Use Open WebUI when you want a browser interface in front of Ollama, not another inference engine. Keep the UI, model server and storage as separate responsibilities. The important first test is whether the UI reaches the intended local model without exposing its unauthenticated backend.

This documentation-based setup belongs to the local inference foundation. If you already run Ollama natively, decide whether to keep that installation or use the container below; running both makes endpoint and model-store confusion more likely.

Two services, one private backend

This CPU-first Compose example publishes only the UI on host loopback. Review the downloaded images before use; replace moving tags with validated version tags or digests for a maintained installation.

services:
  ollama:
    image: ollama/ollama:latest
    volumes:
      - models:/root/.ollama
  webui:
    image: ghcr.io/open-webui/open-webui:main
    ports:
      - "127.0.0.1:3000:8080"
    environment:
      OLLAMA_BASE_URL: http://ollama:11434
      WEBUI_SECRET_KEY: ${WEBUI_SECRET_KEY:?Set a persistent random secret}
    volumes:
      - webui:/app/backend/data
    depends_on:
      - ollama
volumes:
  models:
  webui:

Create a strong random WEBUI_SECRET_KEY and supply it through your deployment environment. Preserve it across recreations, and keep it out of version control. The UI volume holds application data, including accounts and chat history; it needs protection and backups, not just persistence.

Start with docker compose up -d. Replace the model placeholder before running:

docker compose exec ollama ollama pull MODEL_NAME
docker compose exec ollama ollama list
docker compose logs --tail 100 webui

Open http://127.0.0.1:3000. Complete the initial account setup on your trusted machine before permitting other users. Verify administrator ownership and current signup settings; do not disable authentication for convenience.

Confirm the connection, not just the page

A loaded login page proves that the frontend is serving. A model list and successful short chat prove the backend path works. The UI container uses http://ollama:11434, not localhost:11434: localhost inside that container is the UI itself.

If the model does not appear, compare the UI connection configuration with docker compose exec ollama ollama list. Existing persisted admin settings can affect connection behavior; review the configured provider in the admin interface rather than recreating volumes. Use Docker networking diagnosis or missing model diagnosis for the appropriate layer.

GPU access belongs on the Ollama service and depends on the host. Add it only after the CPU/network path is understood, using the official runtime mappings.

“Local chat” does not prove every feature is offline

Audit configured model providers, embeddings, speech services, web search, tools and plugins separately. A local chat model can coexist with external document processing or search. Test with nonsensitive data first, restrict tool permissions and define retention for chat uploads.

Remote team access needs authenticated TLS access and a reviewed authorization boundary. Do not publish Ollama’s raw port as an alternative to securing the UI. For document answers, validate evidence and access permissions using the local RAG workflow.

Before upgrading, back up application data, record image versions and test account access plus a known conversation. A moving image tag is not a reproducibility policy.

Sources checked November 10, 2026: Open WebUI quick start, Ollama API authentication. Configuration and feature behavior depend on the installed release; no deployment benchmark is claimed.