That is somewhat of an "hard" to solve problem.
As you have written:
Currently, anyone who can log into the server can see what's inside the image folder.
I assume, you don't let everyone on your boxes ;)
So there is a group of people who are allowed (for reasons) to log into your box. But the only reason where someone should be allowed to log into the box, would include, that somebody has sufficient rights to circumvent whatever operational precautions you take (= access rights). At best: nobody should ever have the need to log into your server. Operations should be done via automation. So unless your automation isn't corrupted, the user data should be relatively safe - assuming / depending on how your application is.
What is left is securing/encrypting the content itself.
There are (perhaps) ways to do this, but the question is: would it be worth the effort?
Depending on the level of sensitivity of the user-data:
If you mistrust your developers in general, than that is the problem, not how to encrypt data.
My company works for the public sector and as such with personal sensitive data. That has several security implications. One is: that only 2 persons in the whole company have access to such data (which is not encrypted). And even logfile information for developers are stripped down to the absolute minimum (the real logs are manually prepared for and presented to developers).