SOP: Install Open WebUI on Linux Using Docker Compose

admin

06 Aug 2026 — 13 min read

1. Purpose

This SOP describes how to install and configure Open WebUI on a Linux server using Docker Compose.

The deployment supports:

Connection to Ollama running on the Linux host
Persistent storage for users, chats, configuration, and uploaded files
Optional Microsoft Entra ID authentication
Optional Google authentication
Optional NVIDIA GPU access
Automatic container restart

2. Scope

This procedure applies to Linux servers using Docker Engine and the Docker Compose plugin.

The examples primarily use Ubuntu or Debian. For Red Hat Enterprise Linux, Rocky Linux, AlmaLinux, or similar distributions, install Docker using the appropriate Docker repository for that operating system.

3. Architecture

User Browser
     |
     | TCP 8080 or HTTPS 443
     v
Open WebUI Docker Container
     |
     | host.docker.internal:11434
     v
Ollama Service on Linux Host
     |
     v
Local AI Models

4. Prerequisites

Ensure the server has:

A supported Linux operating system
sudo or root access
Internet access for downloading container images
Docker Engine
Docker Compose plugin
Ollama installed and running
Sufficient disk space for Open WebUI data
DNS and TLS certificates when using a production hostname
NVIDIA drivers and NVIDIA Container Toolkit when GPU access is required

Recommended minimum resources:

Resource	Minimum	Recommended
CPU	2 cores	4 or more cores
Memory	4 GB	8 GB or more
Disk	20 GB	100 GB or more
Network	1 Gbps	1 Gbps or faster

The primary CPU, memory, and GPU requirements are normally determined by Ollama and the models it runs rather than by the Open WebUI frontend.

5. Verify Ollama

Confirm that Ollama is running on the Linux host:

sudo systemctl status ollama

Test the Ollama API:

curl http://localhost:11434/api/tags

Verify that at least one model is installed:

ollama list

Example model installation:

ollama pull gemma4:12b

If Ollama must accept connections from Docker containers, configure it to listen beyond 127.0.0.1.

Create a systemd override:

sudo systemctl edit ollama

Add:

[Service]
Environment="OLLAMA_HOST=0.0.0.0:11434"

Reload and restart Ollama:

sudo systemctl daemon-reload
sudo systemctl restart ollama

Verify the listening address:

sudo ss -lntp | grep 11434

Expected output should show port 11434 listening on 0.0.0.0 or another address reachable from the Docker bridge.

Do not expose Ollama port 11434 directly to the public Internet.

6. Install Docker Engine

6.1 Remove Conflicting Packages

On Ubuntu or Debian, remove potentially conflicting packages:

sudo apt-get remove -y \
  docker.io \
  docker-doc \
  docker-compose \
  podman-docker \
  containerd \
  runc

6.2 Install Required Packages

sudo apt-get update
sudo apt-get install -y \
  ca-certificates \
  curl

6.3 Add the Docker Repository

Create the keyring directory:

sudo install -m 0755 -d /etc/apt/keyrings

Download the Docker signing key:

sudo curl -fsSL \
  https://download.docker.com/linux/ubuntu/gpg \
  -o /etc/apt/keyrings/docker.asc

Set appropriate permissions:

sudo chmod a+r /etc/apt/keyrings/docker.asc

Add the Docker repository:

echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" \
  | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

Install Docker Engine and the Compose plugin:

sudo apt-get update

sudo apt-get install -y \
  docker-ce \
  docker-ce-cli \
  containerd.io \
  docker-buildx-plugin \
  docker-compose-plugin

Enable and start Docker:

sudo systemctl enable --now docker

7. Verify Docker

Check the Docker service:

sudo systemctl status docker

Verify Docker Engine:

sudo docker version

Verify Docker Compose:

sudo docker compose version

Run a test container:

sudo docker run --rm hello-world

8. Optional: Allow Non-Root Docker Administration

Add the current user to the Docker group:

sudo usermod -aG docker "$USER"

Log out and log back in before continuing.

Verify access:

docker ps

Membership in the Docker group provides privileges comparable to root access. Limit membership to authorized administrators.

The remaining examples use docker without sudo. Add sudo where required by the local security policy.

9. Optional: Configure NVIDIA GPU Access

Open WebUI generally does not require GPU access when Ollama runs directly on the host. The GPU reservation in the Compose file is optional and may be removed unless Open WebUI itself needs GPU-enabled features.

9.1 Verify the NVIDIA Driver

nvidia-smi

9.2 Install NVIDIA Container Toolkit

Install the toolkit using NVIDIA's supported repository instructions for the server's Linux distribution.

After installation, configure Docker:

sudo nvidia-ctk runtime configure --runtime=docker
sudo systemctl restart docker

9.3 Test Container GPU Access

docker run --rm --gpus all \
  nvidia/cuda:12.6.0-base-ubuntu24.04 \
  nvidia-smi

Do not include the GPU reservation in the Open WebUI Compose file unless this test succeeds.

10. Create the Installation Directory

Create a dedicated installation directory:

sudo mkdir -p /opt/open-webui
sudo chown "$USER":"$USER" /opt/open-webui
cd /opt/open-webui

Create the persistent data directory:

mkdir -p data

Recommended directory structure:

/opt/open-webui/
├── docker-compose.yaml
├── .env
└── data/

Using an absolute directory such as /opt/open-webui/data is preferred over ~/data/open-webui for a server installation because its location does not depend on which user starts Docker Compose.

11. Generate a Secret Key

Generate a strong secret key:

openssl rand -hex 32

Save the generated value securely. It will be assigned to WEBUI_SECRET_KEY.

Do not commit secrets to source control.

12. Create the Environment File

Create the environment file:

vi /opt/open-webui/.env

Add the following:

# Public URL
WEBUI_URL=http://SERVER_IP:8080

# Application security
WEBUI_SECRET_KEY=REPLACE_WITH_GENERATED_SECRET

# Ollama
OLLAMA_BASE_URL=http://host.docker.internal:11434

# Authentication
ENABLE_OAUTH_SIGNUP=true
OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true
ENABLE_LOGIN_FORM=true

# Optional Microsoft Entra ID
MICROSOFT_CLIENT_ID=
MICROSOFT_CLIENT_SECRET=
MICROSOFT_CLIENT_TENANT_ID=
MICROSOFT_REDIRECT_URI=
OPENID_PROVIDER_URL=

# Optional Microsoft scope
MICROSOFT_OAUTH_SCOPE=openid email profile offline_access

# Optional Google
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=

Protect the file:

chmod 600 /opt/open-webui/.env

Initial Authentication Recommendation

During initial installation, use:

ENABLE_LOGIN_FORM=true

This allows the first local account to be created. The first account normally becomes the Open WebUI administrator.

After Microsoft or Google authentication has been tested successfully, an SSO-only deployment may use:

ENABLE_LOGIN_FORM=false

Do not disable the login form until OAuth has been verified, or administrators may be locked out.

13. Create the Docker Compose File

Create the file:

vi /opt/open-webui/docker-compose.yaml

Use the following configuration:

services:
  open-webui:
    image: ghcr.io/open-webui/open-webui:main
    container_name: open-webui

    ports:
      - "8080:8080"

    volumes:
      - /opt/open-webui/data:/app/backend/data

    env_file:
      - .env

    extra_hosts:
      - "host.docker.internal:host-gateway"

    restart: unless-stopped

Configuration Notes

OLLAMA_BASE_URL connects Open WebUI to Ollama.
host.docker.internal resolves to the Linux Docker host through the extra_hosts entry.
/app/backend/data stores the Open WebUI database, user accounts, conversations, settings, and uploaded files.
restart: unless-stopped restarts Open WebUI after failures and host reboots unless an administrator intentionally stops it.
The main image tag tracks the latest development or current mainline image. For production, use a tested, version-specific image tag when available.

14. Optional GPU-Enabled Compose Configuration

Only add this section when Open WebUI itself requires GPU access and the NVIDIA Container Toolkit has been validated:

services:
  open-webui:
    image: ghcr.io/open-webui/open-webui:main
    container_name: open-webui

    ports:
      - "8080:8080"

    volumes:
      - /opt/open-webui/data:/app/backend/data

    env_file:
      - .env

    extra_hosts:
      - "host.docker.internal:host-gateway"

    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities:
                - gpu

    restart: unless-stopped

When Ollama runs on the host and owns the GPU workload, this section is usually unnecessary.

15. Validate the Compose Configuration

Run:

cd /opt/open-webui
docker compose config

Review the output for:

YAML syntax errors
Missing environment variables
Incorrect indentation
Unexpected empty values
Exposed secrets

The rendered output may contain secret values. Do not copy it into tickets, logs, or chat systems.

16. Start Open WebUI

Pull the container image:

docker compose pull

Start Open WebUI:

docker compose up -d

Verify the container:

docker compose ps

Expected result:

NAME          IMAGE                                      STATUS
open-webui    ghcr.io/open-webui/open-webui:main         Up

17. Review Startup Logs

Display recent logs:

docker compose logs --tail=100 open-webui

Follow logs continuously:

docker compose logs -f open-webui

Look for:

Successful application startup
Database initialization
Ollama connection errors
OAuth configuration errors
File permission errors
Port binding conflicts

Press Ctrl+C to stop following the logs.

18. Access Open WebUI

Open a browser and navigate to:

http://SERVER_IP:8080

Examples:

http://192.168.1.25:8080

or:

http://open-webui.internal.example.com:8080

Create the initial administrator account.

After signing in:

Open the administrator settings.
Confirm that Ollama is listed as a connection.
Confirm that the expected Ollama models appear.
Select a model.
Submit a test prompt.

Example test prompt:

Respond with: Open WebUI is connected to Ollama.

19. Test Ollama Connectivity from the Container

Enter the container:

docker exec -it open-webui bash

Test DNS resolution:

getent hosts host.docker.internal

Test the Ollama API:

curl http://host.docker.internal:11434/api/tags

Exit:

exit

A successful response should contain the available Ollama models.

20. Firewall Configuration

Ubuntu UFW

Allow port 8080 only from an approved internal network:

sudo ufw allow from 10.0.0.0/8 to any port 8080 proto tcp

Example for a specific subnet:

sudo ufw allow from 192.168.10.0/24 to any port 8080 proto tcp

Verify:

sudo ufw status numbered

Firewalld

Allow port 8080:

sudo firewall-cmd \
  --permanent \
  --add-port=8080/tcp

sudo firewall-cmd --reload

For production, place Open WebUI behind an HTTPS reverse proxy and avoid exposing port 8080 broadly.

21. Microsoft Entra ID Configuration

21.1 Create an Entra ID Application

In the Microsoft Entra admin center:

Open App registrations.
Select New registration.
Enter an application name such as Open WebUI.
Select the appropriate tenant access option.
Create the registration.

Record:

Application or client ID
Directory or tenant ID

21.2 Create a Client Secret

Under Certificates & secrets:

Create a new client secret.
Record the secret value immediately.
Store it in an approved secrets-management system.

21.3 Configure the Redirect URI

For native Microsoft authentication, configure:

https://open-webui.example.com/oauth/microsoft/callback

For a temporary non-TLS internal test:

http://SERVER_IP:8080/oauth/microsoft/callback

Use HTTPS for production.

21.4 Update `.env`

WEBUI_URL=https://open-webui.example.com

ENABLE_OAUTH_SIGNUP=true
OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true

MICROSOFT_CLIENT_ID=YOUR_CLIENT_ID
MICROSOFT_CLIENT_SECRET=YOUR_CLIENT_SECRET
MICROSOFT_CLIENT_TENANT_ID=YOUR_TENANT_ID
MICROSOFT_REDIRECT_URI=https://open-webui.example.com/oauth/microsoft/callback

OPENID_PROVIDER_URL=https://login.microsoftonline.com/YOUR_TENANT_ID/v2.0/.well-known/openid-configuration

MICROSOFT_OAUTH_SCOPE=openid email profile offline_access

Restart the container:

docker compose up -d --force-recreate

Review logs:

docker compose logs --tail=100 open-webui

22. Google Authentication Configuration

22.1 Create a Google OAuth Client

In Google Cloud Console:

Create or select a project.
Configure the OAuth consent screen.
Create an OAuth 2.0 client ID.
Select Web application.
Record the client ID and client secret.

22.2 Configure the Redirect URI

Add:

https://open-webui.example.com/oauth/google/callback

For temporary testing:

http://SERVER_IP:8080/oauth/google/callback

22.3 Update `.env`

WEBUI_URL=https://open-webui.example.com

ENABLE_OAUTH_SIGNUP=true
OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true

GOOGLE_CLIENT_ID=YOUR_GOOGLE_CLIENT_ID
GOOGLE_CLIENT_SECRET=YOUR_GOOGLE_CLIENT_SECRET

Restart Open WebUI:

docker compose up -d --force-recreate

23. Using Microsoft and Google Together

The supplied Compose configuration attempts to enable both Microsoft and Google authentication.

Open WebUI's dual-provider configuration should be treated cautiously because the project documentation describes simultaneous Microsoft and Google configuration as an unofficial community workaround.

For a dual-provider deployment, use Microsoft-specific variables rather than assigning Microsoft credentials to generic OAUTH_CLIENT_ID and OAUTH_CLIENT_SECRET variables:

ENABLE_OAUTH_SIGNUP=true
OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true

MICROSOFT_CLIENT_ID=YOUR_MICROSOFT_CLIENT_ID
MICROSOFT_CLIENT_SECRET=YOUR_MICROSOFT_CLIENT_SECRET
MICROSOFT_CLIENT_TENANT_ID=YOUR_TENANT_ID
MICROSOFT_REDIRECT_URI=https://open-webui.example.com/oauth/microsoft/callback
MICROSOFT_OAUTH_SCOPE=openid email profile offline_access

OPENID_PROVIDER_URL=https://login.microsoftonline.com/YOUR_TENANT_ID/v2.0/.well-known/openid-configuration

GOOGLE_CLIENT_ID=YOUR_GOOGLE_CLIENT_ID
GOOGLE_CLIENT_SECRET=YOUR_GOOGLE_CLIENT_SECRET

Test both authentication paths before disabling local login.

24. Restrict OAuth Access

For enterprise deployments, do not allow unrestricted account creation solely because a user can authenticate with Microsoft or Google.

Consider:

Restricting access to approved email domains
Using Entra ID application assignments
Mapping Entra application roles
Limiting access to approved identity-provider groups
Disabling local password authentication after SSO validation
Reviewing new accounts periodically
Removing departed users promptly

Example domain restriction:

OAUTH_ALLOWED_DOMAINS=example.com

Example Entra role configuration:

ENABLE_OAUTH_ROLE_MANAGEMENT=true
OAUTH_ROLES_CLAIM=roles
OAUTH_ALLOWED_ROLES=OpenWebUI.User,OpenWebUI.Admin
OAUTH_ADMIN_ROLES=OpenWebUI.Admin

Test role claims in a non-production environment before enforcement.

25. Configure HTTPS

For production, place Open WebUI behind NGINX, HAProxy, Traefik, or another approved reverse proxy.

Example NGINX configuration:

server {
    listen 443 ssl;
    server_name open-webui.example.com;

    ssl_certificate /etc/ssl/certs/open-webui-fullchain.pem;
    ssl_certificate_key /etc/ssl/private/open-webui-key.pem;

    client_max_body_size 100M;

    location / {
        proxy_pass http://127.0.0.1:8080;

        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_read_timeout 600s;
        proxy_send_timeout 600s;
    }
}

When using a reverse proxy, limit the Docker port to localhost:

ports:
  - "127.0.0.1:8080:8080"

Update:

WEBUI_URL=https://open-webui.example.com

Recreate the container:

docker compose up -d --force-recreate

26. Routine Administration

Check Status

docker compose ps

Start Open WebUI

docker compose start

Stop Open WebUI

docker compose stop

Restart Open WebUI

docker compose restart

View Logs

docker compose logs -f open-webui

Display Resource Usage

docker stats open-webui

Inspect the Container

docker inspect open-webui

27. Update Open WebUI

Before updating, back up the persistent data directory.

cd /opt/open-webui

docker compose stop

sudo tar \
  --create \
  --gzip \
  --file="/var/backups/open-webui-$(date +%Y%m%d-%H%M%S).tar.gz" \
  /opt/open-webui/data

docker compose pull

docker compose up -d

docker compose logs --tail=100 open-webui

Verify:

Login
OAuth
Ollama connectivity
Model availability
Existing conversations
File uploads
Administrative settings

For controlled production environments, replace:

image: ghcr.io/open-webui/open-webui:main

with an approved version-specific image tag.

28. Backup Procedure

The persistent data is stored in:

/opt/open-webui/data

Create the backup directory:

sudo mkdir -p /var/backups/open-webui

Stop Open WebUI for a consistent filesystem backup:

cd /opt/open-webui
docker compose stop

Create a backup:

sudo tar \
  --create \
  --gzip \
  --file="/var/backups/open-webui/open-webui-$(date +%Y%m%d-%H%M%S).tar.gz" \
  /opt/open-webui/data

Restart Open WebUI:

docker compose start

Verify the backup:

sudo tar -tzf \
  /var/backups/open-webui/open-webui-YYYYMMDD-HHMMSS.tar.gz \
  | head

Protect backups because they may contain:

User account information
Conversation history
Uploaded documents
Application settings
API connection information
Potentially sensitive prompts and responses

29. Restore Procedure

Stop Open WebUI:

cd /opt/open-webui
docker compose down

Move the existing directory:

sudo mv \
  /opt/open-webui/data \
  "/opt/open-webui/data.before-restore-$(date +%Y%m%d-%H%M%S)"

Extract the backup:

sudo tar \
  --extract \
  --gzip \
  --file=/var/backups/open-webui/open-webui-YYYYMMDD-HHMMSS.tar.gz \
  --directory=/

Correct ownership if necessary:

sudo chown -R "$USER":"$USER" /opt/open-webui/data

Start Open WebUI:

docker compose up -d

Review logs and test the application:

docker compose logs --tail=100 open-webui

30. Troubleshooting

30.1 Container Does Not Start

Check status:

docker compose ps -a

Review logs:

docker compose logs --tail=200 open-webui

Validate Compose:

docker compose config

30.2 Port 8080 Is Already in Use

Check the port:

sudo ss -lntp | grep 8080

Change the host port:

ports:
  - "3000:8080"

Then access:

http://SERVER_IP:3000

30.3 Ollama Models Do Not Appear

Test Ollama on the host:

curl http://localhost:11434/api/tags

Test from the Open WebUI container:

docker exec -it open-webui \
  curl http://host.docker.internal:11434/api/tags

Confirm .env contains:

OLLAMA_BASE_URL=http://host.docker.internal:11434

Confirm Compose contains:

extra_hosts:
  - "host.docker.internal:host-gateway"

Confirm Ollama listens on a Docker-reachable address:

sudo ss -lntp | grep 11434

Restart both services:

sudo systemctl restart ollama

cd /opt/open-webui
docker compose restart

30.4 Incorrect Environment Variable Used

For Ollama, use:

OLLAMA_BASE_URL=http://host.docker.internal:11434

Do not use this for a native Ollama connection:

OPENAI_API_BASE_URL=http://host.docker.internal:11434

For an OpenAI-compatible vLLM endpoint, use an OpenAI connection variable or configure the endpoint through the Open WebUI administration interface, typically with a URL ending in /v1, for example:

http://host.docker.internal:8000/v1

30.5 OAuth Redirect URI Mismatch

Confirm that all of the following match exactly:

URL entered in Microsoft or Google
WEBUI_URL
Redirect URI environment variable
HTTP versus HTTPS
Hostname
Port
Callback path
Trailing slash behavior

Microsoft callback:

https://open-webui.example.com/oauth/microsoft/callback

Google callback:

https://open-webui.example.com/oauth/google/callback

Generic OIDC callback:

https://open-webui.example.com/oauth/oidc/callback

30.6 OAuth Settings Appear to Be Ignored

Some Open WebUI settings are persisted in the application database and may take precedence over environment-variable changes.

Check:

Administrator settings in the Open WebUI interface
WEBUI_URL
Existing persisted authentication settings
Container environment variables
Startup logs

Display configured environment variables:

docker inspect open-webui \
  --format='{{range .Config.Env}}{{println .}}{{end}}' \
  | grep -E 'WEBUI|OAUTH|GOOGLE|MICROSOFT|OPENID|OLLAMA'

Be careful because this output may reveal secrets.

30.7 Permission Denied on Persistent Storage

Check the directory:

ls -ld /opt/open-webui/data

Review container logs:

docker compose logs --tail=100 open-webui

Correct ownership as appropriate for the deployment:

sudo chown -R "$USER":"$USER" /opt/open-webui/data

Avoid using unrestricted permissions such as:

chmod -R 777

30.8 GPU Is Not Available

Verify the host:

nvidia-smi

Verify Docker:

docker run --rm --gpus all \
  nvidia/cuda:12.6.0-base-ubuntu24.04 \
  nvidia-smi

Verify the Open WebUI container:

docker exec -it open-webui nvidia-smi

If Ollama runs directly on the host, verify Ollama's GPU use instead:

watch -n 1 nvidia-smi

31. Security Requirements

For production deployments:

Use HTTPS.
Bind port 8080 to localhost when using a reverse proxy.
Do not expose Ollama port 11434 publicly.
Store OAuth client secrets outside source control.
Protect the .env file with restrictive permissions.
Use a stable, unique WEBUI_SECRET_KEY.
Restrict OAuth access to approved users, domains, groups, or application assignments.
Disable local login only after SSO has been tested.
Limit Docker group membership.
Back up the Open WebUI data directory.
Encrypt backups at rest.
Apply operating-system and Docker security updates.
Pin and test container image versions before production rollout.
Review Open WebUI and reverse-proxy logs.
Configure retention requirements for conversations and uploaded documents.
Avoid entering regulated, confidential, or customer data unless the deployment has been approved for that data classification.
Document administrator access and periodic access reviews.

32. Validation Checklist

Complete the following before approving the installation:

Docker Engine is running.
Docker Compose is installed.
Ollama is running.
Ollama is reachable from the Open WebUI container.
Open WebUI starts without critical errors.
Persistent storage is mounted.
Open WebUI is accessible from an approved network.
At least one Ollama model appears.
A test prompt completes successfully.
WEBUI_SECRET_KEY is configured.
.env permissions are restricted.
Firewall rules limit access.
HTTPS is enabled for production.
Microsoft authentication is tested, if enabled.
Google authentication is tested, if enabled.
Local login is disabled only after SSO validation, if required.
Backup and restore procedures are tested.
Administrative ownership is documented.

33. Rollback Procedure

Stop and remove the current container without deleting persistent data:

cd /opt/open-webui
docker compose down

Update docker-compose.yaml to use the previously approved image tag:

image: ghcr.io/open-webui/open-webui:PREVIOUS_VERSION

Pull and start the previous version:

docker compose pull
docker compose up -d

Review logs:

docker compose logs --tail=100 open-webui

If the update changed the database incompatibly, restore the backup created immediately before the upgrade.

34. Completion Record

Record the following:

Field	Value
Server hostname
Server IP address
Open WebUI URL
Open WebUI image tag
Installation date
Installed by
Ollama server
Default model
Authentication method
Backup location
Change or ticket number
Validation completed by
Validation date

Important changes from the original file:

Use OLLAMA_BASE_URL=http://host.docker.internal:11434 for Ollama. Open WebUI
Add WEBUI_URL, especially before enabling OAuth; Open WebUI warns that missing or incorrect external URL configuration can break SSO redirects. Open WebUI
Use Microsoft-specific variables such as MICROSOFT_CLIENT_ID, MICROSOFT_CLIENT_SECRET, MICROSOFT_CLIENT_TENANT_ID, and MICROSOFT_REDIRECT_URI for native Entra authentication. Open WebUI
Treat simultaneous Microsoft and Google login as an unofficial workaround and test it carefully before production. Open WebUI
GPU passthrough is usually unnecessary for the WebUI container when Ollama runs on the Linux host and performs the inference. NVIDIA Container Toolkit is needed only when a Docker container must access the NVIDIA GPU. NVIDIA Docs
Use the official Docker packages and Compose plugin; Docker documents the docker-compose-plugin installation path, and Open WebUI recommends the official Docker package for reliable host.docker.internal support. docs.docker.com

2. Scope

3. Architecture

4. Prerequisites

5. Verify Ollama

6. Install Docker Engine

6.1 Remove Conflicting Packages

6.2 Install Required Packages

6.3 Add the Docker Repository

7. Verify Docker

8. Optional: Allow Non-Root Docker Administration

9. Optional: Configure NVIDIA GPU Access

9.1 Verify the NVIDIA Driver

9.2 Install NVIDIA Container Toolkit

9.3 Test Container GPU Access

10. Create the Installation Directory

11. Generate a Secret Key

12. Create the Environment File

Initial Authentication Recommendation

13. Create the Docker Compose File

Configuration Notes

14. Optional GPU-Enabled Compose Configuration

15. Validate the Compose Configuration

16. Start Open WebUI

17. Review Startup Logs

18. Access Open WebUI

19. Test Ollama Connectivity from the Container

20. Firewall Configuration

Ubuntu UFW

Firewalld

21. Microsoft Entra ID Configuration

21.1 Create an Entra ID Application

21.2 Create a Client Secret

21.3 Configure the Redirect URI

21.4 Update .env

22. Google Authentication Configuration

22.1 Create a Google OAuth Client

22.2 Configure the Redirect URI

22.3 Update .env

23. Using Microsoft and Google Together

24. Restrict OAuth Access

25. Configure HTTPS

26. Routine Administration

Check Status

Start Open WebUI

Stop Open WebUI

Restart Open WebUI

View Logs

Display Resource Usage

Inspect the Container

27. Update Open WebUI

28. Backup Procedure

29. Restore Procedure

30. Troubleshooting

30.1 Container Does Not Start

30.2 Port 8080 Is Already in Use

30.3 Ollama Models Do Not Appear

30.4 Incorrect Environment Variable Used

30.5 OAuth Redirect URI Mismatch

30.6 OAuth Settings Appear to Be Ignored

30.7 Permission Denied on Persistent Storage

30.8 GPU Is Not Available

31. Security Requirements

32. Validation Checklist

33. Rollback Procedure

34. Completion Record

Read more

AWS EC2 Instance GPU Types

SOP Running and Configuring vLLM on Linux using Docker

SOP: Ollama Installation and Configuration

Employee Onboarding and Offboarding Process

21.4 Update `.env`

22.3 Update `.env`