"role "postgres" does not exist" - installing Label Studio with Postgres and Docker compose

[DaveTSG]

Hello,

I am trying to install Label Studio (latest image, v1.12.1, presumably) with Postgres (v16 alpine), using Docker compose. I already have an instance of Postgres running in another container for Authentik SSO.

When I run docker compose up for the Label Studio/Postgres compose file, I see this error in the Postgres logs: 2024-07-27 07:53:33.374 UTC [335] FATAL: role "postgres" does not exist

And similar in the Label Studio logs: django.db.utils.OperationalError: connection to server at "Postgres-LabelStudio" (172.22.0.22), port 5432 failed: FATAL: role "postgres" does not exist

I have read this guide and also saw this example docker compose file, and set up my compose file based on that.

I don't necessarily need that version of Postgres, but figured I may as well use a reasonably-modern version. I note that the example compose file used v11.5; I tried that but had the same issue, so I don't think it's a Postgres version issue.

I have also tried just using the default Label Studio configuration (which uses SQLite instead of Postgres), and that worked fine. It's just getting it working with Postgres that I'm having problems with.

As mentioned above, I have previously installed Postgres for a completely different Docker service (Authentik). I was not sure if changing the container_name would be sufficient to have two separate instances of Postgres (one for Authentik, one for Label Studio) (I'm pretty new to Docker in general). While I have installed it for Authentik, I'll be honest in saying I don't really understand what I've done, so I may be doing all this the wrong way.

docker ps | grep "gres"
00298de3094d   postgres:16-alpine                              "docker-entrypoint.s…"   16 hours ago   Up 16 hours (healthy)           5432/tcp                                                                                                                                                                                                                                                                                                                                             Postgres-LabelStudio
eb3d3aa55c8f   postgres:16-alpine                              "docker-entrypoint.s…"   23 hours ago   Up 23 hours (healthy)           5432/tcp                                                                                                                                                                                                                                                                                                                                             authentik-postgresql-1

It seems to me that both instances of Postgres have different container names (Postgres-LabelStudio and authentik-postgresql-1), so I assume that's ok. Is it a problem that they're both using port 5432?

I also remember when I installed Postgres for Authentik, if I had files existing in certain folders, it wouldn't create the new database for Authentik.
Are there any specific folders that should be empty when I try to docker compose up my Label Studio compose.yml file?

One last thing, just to complicate matters: I am using Traefik as a proxy. However, when I fired up Label Studio with the default configuration (SQLite, not Postgres), I also had Traefik enabled and that worked fine, so I don't think Traefik is the cause of my problems.

I am including my docker-compose-labelstudio.yml and docker-compose-authentik.yml files below. Could anyone suggest what I might be doing incorrectly please?

Thank you in advance.
Dave

Contents of /home/david/dockerfilesNotOnNAS/labelstudio/dockercompose-labelstudio.yml:

services:
  label-studio:
    container_name: LabelStudio
    image: heartexlabs/label-studio:latest
    networks:
      - proxy
    # environment:
    #   - PUID = 1000
    #   - PGID = 1000
    # user: root
    # ports:
    #   - 8090:8080
    volumes:
    - /home/david/dockerfilesNotOnNAS/labelstudio/mydata:/label-studio/data:rw
    - source: static
      target: /label-studio/static_volume
      type: volume
      volume:
        nocopy: true
    restart: unless-stopped
    dns: 172.22.0.53
    environment:
      - DJANGO_DB=default
      - POSTGRE_NAME=postgres
      - POSTGRE_USER=postgres
      - POSTGRE_PASSWORD=
      - POSTGRE_PORT=5432
      - POSTGRE_HOST=Postgres-LabelStudio
      - LABEL_STUDIO_HOST=${LABEL_STUDIO_HOST:-}
      - LABEL_STUDIO_COPY_STATIC_DATA=true
    depends_on:
      - Postgres-LabelStudio
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.label-studio.entrypoints=http"
      - "traefik.http.routers.label-studio.rule=Host(`label-studio.mydomain.com`)"
      - "traefik.http.routers.label-studio.middlewares=default-whitelist@file"
      - "traefik.http.middlewares.label-studio-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.label-studio.middlewares=label-studio-https-redirect"
      - "traefik.http.routers.label-studio-secure.entrypoints=https"
      - "traefik.http.routers.label-studio-secure.rule=Host(`label-studio.mydomain.com`)"
      - "traefik.http.routers.label-studio-secure.tls=true"
      - "traefik.http.routers.label-studio-secure.service=label-studio"
      - "traefik.http.services.label-studio.loadbalancer.server.port=8080"
      - "traefik.docker.network=proxy"
      - homepage.group=Machine Learning
      - homepage.name=Label Studio
      - homepage.icon=https://ia801409.us.archive.org/31/items/github.com-heartexlabs-label-studio_-_2022-08-05_01-43-27/cover.jpg
      - homepage.href=https://label-studio.mydomain.com/
      - homepage.description=Data and image labelling for machine learning applications.
      - homepage.statusStyle=dot
  Postgres-LabelStudio:
    image: docker.io/library/postgres:16-alpine
    container_name: Postgres-LabelStudio
    hostname: Postgres-LabelStudio
    restart: always
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 5s
    dns: 172.22.0.53
    env_file:
      - .env
    networks:
      - proxy
    environment:
      - POSTGRES_HOST_AUTH_METHOD=trust
      - POSTGRES_USER=${PG_USER}
      - POSTGRES_PASSWORD=${PG_PASS}
      - POSTGRES_DB=${PG_DB}
    volumes:
      - /home/david/dockerfilesNotOnNAS/labelstudio/postgres-data:/var/lib/postgresql/data
      - ./deploy/pgsql/certs:/var/lib/postgresql/certs:ro
    
networks:
  proxy:
    external: true

volumes:
  static: {}

...and contents of /home/david/dockerfilesNotOnNAS/labelstudio/.env:

PG_PASS=longpasswordhere
PG_USER=labelstudioDBuser
PG_DB=LabelStudioDB

Contents of /home/david/dockerfilesNotOnNAS/authentik/docker-compose-authentik.yml:

services:
  postgresql:
    image: docker.io/library/postgres:16-alpine
    dns: 172.22.0.53
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 5s
    volumes:
      - database:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
      POSTGRES_USER: ${PG_USER:-authentik}
      POSTGRES_DB: ${PG_DB:-authentik}
    env_file:
      - .env
    networks:
      proxy:

#Redis and the two Authentik services were also included here but I've removed them for brevity.

volumes:
  database:
    driver: local
  redis:
    driver: local

networks:
  proxy:
    external: true

[LaurentGoderre]

Have you tried disabling the healthcheck test to make sure the error isn't coming from that one?

[yosifkit]

The environment that you are giving to LabelStudio doesn't use the same username and password that you specify to the postgres container.

    environment:
      - DJANGO_DB=default
      - POSTGRE_NAME=postgres
      - POSTGRE_USER=postgres
      - POSTGRE_PASSWORD=
      - POSTGRE_PORT=5432
      - POSTGRE_HOST=Postgres-LabelStudio
      - LABEL_STUDIO_HOST=${LABEL_STUDIO_HOST:-}
      - LABEL_STUDIO_COPY_STATIC_DATA=true

    environment:
      - POSTGRES_HOST_AUTH_METHOD=trust
      - POSTGRES_USER=${PG_USER}
      - POSTGRES_PASSWORD=${PG_PASS}
      - POSTGRES_DB=${PG_DB}

Also, when POSTGRES_HOST_AUTH_METHOD is set to trust, passwords will be ignored by PostgreSQL server and connections from anywhere just need to specify a real user. You do have some protection since it doesn't have a ports directive, so it shouldn't be accessible outside of the docker network or docker host.

[DaveTSG]

The environment that you are giving to LabelStudio doesn't use the same username and password that you specify to the postgres container.

    environment:
      - DJANGO_DB=default
      - POSTGRE_NAME=postgres
      - POSTGRE_USER=postgres
      - POSTGRE_PASSWORD=
      - POSTGRE_PORT=5432
      - POSTGRE_HOST=Postgres-LabelStudio
      - LABEL_STUDIO_HOST=${LABEL_STUDIO_HOST:-}
      - LABEL_STUDIO_COPY_STATIC_DATA=true

    environment:
      - POSTGRES_HOST_AUTH_METHOD=trust
      - POSTGRES_USER=${PG_USER}
      - POSTGRES_PASSWORD=${PG_PASS}
      - POSTGRES_DB=${PG_DB}

Also, when POSTGRES_HOST_AUTH_METHOD is set to trust, passwords will be ignored by PostgreSQL server and connections from anywhere just need to specify a real user. You do have some protection since it doesn't have a ports directive, so it shouldn't be accessible outside of the docker network or docker host.

Ahhh, that's got it working.
Sorry, I realise this must seem like an obvious issue but I hadn't realised the two user/pass fields (in each service) referred to the same thing. Noob mistake. :-)

Thanks for your help; it's all working now.

What I ended up with, in case it helps someone else in future:

environment:
      - DJANGO_DB=default
      - POSTGRE_NAME=postgres
      - POSTGRE_USER=${PG_USER}
      - POSTGRE_PASSWORD=${PG_PASS}
      - POSTGRE_PORT=5432
      - POSTGRE_HOST=Postgres-LabelStudio
      - LABEL_STUDIO_HOST=${LABEL_STUDIO_HOST:-}
      - LABEL_STUDIO_COPY_STATIC_DATA=true

environment:
      - POSTGRES_HOST_AUTH_METHOD=false
      - POSTGRES_USER=${PG_USER}
      - POSTGRES_PASSWORD=${PG_PASS}
      - POSTGRES_DB=${PG_DB}