ImageEngine Kube
Features Configurator Docs ArtifactHub GitHub Get API key
Enterprise · self-hosted · imageengine-kube

Cloud-native image optimization, running in your Kubernetes cluster.

Enterprise-grade and self-hosted, packaged as a signed Helm chart that runs on the infrastructure you already own. Install on any major provider in a handful of commands — scale on your own terms, without per-request SaaS pricing.

Get your API key → Size your cluster Read the docs
Signed with GPG & cosign SBOM + SLSA provenance
install · imageengine-kube
1 · Namespace & secrets 
kubectl create namespace imageengine

kubectl create secret generic ie-kube-api-key -n imageengine \
  --from-literal=KEY=<your-api-key>

kubectl create secret docker-registry ie-kube-image-pull -n imageengine \
  --docker-server=https://docker.scientiamobile.com/v2/ \
  --docker-username=<your-email> \
  --docker-password=<your-api-key> \
  --docker-email=<your-email>
2 · Add the Helm repo 
helm repo add imageengine https://kube.imageengine.io
helm repo update
3 · Install 
helm install imageengine-kube imageengine/imageengine-kube \
  -n imageengine --set provider=aws
EKS provisions an AWS Network Load Balancer for the edge service — make sure the AWS Load Balancer Controller is installed in your cluster.
Built for the enterprise

Enterprise-grade from the first install.

Everything a large team needs to run image optimization in-house: a supply chain you can verify, a footprint that scales with your traffic, and telemetry that plugs straight into your existing stack — all under your own cost controls.

Verifiable supply chain

Every artifact the chart ships is signed and auditable before it ever runs.

✓GPG-signed charts from v0.8.5 onward
✓cosign-signed images for every container
✓SBOM + SLSA provenance shipped alongside
✓Optional Kyverno / sigstore admission enforcement
✓Zero critical vulnerabilities — every image scanned before release

Built to scale

From a small PoC cluster to a sharded, 3-tier caching layer — the footprint follows your traffic.

✓Horizontal autoscaling out of the box
✓Sharded cache layers for high hit rates
✓Runs comfortably on small pods
✓Tunable replicas & cache sizing

Observable by default

See exactly what the edge is doing — telemetry that drops straight into your stack.

✓Prometheus metrics from every pod
✓OpenTelemetry traces end to end
✓Sentry error reporting built in
✓ECS structured logs in JSON

Optimization, built in.

The full ImageEngine optimization pipeline ships inside the chart — no separate service to wire up.

Instant global cache purging
Flush optimized assets everywhere the moment your source changes.
Rules engine
Codify optimization tweaks once and apply them across your whole library.
ImageEngine Directives
Resize, crop and tune straight from the URL — ?imgeng=/w_1200/h_600.
Modern formats, automatically
AVIF, HEIF and WebP served to every device that supports them.
Client hints
Perfect sizing from the browser's own viewport and DPR signals.
Works with every major CDN
Drop it in front of CloudFront, Fastly, Akamai and the rest.
Before you install
Active trial or subscription
Your ImageEngine API key authenticates to the control plane and pulls images from docker.scientiamobile.com.
Two Kubernetes secrets
The chart won't create them for you — an API-key secret and a docker-registry pull secret, both in the install namespace.
Helm 3 + a supported cluster
AWS EKS, Azure AKS, DigitalOcean, GKE, Akamai Linode, or any conformant self-managed Kubernetes.
Verify signatures

Trust, but verify.

Every chart and every container image is cryptographically signed. Check them yourself, against our published keys, before anything runs in your cluster.

Chart · GPG 
curl -fsSL https://kube.imageengine.io/pubkey.asc \
  | gpg --dearmor > ~/.gnupg/imageengine-kube.kbx

helm install imageengine-kube imageengine/imageengine-kube \
  --verify --keyring ~/.gnupg/imageengine-kube.kbx
Key fingerprint
C3A5 5111 ED91 FEDE 4A82  A4B4 4632 6606 0957 C4B3
Charts published from v0.8.5 onward are signed.
Container images · cosign 
curl -fsSLO https://kube.imageengine.io/cosign.pub

cosign verify --key cosign.pub \
  docker.scientiamobile.com/iekube/imageengine-backend.server:<tag>
Every image ships an SBOM and SLSA build provenance alongside its signature.

Verifying every image, reading the SBOM and provenance, and optional in-cluster admission enforcement (Kyverno / sigstore policy-controller) are covered in the security guide.

Documentation & resources

Everything lives alongside the source on GitHub.

Getting started →
The full first-deployment walkthrough, start to finish.
Sizing configurator →
Generate a values-override.yaml sized for your traffic and catalog.
Customizations →
Replicas, autoscaling, ingress, TLS, OSC and Varnish tuning.
Requirements & sizing →
Kubernetes version, storage, network and recommended footprints.
Security →
Image signatures, SBOM, provenance and in-cluster enforcement.
Troubleshooting →
Common issues and how to get pods back to Running.
Provider guides →
AWS, Azure, DigitalOcean, GKE, Linode and self-managed presets.
ArtifactHub listing index.yaml pubkey.asc (GPG) cosign.pub Chart README
Maintained by ScientiaMobile kube.imageengine.io