How to Deploy and Configure Thumbor on Ubuntu 22.04
Introduction
Thumbor is an application that is capable of resizing, cropping, applying filters, and flipping images. Using Thumbor is very easy because people only need to access the URL of the Thumbor service for manipulating an image.
This guide explains how to install and deploy Thumbor on a Vultr Cloud Compute running on Ubuntu 22.04.
Prerequisites
Deploy a Vultr Cloud Compute running on Ubuntu 22.04.
Create a non-root user with sudo access and log in with SSH.
Update the Ubuntu Server.
Install Thumbor
Thumbor is a Python application and it's best to install via pip in a Python virtual environment. You can install Thumbor via apt, but the packages are only available for older Ubuntu versions.
Update the package information.
Install the Python virtual environment library.
Install the dependencies of Thumbor.
Create a virtual environment.
Activate the virtual environment.
Install Thumbor.
Optionally, check that all dependencies of Thumbor have been installed.
You'll get the version of Thumbor installed. Then, more importantly, you'll see all compiled extensions and libraries support of Thumbor.
You can also install Thumbor with Docker. First, you must install Docker itself.
Running Thumbor with Docker will be explained in the next section.
Launching Thumbor
To launch Thumbor, you can run the thumbor command inside the virtual environment:
The Thumbor application runs in the foreground. By default, it runs on port 8888.
Using Thumbor is as easy as accessing it via URL. Suppose you have an image that you want to resize or apply a filter that is located in this URL: https://upload.wikimedia.org/wikipedia/commons/3/37/Acorus_calamus1.jpg
You pass a remote image to Thumbor via URL. Because the port 8888 is not accessible by default to the public, you need to open another SSH session into the server. Once you're inside the server, you can access the image from Thumbor via the URL.
The small_pic.jpg file is the resized version of the Acorus_calamus1.jpg file. The unsafe part in the URL means you're using Thumbor in a non-secure way. Everyone can use your Thumbor server. Later in this article, you'll tweak the security setting. The 300x200 part means the modification you want to apply to an image with Thumbor. In this case, you resized the image to the 300-pixel width and the 200-pixel height. After that, you passed the full remote image URL to the URL.
The thumbor command that you're running now will die if you close the SSH session. To prevent that, you can run it in the background with screen or tmux.
But the proper way to run the thumbor service is to run it with Supervisor or Systemd.
You can run Thumbor on another port.
If you want to run Thumbor on port 80, you need the sudo permission. However, you cannot run sudo inside the Python virtual environment. The solution is to run the thumbor command outside the Python virtual environment.
Kill the thumbor command by Ctrl+C. Then deactivate the Python virtual environment.
Then you can run the thumbor command with the full path.
Then make sure you open port the 80 to public by using the iptables command.
This way, you can access Thumbor from outside with a browser using this URL, http://your_server_ip_address/unsafe/300x200/https://upload.wikimedia.org/wikipedia/commons/3/37/Acorus_calamus1.jpg. Because you haven't installed HTTPS yet, you need to make sure you access the server with the HTTP protocol. Finally, replace your_server_ip_address with your real IP address or domain.
To run Thumbor with Docker, you can launch it this way.
Then you can access Thumbor in port 8888. If you want to access it in port 80, you can map it to port 80.
Basic Usage of Thumbor
You've resized your image to be smaller. But you can flip the image as well using this URL, http://your_server_ip_address/unsafe/-300x-200/https://upload.wikimedia.org/wikipedia/commons/3/37/Acorus_calamus1.jpg.
The -300 part means you flipped the image horizontally. The -200 part means you flipped the image vertically.
You can apply a blurring filter to the image using this URL, http://your_server_ip_address/unsafe/filters:blur(10)/https://upload.wikimedia.org/wikipedia/commons/3/37/Acorus_calamus1.jpg.
There is not the only filter you can use. To make your image gray or black and white, open this URL, http://your_server_ip_address/unsafe/filters:grayscale()/https://upload.wikimedia.org/wikipedia/commons/3/37/Acorus_calamus1.jpg.
You can also combine filters with this URL, http://your_server_ip_address/unsafe/filters:noise(300):round_corner(60,255,255,255)/https://upload.wikimedia.org/wikipedia/commons/3/37/Acorus_calamus1.jpg.
You can also combine the resizing command and the filters using this URL, http://your_server_ip_address/unsafe/400x400/filters:noise(300)/https://upload.wikimedia.org/wikipedia/commons/3/37/Acorus_calamus1.jpg.
Kill Thumbor because you want to configure it and launc it with the configuration file.
Configuration of Thumbor
You can configure the behaviors of Thumbor with a configuration file. First, create a sample configuration file.
You can read the configuration of Thumbor. It's full of comments.
Edit the settings of Thumbor. Uncomment MAX_WIDTH and set it to this value.
This setting means the maximum width of the image you're allowed to read.
Then run the thumbor command with the configuration file.
Open this URL, http://your_server_ip_address/unsafe/400x400/https://upload.wikimedia.org/wikipedia/commons/3/37/Acorus_calamus1.jpg.
You'll see the width of the image is much smaller than the height of the image even if you ask for a square image (400x400).
Kill Thumbor and edit the configuration file again. Uncomment FILE_STORAGE_ROOT_PATH and set it with this value.
Then run Thumbor again using the configuration file. Open the same URL, http://your_server_ip_address/unsafe/400x400/https://upload.wikimedia.org/wikipedia/commons/3/37/Acorus_calamus1.jpg.
Then kill Thumbor again. You can see Thumbor saves the image in the /tmp/storage directory.
If you use Thumbor with Docker, you can configure it with environment variables.
Security of Thumbor
You noticed that there is the unsafe part in the URL of your Thumbor URL. What it means is everyone can use your Thumbor service. There is no authorization. Attackers can overwhelm your Thumbor service, especially when they ask your Thumbor to do heavy processing like upscaling images and applying filters.
You can prevent that by signing your image URLs to avoid tampering.
Edit the configuration file and uncomment two settings and set them to these values.
Run the thumbor command with the configuration file.
If you access this URL, http://your_server_ip_address/unsafe/400x400/https://upload.wikimedia.org/wikipedia/commons/3/37/Acorus_calamus1.jpg, you will get this warning.
To use the Thumbor service, you need to generate the safe URL of the remote image. To generate it, you can use the Python library thumbor.
Then create a Python script and name it generate_safe_url.py. Add the following content to it:
You can see that you used the security key that you saved in the Thumbor configuration file.
Run the script.
You get the safe URL without the server URL.
Append the safe URL to your server IP address to get the complete safe URL, http://your_server_ip_address/4XITN9gQ72mGQ6GuNMU7g1xIyXI=/400x400/https://upload.wikimedia.org/wikipedia/commons/3/37/Acorus_calamus1.jpg.
The unsafe part is replaced with the 4XITN9gQ72mGQ6GuNMU7g1xIyXI= part. For every remote image, that cryptic part will be different. Attackers cannot know it in advance unless they know your security key.
If you use Thumbor with Docker, you can set the security setting this way.
If you don't use Python, there are other libraries that can generate safe URLs for different programming languages. You can explore here.
More Information
To learn more about Thumbor, please see these resources.
0 Comments
Be the first to comment and share your perspective with the community.