Deployment guide

Label Studio

Videos

Overview: Label Studio on Ubuntu 24.04 LTS on Azure: overview (watch on YouTube)

Launch and log in: Label Studio on Ubuntu 24.04 LTS on Azure: launch and log in (watch on YouTube)

Deep Dive: Label Studio on Ubuntu 24.04 LTS on Azure: deep dive (watch on YouTube)

Overview

Label Studio is a popular open-source data labeling and annotation platform for machine learning and AI. Teams use it to label and annotate text, images, audio, video and time series data, manage annotation projects and quality, and export ready-to-use training datasets.

This SecureAnyCloud image installs Label Studio 1.23 into a Python virtual environment at /opt/label-studio on Python 3.12, run by an unprivileged labelstudio service account. An nginx reverse proxy on TCP 80 fronts it, all data persists on a dedicated Azure data disk, and every VM generates a unique password on first boot.

What you get:

Label Studio 1.23 in a Python venv at /opt/label-studio (Python 3.12)
An nginx reverse proxy on :80 with HTTP Basic Authentication in front of the Label Studio server (bound on :8080), with the /health probe left open
A dedicated Azure data disk at /var/lib/label-studio holding the SQLite database, media uploads, annotations and exports, separate from the OS disk and re-provisioned with every VM
A per-VM password generated at first boot and stored in a root-only file, securing both the HTTP gate and the Label Studio administrator account (admin@sac.local)
label-studio.service and nginx.service as enabled, active systemd units
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting size. Scale up for larger projects or more concurrent annotators.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp from the users who label data. For public exposure, front port 80 with TLS (see Enable HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Label Studio by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once per subscription, then create the VM and open port 80.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:label-studio-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name label-studio \
  --image sac1647283583153:label-studio-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name label-studio --port 80 --priority 1010

Step 3 - Connect to your VM

Connect to the VM over SSH as azureuser.

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check both services and the health endpoint.

systemctl is-active label-studio.service nginx.service curl -s http://127.0.0.1/health

Both services report active, and the health endpoint returns {"status": "UP"}.

Step 5 - Retrieve your password

Your VM generates a unique password on first boot and writes it to a root-only file. Read it with sudo:

sudo cat /root/label-studio-credentials.txt

The LABEL_STUDIO_PASSWORD value is the password. The same password secures the HTTP gate (user admin) and the Label Studio administrator account (admin@sac.local).

Step 6 - Sign in

Browse to http://<vm-public-ip>/. The browser first prompts for the HTTP gate. Enter user admin and the password from Step 5.

Then sign in to Label Studio with the email admin@sac.local and the same password.

Step 7 - Create a labeling project

Choose Create Project, name it, and import data. You can drag and drop files, paste URLs, or connect cloud storage.
In Labeling Setup, pick a template or build a custom config. Templates include text classification, named entity recognition, image bounding boxes, audio transcription and many more.
Start labeling. Annotations are saved as you go. Export them in JSON, CSV, COCO, YOLO and other formats from the Export menu.

To pre-label data and speed up annotation, connect a machine learning backend (an external model) under Settings > Model.

Step 8 - Confirm the runtime

Print the installed Label Studio version.

/opt/label-studio/venv/bin/pip show label-studio | grep ^Version

The expected output is Version: 1.23.0. Projects, annotations, uploads and the database persist on the dedicated data disk at /var/lib/label-studio.

Scale for production with PostgreSQL

The image defaults to SQLite and local storage on the data disk. For team scale, set PostgreSQL in /etc/label-studio/label-studio.env. See the Label Studio docs for DJANGO_DB / POSTGRE_* and the cloud storage settings. Then restart the service:

sudo systemctl restart label-studio.service

Enable HTTPS

For production, terminate TLS at nginx with a real domain that points at the VM's public IP. Install certbot and request a certificate, replacing the domain:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

certbot edits the nginx site at /etc/nginx/sites-available/sac-label-studio to add the TLS listener, and sets up automatic renewal.

Backup and maintenance

All Label Studio state lives on the dedicated data disk at /var/lib/label-studio. This includes the SQLite database, uploads, annotations and exports. Snapshot that disk in Azure to back up your projects and annotations.
Keep the OS patched with sudo apt update && sudo apt upgrade.
The HTTP gate password is in /etc/nginx/.label-studio.htpasswd. Rotate it with sudo htpasswd /etc/nginx/.label-studio.htpasswd admin.
Restart the service with sudo systemctl restart label-studio.service. View the logs with sudo journalctl -u label-studio.service.

Support

This image comes with 24/7 SecureAnyCloud support. Contact us by email and chat for help with labeling configuration, machine learning backends, database and storage configuration, TLS termination and scaling.

All product and company names are trademarks or registered trademarks of their respective holders. Their use does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Label Studio on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

Label Studio 1.23 is an open-source data labeling and annotation platform for machine learning. You can label text, images, audio, video and time series data, and export training datasets.

This SecureAnyCloud image runs Label Studio on Ubuntu 24.04 LTS. It is installed into a dedicated Python virtual environment under /opt/label-studio on Python 3.12. An unprivileged labelstudio system account runs it under a systemd service that starts the server on boot and migrates the database automatically.

What you get:

The Label Studio server on port 8080, fronted by nginx on port 80 with HTTP Basic Authentication
An unauthenticated /health probe, while everything else requires the password
A default security group that opens only port 22 (SSH) and port 80 (HTTP), so port 8080 is not reachable externally
A fresh password, unique to each instance, created by a one-shot service on the first boot and written to /root/label-studio-credentials.txt (mode 0600, root only)
The same password securing the HTTP gate and the Label Studio administrator account (admin@sac.local)
The SQLite database, uploads and exports under /var/lib/label-studio on a dedicated, independently resizable EBS data volume

Prerequisites

An AWS account subscribed to this product in AWS Marketplace
An EC2 key pair in your target region for SSH access
A security group that allows inbound TCP 22 (SSH) from your IP and TCP 80 (HTTP) from your users
An instance type of m5.large or larger (recommended)

Connect to your instance

The login user depends on the OS variant. For Ubuntu 24.04, the login user is ubuntu. Connect with this example, replacing the key file and address: ssh -i your-key.pem ubuntu@<instance-public-ip>

Step 1 - Launch from the AWS Marketplace console

Open the product page in AWS Marketplace. Choose Continue to Subscribe, then Continue to Configuration.
Select the Label Studio 1.23 on Ubuntu 24.04 delivery option and your region, then choose Continue to Launch.
Choose your instance type, VPC and subnet, key pair, and the security group described above. Then launch.

Step 2 - Launch from the AWS CLI

Launch an instance from the Marketplace AMI. Replace the example values with your own AMI ID, key pair name and security group ID.

aws ec2 run-instances \
  --image-id ami-xxxxxxxxxxxxxxxxx \
  --instance-type m5.large \
  --key-name your-key \
  --security-group-ids sg-xxxxxxxx \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=label-studio}]'

Step 3 - Connect to your instance

Connect over SSH as the ubuntu user.

ssh -i your-key.pem ubuntu@<instance-public-ip>

Step 4 - Confirm the services are running

systemctl is-active label-studio.service nginx.service curl -s http://127.0.0.1/health

The expected output is:

active active {"status": "UP"}

Step 5 - Retrieve your password

Read the credentials file with sudo. The file lists the URL, user name and your unique password.

sudo cat /root/label-studio-credentials.txt

# Label Studio - generated on first boot by label-studio-firstboot.service LABEL_STUDIO_URL=http://<instance-public-ip>/ LABEL_STUDIO_USERNAME=admin@sac.local LABEL_STUDIO_PASSWORD=<your-unique-password>

Step 6 - Sign in

Browse to http://<instance-public-ip>/. The browser first prompts for the HTTP gate. Enter user admin and the password from Step 5.

Then sign in to Label Studio with the email admin@sac.local and the same password.

Step 7 - Create a labeling project

Choose Create Project, name it, and import data. You can drag and drop files, paste URLs, or connect cloud storage.
In Labeling Setup, pick a template or build a custom config. Templates include text classification, named entity recognition, image bounding boxes, audio transcription and many more.
Start labeling. Annotations are saved as you go. Export them in JSON, CSV, COCO, YOLO and other formats from the Export menu.

To pre-label data and speed up annotation, connect a machine learning backend (an external model) under Settings > Model.

Step 8 - Confirm the runtime

Print the installed Label Studio version.

/opt/label-studio/venv/bin/pip show label-studio | grep ^Version

Version: 1.23.0

Scale for production with PostgreSQL and Amazon S3

The image defaults to SQLite and local storage on the data volume. For team scale, set PostgreSQL and S3 in /etc/label-studio/label-studio.env. See the Label Studio docs for DJANGO_DB / POSTGRE_* and the cloud storage settings. Then restart the service with sudo systemctl restart label-studio.service.

Attach an instance role that grants access to the S3 bucket.

Enable HTTPS

Install certbot and request a certificate for your domain.

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

certbot edits the nginx site at /etc/nginx/sites-available/sac-label-studio to add the TLS listener, and sets up automatic renewal.

Backup and maintenance

All Label Studio state lives under /var/lib/label-studio on its own EBS volume. This includes the SQLite database, uploads and exports. Snapshot that volume to back up projects and annotations.
The HTTP gate password is in /etc/nginx/.label-studio.htpasswd. Rotate it with sudo htpasswd /etc/nginx/.label-studio.htpasswd admin.
Restart the service with sudo systemctl restart label-studio.service. View the logs with sudo journalctl -u label-studio.service.

Support

SecureAnyCloud provides 24/7 technical support for this image by email and chat. Support covers Label Studio deployment, labeling configuration, machine learning backends, database and storage configuration, TLS termination and scaling. Contact details are on the AWS Marketplace listing.

Deploy on AWS

Launch Label Studio on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS