Install Open WebUI with Ollama
Updated Aug 2026
Put a ChatGPT-style web interface on your self-hosted Ollama — one Docker container, multi-user auth, and HTTPS via a reverse proxy.
- A running Ollama server — see Deploy Ollama on a VPS
- A VPS with 2 GB RAM free for the UI (the models' RAM lives with Ollama, not here)
- Docker installed, root/sudo SSH access
What you get
Open WebUI is a self-hosted, ChatGPT-style web interface for Ollama and any OpenAI-compatible API — chat history, model switching, multi-user accounts, and built-in RAG, all served from one container on your own box. If you followed Deploy Ollama on a VPS, you already have models answering over a raw API; this guide puts a browser UI in front of them so the setup is usable by humans, not just curl.
The UI itself is lightweight. All the heavy lifting — model weights, inference RAM — stays with Ollama, so Open WebUI adds little on top of the sizing you already did for the models.
Prerequisites
You need Ollama running and reachable, either on the same VPS or on another machine you control. The Ollama guide leaves you with Ollama listening on 127.0.0.1:11434 — that's exactly what this guide connects to. Docker must be installed (same base setup as that guide).
Install: one Docker command
The verified install is Open WebUI's official quick-start container:
# Open WebUI — official quick-start container
docker run -d -p 3000:8080 \
--add-host=host.docker.internal:host-gateway \
-v open-webui:/app/backend/data \
--name open-webui --restart always \
ghcr.io/open-webui/open-webui:main # → http://SERVER_IP:3000What each piece does:
-p 3000:8080— Open WebUI serves on port 8080 inside the container; this maps it to 3000 on the host, so the UI is athttp://SERVER_IP:3000.--add-host=host.docker.internal:host-gateway— makes the hostnamehost.docker.internalresolve to the host machine from inside the container. That's the bridge that lets the containerized UI reach an Ollama running on the same VPS.-v open-webui:/app/backend/data— a named volume for everything stateful: accounts, chat history, settings. This volume is your backup target; lose it and you lose your users and conversations.--restart always— the UI comes back on its own after reboots.
Open the URL and create the first account immediately — the first account created gets administrator privileges. Don't leave a freshly installed instance sitting on a public port unclaimed.
Paid link — we earn a commission if you shop through it.
Connecting to Ollama
Open WebUI finds its backend through the OLLAMA_BASE_URL environment variable. Its documented default is http://localhost:11434 — which inside a container points at the container itself, not your host. Two setups:
Ollama on the same VPS (the common case): the --add-host flag above exists for exactly this. Be explicit and add the env var to the run command:
-e OLLAMA_BASE_URL=http://host.docker.internal:11434 \Ollama on a separate VPS: point the variable at the other machine instead:
-e OLLAMA_BASE_URL=http://<ollama-host>:11434 \One warning for the split setup: Ollama's port should never be open to the public internet — it has no authentication of its own. Put the two machines on a private network first: a cloud provider's private networking, an SSH tunnel, or a mesh VPN like NetBird — then use the private address in OLLAMA_BASE_URL. You can also change the connection later without recreating the container, under Admin Settings → Connections in the UI.
If the model list shows up in the chat view's model picker, the wiring works — those names come live from Ollama.
Users and auth
Open WebUI ships with sensible multi-user defaults, verified against its configuration reference:
- The first account is the admin and controls user management and system settings.
- Sign-up is enabled by default (
ENABLE_SIGNUPdefaults to true), but new registrations land in pending status (DEFAULT_USER_ROLEdefaults topending) and can't log in until an admin approves them — so an open registration page doesn't mean open access. - For a strictly personal instance you can disable login entirely with
-e WEBUI_AUTH=False— but the docs are explicit that you cannot switch back to multi-account mode afterwards, so leave auth on unless you're sure.
For a small team, the defaults are already right: share the URL, have people sign up, approve them from the admin panel.
HTTPS
Don't leave the UI on plain HTTP — logins and chats deserve TLS. Put a reverse proxy in front, exactly as in Automatic HTTPS with Caddy: point a hostname's A record at the server, then have Caddy reverse-proxy it to 127.0.0.1:3000. Once the proxy is live, tighten the container's port binding so the UI is only reachable through it — recreate with -p 127.0.0.1:3000:8080 in place of -p 3000:8080, and port 3000 disappears from the public internet while Caddy keeps serving it on 443.
Verification + next steps
You're done when: you can log in over HTTPS on your domain, the model picker lists the models you pulled in Ollama, and a chat gets a streamed answer. From here, explore Open WebUI's document/RAG features against your own files, and if the responses feel slow, that's an Ollama sizing question, not a UI one — the Ollama guide's sizing section covers the RAM math, and Best VPS for AI & ML Workloads has the ranked picks.