Label Studio with S3 backup and signup disabled

Dockerfile

@@ -1,17 +1,19 @@
-FROM heartexlabs/label-studio@sha256:07efb8d373c3f66922c27e14dfacfc812fa4d9b088c6f8179c0c85a956c269b2
+FROM heartexlabs/label-studio:hf-latest
 
+# ---------- install aws-cli + sqlite3 (run as root) ----------
 USER root
 
 RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-        curl \
-        unzip \
-        sqlite3 && \
+    apt-get install -y --no-install-recommends curl unzip sqlite3 && \
     # AWS CLI v2
     curl -Lo /tmp/awscliv2.zip https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip && \
     unzip -q /tmp/awscliv2.zip -d /tmp && \
     /tmp/aws/install && \
     rm -rf /tmp/aws /tmp/awscliv2.zip && \
+    # Create /data and hand ownership to the LS user before switching
+    mkdir -p /data && \
+    chown -R 1001:0 /data && \
+    chmod -R 775 /data && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 
@@ -19,16 +21,16 @@ RUN apt-get update && \
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
-# ---------- create /data and hand it to the LS user ----------
-RUN mkdir -p /data && chown 1001:1001 /data
-
-# ---------- switch back to the non-root LS user ----------
+# ---------- switch back to the non-root LS user (matches official image) ----------
 USER 1001
 
+# ---------- signup disabled by default: only admin-invited users can log in ----------
+# Protects a Public HF Space — strangers reach the login screen but cannot
+# self-register. Remove or set to "false" only if you want open registration.
+ENV LABEL_STUDIO_DISABLE_SIGNUP_WITHOUT_LINK=true
+
 # ---------- tell Label Studio where its data lives ----------
 ENV LABEL_STUDIO_BASE_DATA_DIR=/data
 
-# ---------- HF Spaces exposes port 7860 by default ----------
-EXPOSE 7860
-
-ENTRYPOINT ["/entrypoint.sh"]
+# ---------- run our backup-wrapper instead of the default CMD ----------
+CMD ["/entrypoint.sh"]

entrypoint.sh

@@ -19,7 +19,6 @@
 #   AWS_DEFAULT_REGION      – us-east-1
 #   AWS_ENDPOINT_URL        – https://s3.amazonaws.com   (change for R2/MinIO)
 #   SYNC_INTERVAL_SECONDS   – 60
-#   LABEL_STUDIO_PORT       – 7860
 # =============================================================================
 
 set -euo pipefail
@@ -30,10 +29,10 @@ PREFIX="${BACKUP_S3_PREFIX:-labelstudio}"
 REGION="${AWS_DEFAULT_REGION:-us-east-1}"
 ENDPOINT="${AWS_ENDPOINT_URL:-https://s3.amazonaws.com}"
 SYNC_INTERVAL="${SYNC_INTERVAL_SECONDS:-60}"
-LS_PORT="${LABEL_STUDIO_PORT:-7860}"
 
 DATA_DIR=/data
-DB_FILE="$DATA_DIR/label_studio.db"
+# Label Studio uses label_studio.sqlite3 (not .db) — confirmed from live logs
+DB_FILE="$DATA_DIR/label_studio.sqlite3"
 S3_PATH="s3://${BUCKET}/${PREFIX}"
 
 export AWS_DEFAULT_REGION="$REGION"
@@ -112,11 +111,10 @@ label-studio user create \
     --preserve-case 2>/dev/null || true
 
 # ------------- 4. start Label Studio in the background --------------------
-# LABEL_STUDIO_DISABLE_SIGNUP_WITHOUT_LINK=true prevents strangers from
-# self-registering on a public HF Space. Only admin-created accounts can log in.
-echo "[start] Starting Label Studio on port $LS_PORT ..."
-LABEL_STUDIO_DISABLE_SIGNUP_WITHOUT_LINK="${LABEL_STUDIO_DISABLE_SIGNUP_WITHOUT_LINK:-true}" \
-label-studio --host="0.0.0.0" --port="$LS_PORT" &
+# Use $SPACE_HOST exactly as the official HF Dockerfile does — this is what
+# makes HF's reverse proxy route traffic correctly to the container.
+echo "[start] Starting Label Studio ..."
+label-studio --host="$SPACE_HOST" &
 LS_PID=$!
 echo "[start] Label Studio PID: $LS_PID"