Across e-commerce marketplaces, real estate portals, and media publications, raster images account for 60% to 78% of total CDN egress bytes. Transcoding legacy JPEG and PNG originals into modern WebP and AVIF formats reduces outbound bandwidth volume by 35% to 62% at equivalent SSIM/VMAF visual quality.
However, third-party SaaS Image CDNs frequently charge per "Master Origin Image" or per "Unique Transformation," which can cost more than the bandwidth saved. This guide evaluates codec compression ratios, `Vary: Accept` header normalization, and the TCO of managed edge transformation versus self-hosted `imgproxy` / `libvips` clusters.
Empirical Codec Compression & CPU Encode Matrix (SSIM = 0.985)
Benchmarks measured across a 10,000-image e-commerce and editorial corpus resized to `1200×800` at visually lossless perceptual quality:
| Image Codec | Median Payload Size | Bandwidth Reduction | CPU Encode Time (1 Core) | Global Browser Support |
|---|---|---|---|---|
| Baseline JPEG (`mozjpeg` q=82) | 184 KB | 0.0% (Baseline) | 18 ms | 100.0% |
| WebP (`libwebp` q=80, m=4) | 118 KB | -35.9% | 34 ms | 97.8% |
| AVIF (`libaom/svt` q=68, speed=6) | 79 KB | -57.1% | 145 ms | 94.6% |
The AVIF CPU vs. Bandwidth Trade-Off: While AVIF reduces CDN egress bandwidth by **57.1%** compared to JPEG (and 33% compared to WebP), encoding AVIF at `speed=6` consumes roughly **4.2x more CPU cycles** than WebP. Consequently, high-traffic platforms serve WebP on initial uncached edge misses (for <35ms TTFB) while queueing asynchronous background workers to encode and replace the cache entry with AVIF for subsequent hits.
Preventing `Vary: Accept` Cache Fragmentation
When serving AVIF, WebP, or JPEG dynamically from the same URL (`/products/shoe-104.jpg?w=800`) based on the browser's `Accept` request header, returning a raw `Vary: Accept` header from your origin server destroys CDN cache efficiency because different browsers send dozens of distinct `Accept` strings (`image/avif,image/webp,image/apng,*/*;q=0.8` vs `image/webp,*/*`).
Normalize the incoming `Accept` header at the CDN edge into a strict 3-value internal variable (`avif`, `webp`, or `jpeg`) and append it to the CDN cache key:
# Nginx / Edge Proxy Accept Header Normalization Map
map $http_accept $normalized_image_format {
default "jpeg";
"~*avif" "avif";
"~*webp" "webp";
}
# Include $normalized_image_format in the proxy_cache_key so maximum 3 variants exist per width
proxy_cache_key "$scheme$proxy_host$uri?w=$arg_w&fmt=$normalized_image_format";
Managed Image CDNs vs. Self-Hosted `imgproxy` TCO Matrix
Suppose an e-commerce catalog hosts **5 million master product images** (5 TB in object storage), generates **15 million unique resized transformations per month**, and delivers **40 TB of monthly image egress**:
| Image Delivery Stack | Transformation / License Fee | Storage + 40 TB Egress Cost | Total Monthly Run-Rate |
|---|---|---|---|
| Bunny Optimizer + B2 Origin | $9.50 / mo (Flat per zone!) | $30 B2 + $400 Bunny CDN | $439.50 / mo |
| Self-Hosted `imgproxy` + R2 + CF CDN | $80.00 (2× C7g.xlarge Workers) | $75 R2 Storage + $0 Egress | $155.00 / mo |
| Cloudflare Images Transformations | $7,500.00 (15M × $0.50/1k unique) | $75 R2 Storage + $0 Egress | $7,575.00 / mo |
| AWS CloudFront + Lambda@Edge + S3 | $320.00 (Lambda compute) | $115 S3 + $3,200 CloudFront | $3,635.00 / mo |
Production `imgproxy` Container Configuration (Preventing AVIF CPU Saturation): When running self-hosted `imgproxy` behind a CDN, cap concurrent worker threads (`IMGPROXY_CONCURRENCY`) to match physical vCPU count and restrict `IMGPROXY_MAX_SRC_RESOLUTION` so maliciously crafted 100-megapixel PNG uploads cannot trigger OOM kills:
# Production imgproxy v3.24 Environment Flags (4-vCPU Worker Node)
IMGPROXY_CONCURRENCY=4
IMGPROXY_MAX_SRC_RESOLUTION=50
IMGPROXY_FORMAT_QUALITY="jpeg=82,webp=80,avif=65"
IMGPROXY_AVIF_SPEED=6
IMGPROXY_ENABLE_WEBP_DETECTION=true
IMGPROXY_ENABLE_AVIF_DETECTION=true
IMGPROXY_TTL=2592000
IMGPROXY_USE_S3=true
IMGPROXY_S3_ENDPOINT="https://${ACCOUNT_ID}.r2.cloudflarestorage.com"
MALLOC_ARENA_MAX=2
Eliminate Kubernetes Cross-AZ Data Transfer Costs Next
Learn how Kubernetes Topology Aware Routing prevents $0.02/GB inter-zone pod traffic charges.