toolkitbox

~/ / AI articles / Local LLMs on a VPS / Open WebUI on a VPS: run it in Docker and connect it to Ollama

Open WebUI on a VPS: run it in Docker and connect it to Ollama

A chat window in the browser is the easiest way to use a model that runs on your own server. Open WebUI is one such interface, and its documentation shows how to start it with Docker and how to connect it to Ollama. This article follows the official quick start and the connection guides, step by step, and notes where the two guides describe the connection differently.

Published: · 4 min read · Checked against the official Open WebUI documentation on 2026-10-26. Commands, image tags and settings change between versions, so confirm them in the current documents before you run anything on a server.

Check the memory first

Open WebUI is an extra program on the same server, and the documentation gives no memory figure for it. The standard image, tagged main, includes bundled speech-to-text and embedding models according to the quick start. Estimate the memory of your model first, and leave room for the interface and the operating system.

Try it: Local LLM Memory Estimator

Model

Ollama tag qwen3:8b, quantization Q4_K_M, download size 5.2 GB.

Estimate

Model weights
4.84 GiB
KV cache
0.56 GiB
Reserve
1.00 GiB
Total
6.41 GiB (6.88 GB)
Smallest common memory size that holds it
8 GiB

This is an estimate. It does not include the runtime's compute buffers, and it assumes that every layer has the same KV shape. Measure a real run before you choose a plan.

Model data checked on 2026-10-26.

Sources: Ollama library · Model configuration (config.json) · Ollama FAQ

Everything runs in your browser. Nothing is uploaded.

Start it with Docker

The quick start serves Open WebUI at http://localhost:3000 and runs it with one docker run command. Replace your-secret-key with a value that you generate, for example with the command that the guide gives for it.

StepCommand
Generate a secret keyopenssl rand -hex 32
Start Open WebUIdocker run -d -p 3000:8080 --add-host=host.docker.internal:host-gateway -v open-webui:/app/backend/data -e WEBUI_SECRET_KEY=your-secret-key --name open-webui --restart always ghcr.io/open-webui/open-webui:main
Follow the logsdocker logs -f open-webui
  • -p 3000:8080 maps port 3000 of the host to port 8080 of the container.
  • The volume open-webui holds your chats, users and settings. The guide says it survives updates and that you should never run without it.
  • WEBUI_SECRET_KEY: the guide says to set it once and keep it, because without a fixed key every recreated container logs everyone out, and a new key signs everyone out.
  • The image tags: main is the standard image, cuda adds NVIDIA GPU support and needs --gpus all, and ollama bundles Ollama inside the same container.

The first account is the administrator

The first screen offers to create an admin account. According to the guide, that first account is the administrator, which manages users and every instance-wide setting, and sign-up switches itself off once the admin account exists.

Our recommendation, not a statement from the documents: create the admin account right after the container starts, before you tell anyone the address, because whoever reaches the page first can create it.

Connect it to Ollama: two ways in the documentation

The Open WebUI pages that we checked describe the connection in two different ways. Use the page that matches the version you run, and confirm which type your version offers in Settings, Admin, Connections.

ConnectionWhat the page says
Ollama API protocolUnder Settings > Admin > Connections, Manage Ollama API Connections. The page gives port 11434 as the typical port, and says to use http://host.docker.internal:11434 when Open WebUI runs in Docker and Ollama runs on the host.
OpenAI-type connectionAdd a connection of type OpenAI with the Base URL http://localhost:11434/v1 and any text as the API key. The page says Ollama does not check the key, but the field cannot be empty, and that typing ollama works.
  • Pulled models are discovered automatically and appear in the model selector. You may limit them with a comma-separated list.
  • You can add several Ollama instances. The page says requests are distributed by random selection, model IDs must match exactly across instances, and a prefix such as remote/ tells instances with the same model names apart.
  • For a slow or unreachable endpoint, the page suggests setting AIOHTTP_CLIENT_TIMEOUT_MODEL_LIST=3 (the default is 10 seconds) for faster failover.
  • If the connection fails, the page names network misconfiguration as the most common cause and points to its troubleshooting guide.

The pages we checked do not say whether a container can reach an Ollama that listens only on 127.0.0.1, and they do not cover widening Ollama's address. Ollama binds 127.0.0.1 by default according to its FAQ. Our recommendation: do not open Ollama to the whole network without a firewall rule that limits it to the addresses you use.

Update and remove

TaskCommands from the quick start
Update by handdocker rm -f open-webui, then docker pull ghcr.io/open-webui/open-webui:main, then the same docker run command as before
Update with Watchtowerdocker run --rm --volume /var/run/docker.sock:/var/run/docker.sock nickfedor/watchtower --run-once open-webui
Uninstalldocker rm -f open-webui, then docker rmi ghcr.io/open-webui/open-webui:main, then docker volume rm open-webui

Removing the volume deletes your chats, users and settings. The guide says that your data is in the volume, so keep it when you update.

Keep it private

  • The quick start shows a variant with WEBUI_AUTH=False. Our recommendation, not a statement from the documents: do not use it on a server that anyone can reach.
  • Put HTTPS and a firewall rule in front of port 3000 before you share the address, and keep the secret key out of anything you commit.
  • The quick start also shows how to point Open WebUI at another server with OLLAMA_BASE_URL. If you do, treat that connection as part of your private network too.

Sources

Read next