# Label studio with cloud run and vpc access conector & PRIVATE CLOUD SQL **URL:** \ **Category:** Label Studio Support\ **Tags:** deployment\ **Created:** [February 28, 2025, 6:50pm UTC](https://community.labelstud.io/t/label-studio-with-cloud-run-and-vpc-access-conector-private-cloud-sql/512 "2025-02-28T18:50:35Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Daniel\_Barria\_Andrad](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.labelstud.io/daniel_barria_andrad/32/314_2.png) [@Daniel\_Barria\_Andrad](https://community.labelstud.io/u/Daniel_Barria_Andrad)\ **Post date:** [February 28, 2025, 6:50pm UTC](https://community.labelstud.io/t/label-studio-with-cloud-run-and-vpc-access-conector-private-cloud-sql/512/1 "2025-02-28T18:50:35Z")
Hi everyone Im using a docker image for label studio 1.15.0 and Im trying to deploy using cloud run and a private Cloud SQL. My question is: this image it’s prepare to use a private SQL connection with SSL? Do you have any experience with this? or workaround? Thank you ---
**Author:** ![makseq](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.labelstud.io/makseq/32/26_2.png) [@makseq](https://community.labelstud.io/u/makseq)\ **Post date:** [March 1, 2025, 3:11am UTC](https://community.labelstud.io/t/label-studio-with-cloud-run-and-vpc-access-conector-private-cloud-sql/512/2 "2025-03-01T03:11:30Z")
Yes, the Label Studio 1.15.0 Docker image might work with a secure (SSL) connection to a private Cloud SQL instance, but the functionality you are asking about is more relevant to the enterprise version of LSE, and we have not tested or designed it for the open-source version. There are two common approaches: 1. **Using Cloud SQL Proxy (Recommended):** When running on Cloud Run, it’s common to deploy the Cloud SQL Proxy as a sidecar or include it within your container. The proxy handles the SSL‐certificate management and secure connection details, so your Label Studio container can simply connect to a local proxy endpoint without extra SSL settings. This avoids the need to manually mount the certificates or modify your DATABASE\_URL with SSL parameters. 2. **Direct SSL Configuration:** If you prefer to connect directly (without using the Cloud SQL Proxy), you must: - **Mount the necessary certificates** (e.g., the server CA, client certificate, and client key) into your container (via volumes or secrets). - **Set up your environment variables** appropriately. For example, your `DATABASE_URL` could include query parameters such as: ```auto sslmode=verify-full sslrootcert=/path/to/ca-cert.pem sslcert=/path/to/client-cert.pem sslkey=/path/to/client-key.pem ``` Alternatively, you can also set: \* `DATABASE_SSLMODE=require` (or `verify-full` if you want strict verification), \* `DATABASE_SSLROOTCERT` to point to your CA certificate, \* `DATABASE_SSLCERT` for your client certificate, and \* `DATABASE_SSLKEY` for your client key.This direct SSL method works if all certificate files are reachable inside your Cloud Run container and your Cloud SQL instance is configured to require trusted client certificates. In our deployments, using the Cloud SQL Proxy is usually the “workaround of choice” since it simplifies the secure connection process and avoids potential pitfalls with direct SSL configuration. For more details on securing Label Studio and connecting it to external databases, please see the security documentation: - [Secure Label Studio](https://docs.humansignal.com/guide/security.html) - [Deploy Label Studio on Kubernetes – Optional: set up TLS for PostgreSQL](https://docs.humansignal.com/guide/install_k8s.html#Optional-set-up-TLS-for-PostgreSQL) ---
**Author:** ![Daniel\_Barria\_Andrad](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.labelstud.io/daniel_barria_andrad/32/314_2.png) [@Daniel\_Barria\_Andrad](https://community.labelstud.io/u/Daniel_Barria_Andrad)\ **Post date:** [March 3, 2025, 4:07pm UTC](https://community.labelstud.io/t/label-studio-with-cloud-run-and-vpc-access-conector-private-cloud-sql/512/3 "2025-03-03T16:07:11Z")
Thanks for your answers. Yes. I’m agree with you I think SQL proxy is the right approach for this. I have a second question. For the db host variable: I need to use the string connection that appears in Cloud SQL instance or the private IP? ---
**Author:** ![Rillwan\_Shokunbi](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.labelstud.io/rillwan_shokunbi/32/378_2.png) [@Rillwan\_Shokunbi](https://community.labelstud.io/u/Rillwan_Shokunbi)\ **Post date:** [May 19, 2025, 2:08am UTC](https://community.labelstud.io/t/label-studio-with-cloud-run-and-vpc-access-conector-private-cloud-sql/512/4 "2025-05-19T02:08:55Z")
Thanks for the workaround. Should incase I want to go with using the private cloud SQL, please what is cost with switching to the enterprise version of LS? ---
**Author:** ![makseq](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.labelstud.io/makseq/32/26_2.png) [@makseq](https://community.labelstud.io/u/makseq)\ **Post date:** [May 19, 2025, 8:59am UTC](https://community.labelstud.io/t/label-studio-with-cloud-run-and-vpc-access-conector-private-cloud-sql/512/5 "2025-05-19T08:59:43Z")
Hello, it highly depends on a number of seats you are going to have in your enterprise license. Please, contact our sales here: [sales@humansignal.com](mailto:sales@humansignal.com) ---
**Author:** ![Rillwan\_Shokunbi](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.labelstud.io/rillwan_shokunbi/32/378_2.png) [@Rillwan\_Shokunbi](https://community.labelstud.io/u/Rillwan_Shokunbi)\ **Post date:** [May 19, 2025, 8:53pm UTC](https://community.labelstud.io/t/label-studio-with-cloud-run-and-vpc-access-conector-private-cloud-sql/512/6 "2025-05-19T20:53:31Z")
Hi Makseq, The email bounced back. We are generally looking for about 3 seats. ---
**Author:** ![makseq](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.labelstud.io/makseq/32/26_2.png) [@makseq](https://community.labelstud.io/u/makseq)\ **Post date:** [May 19, 2025, 10:31pm UTC](https://community.labelstud.io/t/label-studio-with-cloud-run-and-vpc-access-conector-private-cloud-sql/512/7 "2025-05-19T22:31:29Z")
Ok, I have asked our sales to contact you. ---
**Author:** ![makseq](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.labelstud.io/makseq/32/26_2.png) [@makseq](https://community.labelstud.io/u/makseq)\ **Post date:** [May 20, 2025, 3:01pm UTC](https://community.labelstud.io/t/label-studio-with-cloud-run-and-vpc-access-conector-private-cloud-sql/512/8 "2025-05-20T15:01:12Z")
The sales team confirmed that they have sent an email to you.