daemon: images should be private