FROM heartexlabs/label-studio:hf-latest

# ---------- install aws-cli + sqlite3 (run as root) ----------
USER root

RUN apt-get update && \
    apt-get install -y --no-install-recommends curl unzip sqlite3 && \
    # AWS CLI v2
    curl -Lo /tmp/awscliv2.zip https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip && \
    unzip -q /tmp/awscliv2.zip -d /tmp && \
    /tmp/aws/install && \
    rm -rf /tmp/aws /tmp/awscliv2.zip && \
    # Create /data and hand ownership to the LS user before switching
    mkdir -p /data && \
    chown -R 1001:0 /data && \
    chmod -R 775 /data && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

# ---------- copy our entrypoint wrapper ----------
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

# ---------- switch back to the non-root LS user (matches official image) ----------
USER 1001

# ---------- signup disabled by default: only admin-invited users can log in ----------
# Protects a Public HF Space — strangers reach the login screen but cannot
# self-register. Remove or set to "false" only if you want open registration.
ENV LABEL_STUDIO_DISABLE_SIGNUP_WITHOUT_LINK=true

# ---------- tell Label Studio where its data lives ----------
ENV LABEL_STUDIO_BASE_DATA_DIR=/data

# ---------- run our backup-wrapper instead of the default CMD ----------
CMD ["/entrypoint.sh"]