Label studio with cloud run and vpc access conector & PRIVATE CLOUD SQL

Label Studio Support
1

Hi everyone

Im using a docker image for label studio 1.15.0 and Im trying to deploy using cloud run and a private Cloud SQL.

My question is:

this image it’s prepare to use a private SQL connection with SSL?

Do you have any experience with this? or workaround?

Thank you

2

Yes, the Label Studio 1.15.0 Docker image might work with a secure (SSL) connection to a private Cloud SQL instance, but the functionality you are asking about is more relevant to the enterprise version of LSE, and we have not tested or designed it for the open-source version. There are two common approaches:

  1. Using Cloud SQL Proxy (Recommended):
    When running on Cloud Run, it’s common to deploy the Cloud SQL Proxy as a sidecar or include it within your container. The proxy handles the SSL‐certificate management and secure connection details, so your Label Studio container can simply connect to a local proxy endpoint without extra SSL settings. This avoids the need to manually mount the certificates or modify your DATABASE_URL with SSL parameters.

  2. Direct SSL Configuration:
    If you prefer to connect directly (without using the Cloud SQL Proxy), you must:

  • Mount the necessary certificates (e.g., the server CA, client certificate, and client key) into your container (via volumes or secrets).
  • Set up your environment variables appropriately. For example, your DATABASE_URL could include query parameters such as:
sslmode=verify-full
sslrootcert=/path/to/ca-cert.pem
sslcert=/path/to/client-cert.pem
sslkey=/path/to/client-key.pem

Alternatively, you can also set:
* DATABASE_SSLMODE=require (or verify-full if you want strict verification),
* DATABASE_SSLROOTCERT to point to your CA certificate,
* DATABASE_SSLCERT for your client certificate, and
* DATABASE_SSLKEY for your client key.This direct SSL method works if all certificate files are reachable inside your Cloud Run container and your Cloud SQL instance is configured to require trusted client certificates.

In our deployments, using the Cloud SQL Proxy is usually the “workaround of choice” since it simplifies the secure connection process and avoids potential pitfalls with direct SSL configuration.

For more details on securing Label Studio and connecting it to external databases, please see the security documentation:

1 Like
3

Thanks for your answers. Yes. I’m agree with you I think SQL proxy is the right approach for this.

I have a second question.

For the db host variable:
I need to use the string connection that appears in Cloud SQL instance or the private IP?