Open WebUI Setup: Install, Configure & Secure for Teams

Open WebUI is a self-hosted web interface for running and managing language models locally or via remote APIs. It connects to Ollama, OpenAI, Anthropic, or any OpenAI-compatible endpoint, giving your team a private, centralized LLM chat experience. This guide walks you through three installation paths, team configuration, and production hardening for small teams.

Installation Methods: Quick Comparison

Open WebUI runs on Docker, Python (uv or pip), or as a desktop app. For teams managing multiple users, Docker is easiest to maintain and scale. Python is lighter weight but requires manual dependency management. The desktop app is single-user only and best for solo evaluation before committing to a shared setup.

Method	Setup Time	Team Ready	System Requirement	Update Path
Docker	5 minutes	Yes	Docker Desktop or Docker Engine	One command
Python (uv)	10 minutes	Partial	Python 3.11+	Manual venv
Desktop App	2 minutes	No	Windows/Mac/Linux binary	Automatic

Option 1: Docker (Recommended for Teams)

Docker packages Open WebUI and all dependencies in a container, making it identical on every machine. You can run it on any system with Docker Engine installed. For more on deployment options, see our guide to Open WebUI hosting and managed alternatives.

Prerequisites: Docker Desktop (Mac/Windows) or Docker Engine (Linux). Visit docker.com to install.

Step 1: Pull the Docker image

docker pull ghcr.io/open-webui/open-webui:latest

Step 2: Run the container with persistent storage

docker run -d -p 3000:8080 \
  -v open-webui-data:/app/backend/data \
  --name open-webui \
  ghcr.io/open-webui/open-webui:latest

The -v flag creates a Docker volume named open-webui-data. This volume persists even if you stop or restart the container. Open WebUI is now running on your local machine at port 3000.

Step 3: Connect to Ollama (local or remote)

If Ollama is on the same machine, add a network flag:

docker run -d -p 3000:8080 \
  --network host \
  -v open-webui-data:/app/backend/data \
  --name open-webui \
  ghcr.io/open-webui/open-webui:latest

The --network host flag allows Open WebUI to reach Ollama on port 11434. If Ollama runs on a remote server, log into Open WebUI > Settings > Connections > Ollama API Base URL and set it to your server's address and port (e.g., your-ollama-server:11434).

Step 4: Enable GPU acceleration (Linux only, optional)

If you have an NVIDIA GPU and want Ollama to use it for inference:

docker run -d -p 3000:8080 \
  --gpus all \
  --network host \
  -v open-webui-data:/app/backend/data \
  --name open-webui \
  ghcr.io/open-webui/open-webui:latest

Requires nvidia-docker2 installed on the host system.

Option 2: Python (uv or pip)

Python installation is lighter than Docker and suitable for single-machine development or testing environments. We recommend uv for faster dependency resolution and cleaner virtual environment management.

Prerequisites: Python 3.11 or later. Check: python3 --version

Step 1: Install uv (if not already installed)

pip install uv

Step 2: Create and activate a virtual environment

uv venv open-webui-env
source open-webui-env/bin/activate

On Windows, use: open-webui-env\Scripts\activate

Step 3: Install Open WebUI

uv pip install open-webui

Step 4: Run Open WebUI

open-webui serve

Open WebUI listens on your local machine at port 8080. Press Ctrl+C to stop.

Step 5: Auto-start with systemd (Linux)

For a server environment, create /etc/systemd/system/open-webui.service:

[Unit]
Description=Open WebUI
After=network.target

[Service]
User=your-username
WorkingDirectory=/home/your-username/open-webui-env
ExecStart=/home/your-username/open-webui-env/bin/open-webui serve
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

Enable and start:

sudo systemctl enable open-webui
sudo systemctl start open-webui

Check status: sudo systemctl status open-webui.

Option 3: Desktop App

Open WebUI offers standalone desktop apps for Windows, Mac, and Linux. Download the latest release from github.com/open-webui/open-webui, extract the binary for your OS, and double-click to run. No dependencies, no configuration.

The desktop app runs locally without network exposure, so it is not suitable for team access. If you need multiple team members on the same instance, use Docker or Python with HTTPS setup covered below.

First Login and Admin Account Setup

When you first visit your local Open WebUI instance (port 3000 for Docker or port 8080 for Python), Open WebUI prompts you to sign up. There is no default admin account.

Enter an email, password, and name. This becomes your admin account with full permissions. All chats, user accounts, and settings are stored in the Docker volume or Python data directory.

Write down your password. Self-hosted Open WebUI has no password recovery. If you lose the password, you must manually reset the database or restore from a backup.

After login, go to Settings (gear icon, top-right) to configure model connections, user permissions, and security options.

Connecting to Model Endpoints

Open WebUI supports multiple model sources. Configuration differs slightly for each.

Ollama (local or remote)

Ollama is a local LLM runner that listens on port 11434 by default. In Open WebUI Settings > Connections > Ollama API Base URL, set your Ollama server address with port 11434 (e.g., localhost:11434 for local or your-server-ip:11434 for remote).

Pull models in Ollama first: ollama pull llama2. Then refresh the Open WebUI browser tab to see models in the dropdown.

OpenAI API

Go to Settings > Connections > OpenAI. Paste your API key from platform.openai.com/api-keys. Enable the connection. The dropdown populates with gpt-4, gpt-4-turbo, gpt-3.5-turbo, and any fine-tuned models.

OpenAI charges per token consumed. See their pricing page for current rates by model.

Anthropic (Claude API)

Go to Settings > Connections, add your Anthropic API key, and enable it. Claude models appear in the dropdown.

Other OpenAI-compatible APIs

Any provider that mimics OpenAI's API (LM Studio, vLLM, Together AI, Mistral, etc.) works via the OpenAI settings. Set Base URL to the provider endpoint (for example, localhost on port 8000 with /v1 path for LM Studio local). Paste the API key if required.

For a team comparing deployment options and operational complexity, see our analysis of self-hosted vs managed LLM interfaces.

Managing Team Users and Permissions

Open WebUI starts as single-user, but you can invite team members and assign roles.

Step 1: Add a user

Go to Settings > Users. Click Add User. Enter the team member's email and choose a role:

• Admin: Can invite users, modify settings, enable/disable model connections.
• User: Can chat and view shared conversations, but not change global settings.

Send the sign-up link to the team member. They create their own password.

Step 2: Share conversations

Open a chat. Click the Share icon (top-right). Generate a public link or copy the chat text. Shared conversations are readable without sign-in.

Step 3: Organize with groups (for larger teams)

For 10+ users, create groups in Settings > Groups. Add members, set permissions per group. This scales better than managing individual user permissions, but is unnecessary for small teams.

Securing Open WebUI with HTTPS

If Open WebUI is accessed over the internet or untrusted networks, HTTPS is mandatory. Local team networks can use unencrypted HTTP. HTTPS requires a certificate (self-signed for internal use, Let's Encrypt for public).

Step 1: Generate a self-signed certificate (optional, internal use only)

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes

Step 2: Configure a reverse proxy (nginx example)

Create an nginx configuration with SSL enabled. Use a reverse proxy to forward HTTPS requests to your running Open WebUI instance:

server {
    listen 443 ssl;
    server_name your-domain.com;
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;
    
    location / {
        proxy_pass backend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
    }
}

Set the backend destination to point to where Open WebUI is running. For a Docker container on the same machine, use the container's IP or hostname with port 3000. For Python installations, use localhost with port 8080. Restart nginx after updating the config: sudo systemctl restart nginx.

Step 3: Use Let's Encrypt for free certificates (public access)

Automate certificate generation and renewal with Certbot:

sudo apt install certbot python3-certbot-nginx
sudo certbot certonly --standalone -d your-domain.com

Certbot auto-renews certificates every 60 days. Use the generated certs in your nginx config (same template as above).

Step 4: Firewall rules

• Allow port 443 (HTTPS) from trusted IPs only
• Block ports 3000 or 8080 from the internet
• If behind a corporate firewall, whitelist the Open WebUI server IP

Backup and Disaster Recovery

Open WebUI stores chats, user accounts, and settings in its data directory. Regular backups are critical for data protection.

Docker backup

Backup the volume:

docker exec open-webui tar czf - /app/backend/data | gzip > open-webui-backup.tar.gz

Schedule weekly with cron:

0 2 * * 0 docker exec open-webui tar czf - /app/backend/data | gzip > /backups/open-webui-$(date +\%Y\%m\%d).tar.gz

Python backup

tar czf open-webui-backup.tar.gz ~/.local/share/open-webui/

Or configure automated backups with rsync or cloud sync (Nextcloud, S3, Google Drive).

Restore from backup

Stop the service, extract the backup, and restart:

docker stop open-webui
tar xzf open-webui-backup.tar.gz -C /var/lib/docker/volumes/open-webui-data/_data/
docker start open-webui

Always test restores in a non-production environment before relying on them.

Troubleshooting by Platform

Windows PATH issues

If open-webui command is not found after pip install, Python or uv is not in your system PATH. Add C:\Users\YourName\AppData\Local\Programs\Python\Python311\Scripts (adjust for your Python version) to Environment Variables via System Properties > Environment Variables > Path.

Mac permission errors

If you see "permission denied" running open-webui, check home directory permissions:

chmod u+w ~

Linux systemd service fails

Check the systemd journal:

sudo journalctl -u open-webui -f

Common causes: incorrect WorkingDirectory, wrong user ownership, or broken Python path. Edit /etc/systemd/system/open-webui.service, fix the issue, then reload:

sudo systemctl daemon-reload
sudo systemctl restart open-webui

Docker volume errors

If the container crashes or the volume is corrupted:

docker volume inspect open-webui-data
docker volume rm open-webui-data
docker run... (re-run Step 2 from Docker section)

This creates a fresh volume. Restore from backup if you have one.

Model endpoints not connecting

Verify the endpoint is reachable. For Ollama, test connectivity via curl to your Ollama server on port 11434. Check firewall rules if the endpoint is remote. Restart Open WebUI or refresh the browser.

Choosing the Right Setup for Your Team

Docker is the recommended path if you have multiple users, need easy scaling, or want automatic updates. Python works if you are testing on a single server or prefer minimal overhead. Desktop app is for solo evaluation only. All three methods can connect to Ollama, OpenAI, or any OpenAI-compatible API. If comparing Open WebUI to LM Studio for team use, see our detailed comparison of features, deployment complexity, and costs.

Frequently Asked Questions

How do I install Open WebUI on Ubuntu? Use Docker: sudo apt install docker.io, then run the Docker commands above. Or use Python: install python3.11-dev, create a venv, and uv pip install open-webui.

How do I set up Open WebUI with Ollama? Run Ollama on the same machine or remote server. In Open WebUI Settings > Connections > Ollama API Base URL, enter your Ollama server address with port 11434. Pull models in Ollama first: ollama pull llama2. Refresh Open WebUI to see them.

Can I run Open WebUI on Windows 11? Yes, via Docker Desktop or Python. Install Docker Desktop for Windows, run the Docker commands above, or install Python 3.11+ and follow the Python section. A desktop app is also available for Windows.

How do I invite team members to Open WebUI? Go to Settings > Users, click Add User, enter their email, choose Admin or User role, and send the sign-up link. They set their own password.

How do I back up my Open WebUI data? Docker: docker exec open-webui tar czf - /app/backend/data | gzip > backup.tar.gz. Python: tar czf ~/.local/share/open-webui/ > backup.tar.gz. Store backups off-site and test restores regularly.

Do I need HTTPS for Open WebUI? Only if accessing over the internet or untrusted networks. Internal team networks can use HTTP. HTTPS requires a certificate (self-signed or Let's Encrypt) and a reverse proxy.

Can I use multiple model providers at once? Yes. Go to Settings > Connections and enable Ollama, OpenAI, Anthropic, or any OpenAI-compatible endpoint. Chat dropdown shows all connected models.

The Bottom Line

Open WebUI is a lightweight, actively maintained interface with 157.7K GitHub stars. It connects your team to local or cloud-hosted language models and provides user management, shared conversations, and backup features. Docker is the fastest path for team setups. Python suits single-machine development. Regular backups and HTTPS are essential before production use. If you want a fully managed Open WebUI setup without infrastructure overhead, see our hosting options and compare self-hosted, managed, and cloud strategies for your team.