Label Studio with S3 backup and signup disabled

Dockerfile

@@ -1,140 +1,36 @@
 FROM heartexlabs/label-studio:hf-latest
 
-# 1. Switch to root to perform installs and permission changes
+# ---------- install aws-cli + sqlite3 (run as root) ----------
 USER root
 
-# 2. Install git AND create the /data directory with correct permissions
-#    We create the folder, give it to user 1001, and allow read/write access
-RUN apt-get update && apt-get install -y git \
-    && mkdir -p /data \
-    && chown -R 1001:0 /data \
-    && chmod -R 775 /data
-
-# 3. Switch back to the standard Label Studio user
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends curl unzip sqlite3 && \
+    # AWS CLI v2
+    curl -Lo /tmp/awscliv2.zip https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip && \
+    unzip -q /tmp/awscliv2.zip -d /tmp && \
+    /tmp/aws/install && \
+    rm -rf /tmp/aws /tmp/awscliv2.zip && \
+    # Create /data and hand ownership to the LS user before switching
+    mkdir -p /data && \
+    chown -R 1001:0 /data && \
+    chmod -R 775 /data && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
+
+# ---------- copy our entrypoint wrapper ----------
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+# ---------- switch back to the non-root LS user (matches official image) ----------
 USER 1001
 
-################################################################################
-#
-# How to Disable Public Account Creation
-# --------------------------------------
-# By default this space allows for the unrestricted creation of new accounts
-# will full access to all projects and data. This is great for trying out
-# Label Studio and collaborating on projects, but you may want to restrict
-# access to your space to only authorized users. Uncomment the following line
-# to disable public account creation for this space.
-#
+# ---------- signup disabled by default: only admin-invited users can log in ----------
+# Protects a Public HF Space — strangers reach the login screen but cannot
+# self-register. Remove or set to "false" only if you want open registration.
 ENV LABEL_STUDIO_DISABLE_SIGNUP_WITHOUT_LINK=true
-#
-# Set secrets in your space to create an inital user, and log in with your
-# provided username and password. Do not set these in your Dockerfile, as they
-# globally visible on a public space.
-#
-# LABEL_STUDIO_USERNAME
-# LABEL_STUDIO_PASSWORD
-#
-# You will need to provide new users with an invitation link to join the space.
-#
-################################################################################
-
-################################################################################
-#
-# How to Enable Persistent Storage for Label Studio in Hugging Face Spaces
-# ------------------------------------------------------------------------
-#
-# By default this space stores all project configuration and data annotations
-# in local storage with sqlite. If the space is reset, all configuration and
-# annotation data in the space will be lost. You can enable configuration
-# persistence through one of two methods:
-#
-# 1) Enabling Hugging Face Persistent Storage for saving project and annotation
-#    settings, as well as local task storage.
-# 2) Connecting an external Postgres database for saving project and annotation
-#    settings, and cloud by connecting cloud storage for tasks.
-#
-################################################################################
-
-################################################################################
-#
-# How to Enable Hugging Face Persistent Storage for Label Studio
-# --------------------------------------------------------------
-#
-# In the Hugging Face Label Studio Space settings, select the appropriate
-# Persistent Storage tier. Note that Persistent Storage is a paid add-on.
-# By default, persistent storage is mounted to /data. In your Space settings,
-# set the following variables:
-#
-# LABEL_STUDIO_BASE_DATA_DIR=/data
-# ENV STORAGE_PERSISTENCE=1
-#
-# Your space will restart. NOTE: if you have existing settings and data,
-# they will be lost in this first restart. Data and setting will only be
-# preserved on subsequent restarts of the space.
-#
-################################################################################
 
-################################################################################
-#
-# How to Enable Configuration Persistence with Postgres
-# -----------------------------------------------------
-#
-# Set the following secret variables to match your own hosted instance of
-# Postgres. We strongly recommend setting these as secrets to prevent leaking
-# information about your database service to the public in your spaces
-# definition.
-#
-# ENV DJANGO_DB=default
-# ENV POSTGRE_NAME=<postgres_name>
-# ENV POSTGRE_PORT=<db_port>
-# ENV POSTGRE_USER=<postgres_user>
-# ENV POSTGRE_PASSWORD=<password>
-# ENV POSTGRE_PORT=<db_port>
-# ENV POSTGRE_HOST=<db_host>
-#
-# Uncomment the following line or set the following Space variable to remove
-# the warning about ephemeral storage
-#
-# ENV STORAGE_PERSISTENCE=1
-#
-# Note that you will need to connect cloud storage to host data items that you
-# want to annotate, as local storage will not be preserved across a space reset.
-#
-#
-# How to Enable Cloud Storage
-# ---------------------------
-# By default the only data storage enabled for this space is local. In the case
-# of a space reset, all data will be lost. To enable permanent storage, you
-# must enable a cloud storage connector. We also strongly recommend enabling
-# configuration persistence to preserve project data, annotations, and user
-# settings. Choose the appropriate cloud connector and configure the secrets
-# for it.
-#
-# Amazon S3
-# =========
-# STORAGE_TYPE=s3
-# STORAGE_AWS_ACCESS_KEY_ID="<YOUR_ACCESS_KEY_ID>"
-# STORAGE_AWS_SECRET_ACCESS_KEY="<YOUR_SECRET_ACCESS_KEY>"
-# STORAGE_AWS_BUCKET_NAME="<YOUR_BUCKET_NAME>"
-# STORAGE_AWS_REGION_NAME="<YOUR_BUCKET_REGION>"
-# STORAGE_AWS_FOLDER=""
-#
-# Google Cloud Storage
-# ====================
-#
-# STORAGE_TYPE=gcs
-# STORAGE_GCS_BUCKET_NAME="<YOUR_BUCKET_NAME>"
-# STORAGE_GCS_PROJECT_ID="<YOUR_PROJECT_ID>"
-# STORAGE_GCS_FOLDER=""
-# GOOGLE_APPLICATION_CREDENTIALS="/opt/heartex/secrets/key.json"
-#
-# Azure Blob Storage
-# ==================
-#
-# STORAGE_TYPE=azure
-# STORAGE_AZURE_ACCOUNT_NAME="<YOUR_STORAGE_ACCOUNT>"
-# STORAGE_AZURE_ACCOUNT_KEY="<YOUR_STORAGE_KEY>"
-# STORAGE_AZURE_CONTAINER_NAME="<YOUR_CONTAINER_NAME>"
-# STORAGE_AZURE_FOLDER=""
-#
-################################################################################
+# ---------- tell Label Studio where its data lives ----------
+ENV LABEL_STUDIO_BASE_DATA_DIR=/data
 
-CMD exec label-studio --host=$SPACE_HOST
+# ---------- run our backup-wrapper instead of the default CMD ----------
+CMD ["/entrypoint.sh"]