How to Self-Host Open WebUI With Ollama or an OpenAI API

The hard part of running AI in-house isn't the model. It's handing your team an interface they'll actually open every morning. Open WebUI closes that gap: a self-hosted, ChatGPT-style front end that talks to Ollama and to anything speaking the OpenAI API. The one-line version: run a single Docker command, open port 3000, create the first account, and point it at your backend.

Key Takeaways

The short answer: docker run -d -p 3000:8080 --add-host=host.docker.internal:host-gateway -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:main, then open http://localhost:3000.
Open WebUI runs fully offline against a local Ollama instance, so no prompt or document leaves your network.
Any provider that speaks the OpenAI API (vLLM, LM Studio, Groq, OpenRouter) is added as an OpenAI connection with a custom base URL.
The first account you create becomes the administrator, and signup closes automatically after that.
Set WEBUI_SECRET_KEY to a fixed value or every container restart logs everyone out.
All chats, users, and settings persist in the open-webui Docker volume, not in the image.

What You Need Before You Start

Keep the prerequisites short and you'll be chatting within minutes.

A Linux, macOS, or Windows host with Docker installed and running.
A backend for the models: either Ollama already running locally, or an API key and base URL for an OpenAI-compatible provider.
A free TCP port. The examples use 3000 on the host.
Optional: an NVIDIA GPU with the container toolkit if you want the image to run models itself.

How Do You Install Open WebUI and Connect a Model?

Follow these steps in order and you'll finish with a working chat interface pointed at your own backend.

Confirm Docker is up and your backend is reachable. If you're using Ollama, verify it answers on the host:
```
curl http://localhost:11434/api/tags
```

Start the container. This is the standard command. The --add-host flag lets the container reach an Ollama running on the host machine.

docker run -d -p 3000:8080 \
  --add-host=host.docker.internal:host-gateway \
  -v open-webui:/app/backend/data \
  --name open-webui --restart always \
  ghcr.io/open-webui/open-webui:main

Create the admin account. Open http://localhost:3000 in a browser and register. The first user to sign up becomes the administrator; after that, self-signup is closed by default.
Confirm the Ollama connection. Open WebUI auto-detects a local Ollama and lists its models in the model picker at the top of a new chat. If nothing appears, jump to the connection steps below.
Add an OpenAI-compatible provider (optional). Go to Admin Panel > Settings > Connections, click the plus next to OpenAI, and fill in the base URL and API key. Every OpenAI-style backend uses this same form; only the URL changes.
```
# OpenAI:      https://api.openai.com/v1
# vLLM:        http://host.docker.internal:8000/v1
# LM Studio:   http://host.docker.internal:1234/v1
# Groq:        https://api.groq.com/openai/v1
```
Pull or select a model and chat. With Ollama, pull a model from the interface or the CLI, then pick it in the chat header:
```
ollama pull llama3.1:8b
```
Lock in session persistence. Stop the container, generate a secret, and recreate it with the key set so restarts don't log everyone out:
```
openssl rand -hex 32
```

That sequence is the whole task. The rest of this guide covers image choices, provider details, and the errors that send people to the issue tracker.

Which Docker Image Should You Run?

Open WebUI ships several tags, and the right one depends on whether you want the container to host models itself.

Image tag	What it includes	Use it when
`:main`	Open WebUI only, CPU	Ollama or an API already runs elsewhere
`:cuda`	Open WebUI with CUDA for local embeddings and reranking	You want on-box RAG on an NVIDIA GPU
`:ollama`	Open WebUI plus a bundled Ollama server	You want one container to run and serve models

For the bundled option on a GPU host, mount a volume for the model weights so pulls survive restarts:

docker run -d -p 3000:8080 --gpus=all \
  -v ollama:/root/.ollama \
  -v open-webui:/app/backend/data \
  --name open-webui --restart always \
  ghcr.io/open-webui/open-webui:ollama

If Ollama lives on another server, skip --add-host and pass its address directly:

docker run -d -p 3000:8080 \
  -e OLLAMA_BASE_URL=https://ollama.internal.example.com \
  -v open-webui:/app/backend/data \
  --name open-webui --restart always \
  ghcr.io/open-webui/open-webui:main

How Do You Chat With Your Own Documents?

Open WebUI has document chat built in. Upload files to a Knowledge collection under the Workspace, then reference that collection in a chat with #. It chunks, embeds, and retrieves without a separate vector service for small collections. For larger corpora, point it at an external embedding model and add a reranker so retrieval quality holds up as the index grows.

Common Errors and How to Fix Them

Almost every setup problem falls into one of these five buckets.

No models appear and Ollama is running. Inside a container, localhost is the container, not your host. Use http://host.docker.internal:11434 as the Ollama URL, or run Ollama with OLLAMA_HOST=0.0.0.0 so it accepts connections from the Docker bridge.
An OpenAI-compatible provider returns 404 or 500. The base URL almost always needs the /v1 suffix. http://host:8000 fails; http://host:8000/v1 works.
The provider connects but lists no models. Some servers don't expose /models. Add the model IDs manually in the connection's Model IDs filter so the picker shows them.
Everyone is logged out after a restart. You didn't set WEBUI_SECRET_KEY. Add -e WEBUI_SECRET_KEY=$(openssl rand -hex 32) as a fixed value in your compose file or run command.
Chats or users vanished after an update. The -v open-webui:/app/backend/data volume was missing. Data lives there, not in the image; never run without it in production.

How Do You Keep It Updated and Locked Down?

Two operational tasks separate a demo from something you'd put in front of a team.

For updates, pull the new image and recreate the container, or let Watchtower do it for a single service:

docker run --rm \
  --volume /var/run/docker.sock:/var/run/docker.sock \
  containrrr/watchtower --run-once open-webui

For hardening, confirm public signup stays disabled after your admin account exists, set the persistent secret key, put the service behind a reverse proxy with TLS rather than exposing port 3000 directly, and review the roles model before you invite anyone. The project's hardening guide walks through each control.

What to Do Next

Once the interface is live, the useful moves are about the backend and retrieval.

If you're new to the model layer, stand up the engine first with how to run large language models locally with Ollama.
For a production-grade OpenAI-compatible backend that handles real concurrency, serve models with vLLM for high-throughput inference and connect it as an OpenAI provider.
Before you trust document chat at scale, tighten retrieval by adding a reranker to your RAG pipeline.