label-studio

Chainguard Container for label-studio

Label Studio is an open-source data labeling platform that supports annotation of audio, text, images, videos, and time series data.

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/label-studio:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

Getting Started with Docker

To run Label Studio with Docker, you'll need a PostgreSQL database. This example demonstrates a complete setup with both PostgreSQL and Label Studio.

Label Studio supports two deployment modes:

label-studio-uwsgi: The main application server nginx: An nginx reverse proxy (optional)

Step 1: Create a Docker Network

docker network create label-studio

Step 2: Start a PostgreSQL Database

Label Studio requires PostgreSQL for storing project data, annotations, and user information:

docker run -d \
  --name postgres \
  --network label-studio \
  -e POSTGRES_DB=labelstudio \
  -e POSTGRES_USER=labelstudio \
  -e POSTGRES_PASSWORD=mypassword \
   cgr.dev/ORGANIZATION/postgres:latest

Step 3: Start Label Studio

The Chainguard Label Studio image supports two deployment modes. Start with the main application server:

docker run -d \
  --name label-studio \
  --network label-studio \
  -p 8000:8000 \
  -e DJANGO_DB=default \
  -e POSTGRE_NAME=labelstudio \
  -e POSTGRE_USER=labelstudio \
  -e POSTGRE_PASSWORD=mypassword \
  -e POSTGRE_HOST=postgres \
  -e POSTGRE_PORT=5432 \
  -e LABEL_STUDIO_BASE_DATA_DIR=/label-studio/data \
  cgr.dev/ORGANIZATION/label-studio:latest \
  label-studio-uwsgi

The Label Studio web interface will be accessible at http://localhost:8000.

Step 4: Verify Label Studio is Running

Check the health endpoint to ensure the service is up:

curl -s http://localhost:8000/health | jq '.status'

This should return "UP".

Step 6 (Optional): Add Nginx Reverse Proxy

For production deployments, you can add an nginx reverse proxy:

docker run -d \
  --name label-studio-nginx \
  --network label-studio \
  -p 8085:8085 \
  -e LABEL_STUDIO_HOST=http://label-studio:8000 \
  -e APP_HOST=label-studio \
  cgr.dev/ORGANIZATION/label-studio:latest \
  nginx

The nginx proxy will be available at http://localhost:8085.

Getting Started with Kubernetes

Label Studio can be deployed to Kubernetes using the official Helm chart. This guide demonstrates deploying Label Studio with a PostgreSQL database.

Step 1: Deploy PostgreSQL

Create a PostgreSQL instance for Label Studio:

kubectl run postgres-test \
  --image=cgr.dev/ORGANIZATION/postgres:latest \
  --port=5432 \
  --labels='app=postgres-test' \
  --env='POSTGRES_DB=labelstudio' \
  --env='POSTGRES_USER=labelstudio' \
  --env='POSTGRES_PASSWORD=mypassword' \
  --restart=Never

Expose the PostgreSQL service:

kubectl expose pod postgres-test \
  --name=postgres-test \
  --port=5432 --target-port=5432 \
  --type=ClusterIP

Wait for PostgreSQL to be ready:

kubectl wait --for=condition=ready pod --selector app=postgres-test \
  --timeout=30s

Step 2: Create PostgreSQL Credentials Secret

Create a Kubernetes secret for the database password:

kubectl create secret generic postgres-creds \
  --from-literal=password=mypassword

Step 3: Add the Label Studio Helm Repository

helm repo add heartex https://charts.heartex.com/
helm repo update

Step 4: Create a values.yaml file for Label Studio

cat <<EOF > label-studio-values.yaml
global:
  image:
    registry: cgr.dev
    repository: ORGANIZATION/label-studio
    tag: latest
  pgConfig:
    host: postgres-test.default.svc.cluster.local
    port: 5432
    dbName: labelstudio
    userName: labelstudio
    password:
      secretName: postgres-creds
      secretKey: password
  extraEnvironmentVars:
    DJANGO_DB: "default"
    LABEL_STUDIO_BASE_DATA_DIR: "/label-studio/data"

app:
  replicas: 1
  service:
    type: ClusterIP
    port: 8000
    targetPort: 8085 # Route to nginx sidecar

postgresql:
  enabled: false
EOF

Step 5: Install Label Studio

helm install label-studio heartex/label-studio -f label-studio-values.yaml

Wait for Label Studio to be ready:

kubectl rollout status deployment/label-studio-ls-app --timeout=60s
kubectl wait --for=condition=ready pod --selector app.kubernetes.io/name=ls-app --timeout=60s

Step 6: Access the Label Studio UI

Port-forward the Label Studio service to access it locally:

kubectl port-forward svc/label-studio-ls-app 8085:8000

The UI can now be accessed at http://localhost:8085

Documentation and Resources

• Label Studio Documentation
• Label Studio GitHub Repository
• Label Studio Helm Chart Repository
• Label Studio Getting Started Tutorial
• Label Studio API Reference

What are Chainguard Containers?

Chainguard's free tier of Starter container images are built with Wolfi, our minimal Linux undistro.

All other Chainguard Containers are built with Chainguard OS, Chainguard's minimal Linux operating system designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a development, or -dev, variant.

In all other cases, including Chainguard Containers tagged as :latest or with a specific version number, the container images include only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager.

Although the -dev container image variants have similar security features as their more minimal versions, they include additional software that is typically not necessary in production environments. We recommend using multi-stage builds to copy artifacts from the -dev variant into a more minimal production image.

Need additional packages?

To improve security, Chainguard Containers include only essential dependencies. Need more packages? Chainguard customers can use Custom Assembly to add packages, either through the Console, chainctl, or API.

To use Custom Assembly in the Chainguard Console: navigate to the image you'd like to customize in your Organization's list of images, and click on the Customize image button at the top of the page.

Learn More

Refer to our Chainguard Containers documentation on Chainguard Academy. Chainguard also offers VMs and Libraries — contact us for access.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.