butonic · Nov 9, 2026 · Nov 9, 2026
diff --git a/.env.example b/.env.example
@@ -10,24 +10,24 @@ INSECURE=true
 ## Features ##
 # The following variable is a convenience variable to enable or disable features of this compose project.
 # Example: if you want to use traefik and letsencrypt, you can set the variable to
-#COMPOSE_FILE=docker-compose.yml:yjs/yjs.yml:traefik/opencloud.yml
+#COMPOSE_FILE=docker-compose.yml:yjs/yjs.yml:thumbnails/imagor.yml:traefik/opencloud.yml
 # This enables you to just run `docker compose up -d` and the compose files will be added to the stack.
 # As alternative approach you can run `docker compose -f docker-compose.yml -f docker-compose.traefik.yml up -d`
 # Default: OpenCloud and Collabora with traefik and letsencypt
 # This needs DNS entries for the domain names used in the .env file.
-#COMPOSE_FILE=docker-compose.yml:yjs/yjs.yml:weboffice/collabora.yml:traefik/opencloud.yml:traefik/collabora.yml
+#COMPOSE_FILE=docker-compose.yml:yjs/yjs.yml:thumbnails/imagor.yml:weboffice/collabora.yml:traefik/opencloud.yml:traefik/collabora.yml
 # If you want to use the external proxy, you can use the following combination.
 # DNS entries and certificates need to be managed by the external environment.
 # The domain names need to be entered into the .env file.
-#COMPOSE_FILE=docker-compose.yml:yjs/yjs.yml:weboffice/collabora.yml:external-proxy/opencloud.yml:external-proxy/collabora.yml
+#COMPOSE_FILE=docker-compose.yml:yjs/yjs.yml:thumbnails/imagor.yml:weboffice/collabora.yml:external-proxy/opencloud.yml:external-proxy/collabora.yml
 # Keycloak Shared User Directory
-#COMPOSE_FILE=docker-compose.yml:yjs/yjs.yml:weboffice/collabora.yml:traefik/opencloud.yml:traefik/collabora.yml:idm/ldap-keycloak.yml:traefik/ldap-keycloak.yml
+#COMPOSE_FILE=docker-compose.yml:yjs/yjs.yml:thumbnails/imagor.yml:weboffice/collabora.yml:traefik/opencloud.yml:traefik/collabora.yml:idm/ldap-keycloak.yml:traefik/ldap-keycloak.yml
 # External IDP
-#COMPOSE_FILE=docker-compose.yml:yjs/yjs.yml:weboffice/collabora.yml:traefik/opencloud.yml:traefik/collabora.yml:idm/external-idp.yml
+#COMPOSE_FILE=docker-compose.yml:yjs/yjs.yml:thumbnails/imagor.yml:weboffice/collabora.yml:traefik/opencloud.yml:traefik/collabora.yml:idm/external-idp.yml
 # Euro Office with traefik and letsencrypt
-#COMPOSE_FILE=docker-compose.yml:yjs/yjs.yml:weboffice/euro-office.yml:traefik/opencloud.yml:traefik/euro-office.yml
+#COMPOSE_FILE=docker-compose.yml:yjs/yjs.yml:thumbnails/imagor.yml:weboffice/euro-office.yml:traefik/opencloud.yml:traefik/euro-office.yml
 # Euro Office with external proxy (Nginx, Caddy, etc.)
-#COMPOSE_FILE=docker-compose.yml:yjs/yjs.yml:weboffice/euro-office.yml:external-proxy/opencloud.yml:external-proxy/euro-office.yml
+#COMPOSE_FILE=docker-compose.yml:yjs/yjs.yml:thumbnails/imagor.yml:weboffice/euro-office.yml:external-proxy/opencloud.yml:external-proxy/euro-office.yml
 
 ## Traefik Settings ##
 # Note: Traefik is always enabled and can't be disabled.
@@ -193,6 +193,14 @@ SMTP_INSECURE=
 # IMPORTANT: Add any services to the startup list comma separated like "notifications,antivirus" etc.
 START_ADDITIONAL_SERVICES=""
 
+# Services that must not be started, comma separated.
+# The compose files that replace a built-in service exclude it themselves, but docker
+# compose only keeps the value of the last file in COMPOSE_FILE. When combining
+# thumbnails/imagor.yml with idm/ldap-keycloak.yml or idm/external-idp.yml, list
+# all of them here, so the result does not depend on the order of the files:
+#EXCLUDE_ADDITIONAL_SERVICES="idm,idp,thumbnails"
+EXCLUDE_ADDITIONAL_SERVICES=""
+
 
 ## Default Enabled Services ##
 
@@ -210,6 +218,28 @@ START_ADDITIONAL_SERVICES=""
 # like advanced OCR or specific image processing capabilities.
 TIKA_IMAGE=
 
+### Imagor Thumbnail Generator ###
+# Imagor makes the thumbnails when thumbnails/imagor.yml is in COMPOSE_FILE, which all
+# examples above do. Without it, the thumbnails service built into OpenCloud is used,
+# which only supports a minimal set of formats.
+# Image of the imagor container. The magick variant is needed to read ICO files.
+# Defaults to "ghcr.io/cshum/imagor-magick"
+IMAGOR_DOCKER_IMAGE=
+# Defaults to "1.9.11"
+IMAGOR_DOCKER_TAG=
+# Mime types a preview is attempted for on top of the built-in list
+# (png, jpeg, gif, webp, bmp, tiff, text, audio covers and geogebra).
+# Defaults to "image/heic,image/heif,image/avif,image/jp2,image/vnd.adobe.photoshop,image/x-tga,image/x-pcx,image/svg+xml,image/x-icon,image/vnd.microsoft.icon"
+IMAGOR_ADDITIONAL_SOURCE_TYPES=
+# Maximum size of an image a thumbnail is made of, in bytes. Used by OpenCloud and imagor.
+# Defaults to "50000000"
+IMAGOR_MAX_INPUT_FILE_SIZE=
+# Maximum width, height and number of animation frames of a source image.
+# Default to "7680", "7680" and "100"
+IMAGOR_MAX_WIDTH=
+IMAGOR_MAX_HEIGHT=
+IMAGOR_MAX_ANIMATION_FRAMES=
+
 ### IMPORTANT Note for Online Office Apps ###
 # To avoid app interlocking issues, you should select only one app to be active/configured.
 # This is due the fact that there is currently no app interlocking for the same file and one

diff --git a/README.md b/README.md
@@ -195,6 +195,27 @@ By default, OpenCloud Compose uses `apache/tika:latest` which provides:
 
 The base variant is recommended for most use cases. If you need advanced features like specialized OCR processing or specific image format support, you can override the image by setting `TIKA_IMAGE=apache/tika:latest-full` in your `.env` file.
 
+### With Imagor Thumbnails
+
+[Imagor](https://imagor.net) makes the thumbnails instead of the thumbnails service built into OpenCloud, which only supports a minimal set of formats. All `COMPOSE_FILE` examples in `.env.example` include it.
+
+Using `-f` flags:
+```bash
+docker compose -f docker-compose.yml -f thumbnails/imagor.yml -f traefik/opencloud.yml up -d
+```
+
+Or by setting in `.env`:
+```
+COMPOSE_FILE=docker-compose.yml:thumbnails/imagor.yml:traefik/opencloud.yml
+```
+
+This setup includes:
+- the `ghcr.io/cshum/imagor-magick` image, which is only reachable on the internal network
+- previews for HEIC, HEIF, AVIF, JPEG 2000, PSD, TGA, PCX, SVG and ICO files on top of the built-in formats, configurable with `IMAGOR_ADDITIONAL_SOURCE_TYPES`
+- the built-in thumbnails service is not started
+
+`thumbnails/imagor.yml` and the `idm/` files each set `OC_EXCLUDE_RUN_SERVICES`, and docker compose only keeps the value of the last file. When combining them, set `EXCLUDE_ADDITIONAL_SERVICES=idm,idp,thumbnails` in `.env`.
+
 ### With the Yjs Server
 
 The yjs server enables collaborative editing of files. The browser connects to `wss://{OC_DOMAIN}/yjs`. The OpenCloud proxy forwards this route to the yjs container, so no extra DNS entry or port is needed.
@@ -422,6 +443,8 @@ Key variables:
 | `EURO_OFFICE_DOCKER_IMAGE`    | Euro Office Docker image                              | ghcr.io/euro-office/documentserver |
 | `EURO_OFFICE_DOCKER_TAG`      | Euro Office Docker tag                                | latest                       |
 | `TIKA_IMAGE`                  | Apache Tika image tag                                 | apache/tika:slim             |
+| `IMAGOR_DOCKER_TAG`           | Imagor image tag                                      | 1.9.11                       |
+| `EXCLUDE_ADDITIONAL_SERVICES` | Services not to start, see imagor and idm sections    | (no value)                   |
 | `KEYCLOAK_DOMAIN`             | Keycloak domain                                       | keycloak.opencloud.test      |
 | `KEYCLOAK_ADMIN`              | Keycloak admin username                               | kcadmin                      |
 | `KEYCLOAK_ADMIN_PASSWORD`     | Keycloak admin password                               | admin                        |
@@ -477,6 +500,7 @@ This repository uses a modular approach with multiple compose files:
 - `weboffice/` - Web office integrations (Collabora Online)
 - `storage/` - Storage backend configurations (decomposeds3)
 - `search/` - Search and content analysis services (Apache Tika)
+- `thumbnails/` - Thumbnail generator (imagor)
 - `monitoring/` - Monitoring and metrics configurations
 - `idm/` - Identity management configurations (Keycloak & LDAP)
 - `traefik/` - Traefik reverse proxy configurations

diff --git a/docker-compose.yml b/docker-compose.yml
@@ -2,7 +2,7 @@
 services:
   opencloud:
     # renovate: depName=opencloudeu/opencloud-rolling
-    image: ${OC_DOCKER_IMAGE:-opencloudeu/opencloud-rolling}:${OC_DOCKER_TAG:-8.1.0}
+    image: ${OC_DOCKER_IMAGE:-opencloudeu/opencloud-rolling}:${OC_DOCKER_TAG:-9.0.0}
     # changelog: https://github.com/opencloud-eu/opencloud/tree/main/changelog
     # release notes: https://docs.opencloud.eu/opencloud_release_notes.html
     user: ${OC_CONTAINER_UID_GID:-1000:1000}

diff --git a/idm/external-idp.yml b/idm/external-idp.yml
@@ -28,7 +28,9 @@ services:
       PROXY_ROLE_ASSIGNMENT_DRIVER: ${PROXY_ROLE_ASSIGNMENT_DRIVER:-oidc}
       OC_OIDC_ISSUER: ${IDP_ISSUER_URL:-https://keycloak.opencloud.test/realms/openCloud}
       # This specifies to start all services except idm and idp. These are replaced by external services.
-      OC_EXCLUDE_RUN_SERVICES: idm,idp
+      # compose takes this value from the last file in COMPOSE_FILE, so when combining with
+      # thumbnails/imagor.yml set EXCLUDE_ADDITIONAL_SERVICES=idm,idp,thumbnails
+      OC_EXCLUDE_RUN_SERVICES: ${EXCLUDE_ADDITIONAL_SERVICES:-}${EXCLUDE_ADDITIONAL_SERVICES:+,}idm,idp
       # IdP specific configuration for auto-provisioning
       OC_LDAP_SERVER_WRITE_ENABLED: "true"
       PROXY_AUTOPROVISION_ACCOUNTS: "true"

diff --git a/idm/ldap-keycloak.yml b/idm/ldap-keycloak.yml
@@ -19,7 +19,9 @@ services:
       FRONTEND_READONLY_USER_ATTRIBUTES: "user.onPremisesSamAccountName,user.displayName,user.mail,user.passwordProfile,user.accountEnabled,user.appRoleAssignments"
       OC_LDAP_SERVER_WRITE_ENABLED: "false" # the ldap is managed by Keycloak, so it is not writable by OpenCloud
       # This specifies to start all services except idm and idp. These are replaced by external services.
-      OC_EXCLUDE_RUN_SERVICES: idm,idp
+      # compose takes this value from the last file in COMPOSE_FILE, so when combining with
+      # thumbnails/imagor.yml set EXCLUDE_ADDITIONAL_SERVICES=idm,idp,thumbnails
+      OC_EXCLUDE_RUN_SERVICES: ${EXCLUDE_ADDITIONAL_SERVICES:-}${EXCLUDE_ADDITIONAL_SERVICES:+,}idm,idp
       # Keycloak IDP specific configuration
       PROXY_AUTOPROVISION_ACCOUNTS: "false"
       PROXY_ROLE_ASSIGNMENT_DRIVER: "oidc"

diff --git a/renovate.json b/renovate.json
@@ -34,7 +34,8 @@
       "managerFilePatterns": [
         "/^docker-compose\\.yml$/",
         "/^weboffice\\/collabora\\.yml$/",
-        "/^yjs\\/yjs\\.yml$/"
+        "/^yjs\\/yjs\\.yml$/",
+        "/^thumbnails\\/imagor\\.yml$/"
       ],
       "matchStrings": [
         "# renovate: depName=(?<depName>[^\\s]+)\\n\\s+image: \\$\\{[^}]+\\}:\\$\\{[^}]+-(?<currentValue>[0-9]+\\.[0-9]+\\.[0-9]+)\\}"

diff --git a/thumbnails/imagor.yml b/thumbnails/imagor.yml
@@ -0,0 +1,45 @@
+---
+services:
+  opencloud:
+    environment:
+      # webdav posts the image to imagor instead of the built-in thumbnails service
+      WEBDAV_THUMBNAILS_GENERATOR_URL: http://imagor:8000
+      # announce previews for the formats imagor-magick reads on top of the built-in list
+      OC_THUMBNAILS_ADDITIONAL_SOURCE_TYPES: ${IMAGOR_ADDITIONAL_SOURCE_TYPES:-image/heic,image/heif,image/avif,image/jp2,image/vnd.adobe.photoshop,image/x-tga,image/x-pcx,image/svg+xml,image/x-icon,image/vnd.microsoft.icon}
+      # in bytes, the same value is handed to imagor below so both refuse the same files
+      OC_THUMBNAILS_MAX_INPUT_IMAGE_FILE_SIZE: "${IMAGOR_MAX_INPUT_FILE_SIZE:-50000000}"
+      # the built-in thumbnails service is not needed when imagor makes the thumbnails
+      # compose takes this value from the last file in COMPOSE_FILE, so when combining with
+      # idm/ldap-keycloak.yml or idm/external-idp.yml set EXCLUDE_ADDITIONAL_SERVICES=idm,idp,thumbnails
+      OC_EXCLUDE_RUN_SERVICES: ${EXCLUDE_ADDITIONAL_SERVICES:-}${EXCLUDE_ADDITIONAL_SERVICES:+,}thumbnails
+    depends_on:
+      imagor:
+        condition: service_healthy
+
+  imagor:
+    # renovate: depName=ghcr.io/cshum/imagor-magick
+    image: ${IMAGOR_DOCKER_IMAGE:-ghcr.io/cshum/imagor-magick}:${IMAGOR_DOCKER_TAG:-1.9.11}
+    networks:
+      opencloud-net:
+    environment:
+      # webdav only sends unsigned /unsafe/ URLs. imagor is only reachable on the
+      # internal opencloud-net bridge and no port is published to the host.
+      # Do NOT publish a port or expose imagor via the reverse proxy.
+      IMAGOR_UNSAFE: "true"
+      # webdav posts the image, imagor must not fetch anything by itself
+      UPLOAD_LOADER_ENABLE: "true"
+      HTTP_LOADER_DISABLE: "true"
+      # quoted, an unquoted large number reaches imagor as 5e+07 which it cannot parse
+      UPLOAD_LOADER_MAX_ALLOWED_SIZE: "${IMAGOR_MAX_INPUT_FILE_SIZE:-50000000}"
+      # the limits of the built-in thumbnails service
+      VIPS_MAX_WIDTH: ${IMAGOR_MAX_WIDTH:-7680}
+      VIPS_MAX_HEIGHT: ${IMAGOR_MAX_HEIGHT:-7680}
+      VIPS_MAX_ANIMATION_FRAMES: ${IMAGOR_MAX_ANIMATION_FRAMES:-100}
+    healthcheck:
+      test: ["CMD", "curl", "-sf", "http://localhost:8000/healthcheck"]
+      interval: 5s
+      timeout: 5s
+      retries: 12
+    logging:
+      driver: ${LOG_DRIVER:-local}
+    restart: always