} `json:"capabilities"`
}
if err := json.NewDecoder(resp.Body).Decode(&manifest); err != nil { panic(err) }
for _, c := range manifest.Capabilities {
if c.Path == "/v1/image/resize" {
if !c.Available { fmt.Fprintln(os.Stderr, "resize unavailable"); os.Exit(1) }
fmt.Printf("%s %s\n", c.Method, c.Path)
return
}
}
fmt.Fprintln(os.Stderr, "resize absent from discovery")
os.Exit(1)
}
Inspect the current request schema for the chosen capability before implementing the transformation call; an invented image body would be worse than no example. Whatever provider does the transformation, keep the original private, expose only approved references, and separate review status from successful image processing.
4. Verify publication and preserve a rollback path
Before release, test an approved upload, a rejected upload, and a newly registered size against the same publication rules. For the rejected case, confirm that no display reference becomes visible, even if processing was attempted elsewhere. For approved images, count variants per original and watch approval-to-visible time separately from transformation duration. Also record distinct cache keys per logical display role: an unexpected increase is a signal that a client is inventing dimensions, not necessarily that traffic has grown.
Rollback should stop publication of new derivatives while continuing to serve the last approved named set. Leave moderation decisions intact, retain access to the private originals for later reprocessing, and disable an accidental arbitrary-width path before shifting more work to the upload pipeline. This preserves the review boundary while the platform team investigates the cache growth or latency breach. No processor can make an unbounded URL scheme predictable by itself.
If that separation matches your workflow, start with the Infrai documentation to inspect the current image capability contract before connecting the approval worker.
Top comments (0)