Image optimization
Serve source images resized and converted to the size and format each request asks for.
With image optimization on, large source images are resized to fit the visitor's screen and converted to lighter formats such as WebP before they are sent. Results are cached, so later requests are served quickly.
Next.js needs no setup
The default Next.js image loader (next/image) is wired up automatically. Tune image options in next.config as usual, and do not add an images block to nitroship.json.
Other frameworks and static sites
Add images to nitroship.json at the deployment root.
{
"images": {
"protocol": "astro",
"domains": ["images.example.com"],
"remotePatterns": [
{"protocol": "https", "hostname": "cdn.example.com", "pathname": "/**"}
]
}
}protocol: which URL format to use (required)
Pick the format matching the image URLs your framework generates.
| Value | Default path | Example URL | Typically used by |
|---|---|---|---|
astro | /_image | /_image?href=/photo.png&w=640&f=webp | Astro |
ipx | /_ipx | /_ipx/w_640,f_webp/photo.png | Nuxt Image |
vercel | /_vercel/image | /_vercel/image?url=/photo.png&w=640&q=75 | Vercel image loader |
next | /_next/image | /_next/image?url=/photo.png&w=640&q=75 | Next.js format |
Set path to use a different path.
Which source images are allowed
- Remote images must be allowed explicitly. List hostnames in
domains, or useremotePatternsto pin down protocol, host, and path. - Images from your own site are all allowed by default. Narrow this with
localPatterns; an empty array ([]) denies them all. - Requests for a disallowed source or an unsupported transformation return
400.
Security
- SVG is off by default. SVGs can contain scripts, so enable
dangerouslyAllowSVGonly for sources you trust. dangerouslyAllowLocalIP, which would allow sources on private IPs, is not supported. Even if set, images from private networks stay blocked.
Caching
Optimized responses carry an X-Nextjs-Cache: MISS|HIT|STALE header. MISS means freshly converted, HIT means served from cache, and STALE means an expired cached copy was sent while a fresh one is converted in the background.