Open WebUI + Ollama: Complete Self-Hosted AI Setup Guide (2026)

Introduction

Running a private AI chat interface is no longer a niche hobby. With Open WebUI and Ollama, you get a ChatGPT-like experience that respects your privacy, runs entirely on your hardware, and keeps your conversation data under your control. This guide walks you through a production-ready deployment using Docker Compose, covering everything from initial prerequisites to advanced security hardening.

You will learn how to set up both services with pinned versions (Open WebUI v0.11.2 and Ollama v0.33.2), configure persistent storage, expose the service securely via a reverse proxy with SSL, and implement a backup strategy. We also address common pitfalls that trip up even experienced self-hosters, such as GPU passthrough issues and vector store corruption.

By the end, you will have a fully functional AI assistant accessible from any device on your network (or the internet, if you choose), with the foundation to extend it with custom models, tools, and multi-user support.

Prerequisites / Requirements

Before you start, ensure your hardware and software meet the minimum expectations. Performance will vary significantly based on your hardware and the models you run.

Step-by-Step Installation Guide

Step 1: Create Project Directory and .env File

Create a dedicated directory for your stack. This keeps all configuration and data in one place.

mkdir -p ~/open-webui-stack && cd ~/open-webui-stack

Now create a .env file in this directory. This file will hold all your secrets and configurable variables. Never commit this file to Git.

cat > .env << 'EOF'
# Open WebUI version
OPEN_WEBUI_VERSION=v0.11.2
OLLAMA_VERSION=v0.33.2

# Change these to a strong random string
WEBUI_SECRET_KEY=change-me-to-a-long-random-string

# Host ports
OPEN_WEBUI_PORT=3000
OLLAMA_PORT=11434

# Timezone (adjust to your local timezone)
TZ=UTC
EOF

Generate a strong secret key for WEBUI_SECRET_KEY using openssl rand -base64 32 and paste the output into the .env file. This key is used to sign session cookies.

Step 2: Create docker-compose.yml

Create the docker-compose.yml file in the same directory. This defines both services, their volumes, and the network.

cat > docker-compose.yml << 'EOF'
services:
  ollama:
    image: ollama/ollama:${OLLAMA_VERSION:-latest}
    container_name: ollama
    restart: unless-stopped
    ports:
      - "${OLLAMA_PORT:-11434}:11434"
    volumes:
      - ollama_data:/root/.ollama
    environment:
      - TZ=${TZ:-UTC}
    # Uncomment the next lines if you have an NVIDIA GPU
    # deploy:
    #   resources:
    #     reservations:
    #       devices:
    #         - driver: nvidia
    #           count: all
    #           capabilities: [gpu]

  open-webui:
    image: ghcr.io/open-webui/open-webui:${OPEN_WEBUI_VERSION:-latest}
    container_name: open-webui
    restart: unless-stopped
    depends_on:
      - ollama
    ports:
      - "${OPEN_WEBUI_PORT:-3000}:8080"
    volumes:
      - open_webui_data:/app/backend/data
    environment:
      - TZ=${TZ:-UTC}
      - WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY:-}
      - OLLAMA_BASE_URL=http://ollama:11434
      - ENABLE_SIGNUP=true
    extra_hosts:
      - "host.docker.internal:host-gateway"

volumes:
  ollama_data:
  open_webui_data:
EOF

Note that OPEN_WEBUI_VERSION and OLLAMA_VERSION are read from the .env file. If they are not set, the latest tag is used. Check the official GitHub releases page for Open WebUI and Ollama before pinning a version — the versions above may be outdated by now.

Step 3: Start the Stack

Pull the images and start the containers in detached mode.

docker compose up -d

Check the status of the containers.

docker compose ps

Both containers should show a status of "running" or "Up". If not, check the logs with docker compose logs -f.

Step 4: Initial Setup of Open WebUI

Open your browser and navigate to http://localhost:3000. On the first visit, you will be prompted to create an administrator account. This is the first user to sign up — it automatically becomes the admin.

Fill in the form with a username, email, and a strong password. After creation, you will be logged in and redirected to the main chat interface.

Step 5: Pull a Model in Ollama

Open WebUI does not come with any models pre-installed. You need to pull at least one model into Ollama. You can do this via the Open WebUI interface (Settings -> Models -> Pull a Model) or directly from the command line.

docker exec -it ollama ollama pull llama3.1:8b

This downloads the Llama 3.1 8B model (approximately 4.7 GB). You can replace llama3.1:8b with any model from the official Ollama library. After the pull completes, the model will appear in Open WebUI's model selector.

Step 6: Test Chat Completion

In Open WebUI, select the model you just pulled from the dropdown at the top of the chat window. Type a test prompt like "Explain what a transformer is in one paragraph" and send it. You should receive a generated response.

If you get an error, check the logs for both containers.

docker compose logs -f ollama open-webui

Step 7: Configure Persistent Environment Variables

For a more robust setup, you can override any environment variable by editing the .env file and restarting. For example, to disable user signup after your admin account is created (recommended for public-facing instances), change ENABLE_SIGNUP to false in the docker-compose.yml or pass it via .env.

To apply changes:

docker compose up -d --force-recreate

Step 8: Set Up Automatic Model Pulling (Optional)

You can configure Ollama to automatically pull a list of models on startup. Create a script inside the ollama container or use the OLLAMA_MODELS environment variable (not officially supported). Instead, use a one-time command after startup or manage models through Open WebUI's admin panel.

Advanced Configuration & Optimization

Reverse Proxy with SSL (Caddy)

Exposing Open WebUI directly via port 3000 is not secure. Use a reverse proxy with automatic HTTPS. Caddy is the simplest choice for self-hosters.

Create a Caddyfile on your host:

chat.example.com {
    reverse_proxy localhost:3000
}

Run Caddy with Docker:

docker run -d --name caddy \
  -p 80:80 -p 443:443 \
  -v $PWD/Caddyfile:/etc/caddy/Caddyfile \
  -v caddy_data:/data \
  -v caddy_config:/config \
  caddy:2

Replace chat.example.com with your actual domain. Caddy will automatically obtain and renew Let's Encrypt certificates.

Backups

The two named volumes (ollama_data and open_webui_data) contain all your data: models, chat history, user accounts, and the vector database for RAG. Back them up regularly.

Use a simple cron job to create tar archives:

mkdir -p ~/backups && cd ~/open-webui-stack
docker run --rm -v open-webui-stack_ollama_data:/data -v ~/backups:/backup alpine tar czf /backup/ollama_$(date +%Y%m%d).tar.gz -C /data . && docker run --rm -v open-webui-stack_open_webui_data:/data -v ~/backups:/backup alpine tar czf /backup/openwebui_$(date +%Y%m%d).tar.gz -C /data .

To restore, extract the tar archive into the volume using a similar docker run command with tar xzf.

Optional Hardening

Warning: The following settings are application-specific and may break the containers if copied verbatim. Test them in a staging environment first.

You can add these to your docker-compose.yml under each service to reduce the attack surface:

security_opt:
  - no-new-privileges:true
read_only: true
cap_drop:
  - ALL
cap_add:
  - CHOWN
  - SETGID
  - SETUID
  - DAC_OVERRIDE

read_only: true makes the container filesystem read-only, but you must ensure the volumes are writable. The cap_add entries are needed for the container to manage file permissions within the volumes. You may need to adjust these based on the image's documentation. Run id -u && id -g on your host and verify the expected user ID against the image's documentation (default user in Open WebUI is 0 (root) unless configured otherwise).

Troubleshooting Common Errors

Conclusion

You now have a fully functional, self-hosted AI chat interface with Open WebUI v0.11.2 and Ollama v0.33.2. This stack gives you complete control over your data and models, free from third-party API limits and privacy concerns. The setup is modular — you can easily add more models, integrate with other tools, or scale to more users by adjusting the docker-compose.yml.

Remember to keep your software updated. Check the official GitHub releases pages for both projects regularly and update the version numbers in your .env file. With the backup strategy in place, you can confidently experiment with new models and features without fear of data loss.

FAQ

1. How do I update Open WebUI and Ollama?

Update the version numbers in the .env file to the newest releases, then run docker compose pull followed by docker compose up -d. This will recreate the containers with the new images while preserving your data in the named volumes. Always back up before upgrading.

2. Can I use an AMD GPU instead of NVIDIA?

Yes, Ollama supports AMD GPUs via ROCm. You need to install the ROCm driver on your host and pass the device to the container. Uncomment the deploy section and change driver: nvidia to driver: amdgpu. Note that performance may vary by model.

3. How do I add more users to my instance?

By default, ENABLE_SIGNUP is true, which allows anyone to create an account. For a private instance, set it to false after creating your admin account. Then, in Open WebUI's admin panel (Settings -> Users), you can manually create and invite users.

4. What is the best model for a 16 GB RAM machine?

For 16 GB of RAM, a 7B or 8B parameter model quantized to 4-bit (Q4) is a good balance of speed and quality. Models like llama3.1:8b or mistral:7b are commonly reported to work well. Larger models (13B+) will be slow or may not fit in memory.

5. How can I back up only my chat history, not the models?

The chat history is stored in the open_webui_data volume. The models are in ollama_data. To back up only chat history, back up only the open_webui_data volume. You can exclude the ollama_data volume from your backup routine to save space, as models can be re-pulled from the registry.