Deploy Open WebUI with Docker and Persistent Storage

Architecture

Open WebUI provides the browser interface while Ollama or another compatible backend provides model inference. They may run on the same host or separate hosts. Size the inference host for the model; size the Open WebUI host for users, uploads and application services.

Data and secrets

Mount /app/backend/data to persistent storage. The official quick start also recommends a persistent WEBUI_SECRET_KEY for production. Losing either can disrupt sessions or application data.

Image version policy

The main image is convenient for evaluation. For production, select and test a specific release tag, document it and upgrade deliberately after reading release notes.

Public access checklist

• Keep the container port bound to a private interface when possible.
• Use Caddy for HTTPS and a stable domain.
• Disable public sign-up unless the service is intentionally open.
• Back up the persistent volume before upgrades.
• Keep Ollama private; expose Open WebUI rather than the raw model API.

Source

Confirm commands and environment variables in the official Open WebUI quick start before each upgrade.

Environment and requirements

• Operating system: Linux with Docker
• CPU: 2 cores minimum for the web interface
• Memory: 4 GiB minimum excluding model inference
• Storage: 20 GiB SSD plus persistent upload storage
• Network: Private Ollama connection and public HTTPS endpoint

Step 1: Prepare Docker and persistent storage

Confirm Docker is available. A named volume keeps application data outside the container lifecycle.

docker --version
docker volume create open-webui

Expected result: The command completes without an error and the described service or file is available.

Step 2: Generate a stable application secret

Generate a long random value and store it in a root-readable environment file or secret manager. Reuse the same value after restarts and upgrades.

openssl rand -hex 32

Expected result: The command completes without an error and the described service or file is available.

Step 3: Start Open WebUI

This evaluation command persists data and lets the container reach an Ollama service on the host. Replace the example secret and pin a tested image tag for production.

docker run -d -p 127.0.0.1:3001:8080 --add-host=host.docker.internal:host-gateway -e OLLAMA_BASE_URL=http://host.docker.internal:11434 -e WEBUI_SECRET_KEY='replace-with-a-long-random-value' -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:main

Expected result: The command completes without an error and the described service or file is available.

Step 4: Verify the container

Check container health and logs locally before connecting a domain or opening a firewall rule.

docker ps --filter name=open-webui
docker logs --tail=100 open-webui
curl -I http://127.0.0.1:3001

Expected result: The command completes without an error and the described service or file is available.

Step 5: Add Caddy and HTTPS

Reverse proxy the local port through Caddy. Keep the container port private and confirm sign-up settings after creating the administrator.

# openwebui.example.com {
#   reverse_proxy 127.0.0.1:3001
# }

Expected result: The command completes without an error and the described service or file is available.