Open WebUI

Search the Marketplace for Open WebUI on Ubuntu 24.04 and choose your VM size. Attach an NSG that allows TCP 22 (SSH) from your management network and TCP 80 / 443 (the interface) from the networks that need it. Front port 80 with TLS in production (see Step 10).

RG="open-webui-prod"; LOCATION="eastus"; VM_NAME="open-webui-01" IMAGE_URN="sac1647283583153:open-webui-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name owui-vnet --address-prefix 10.90.0.0/16 --subnet-name owui-subnet --subnet-prefix 10.90.1.0/24 az network nsg create -g "$RG" --name owui-nsg az network nsg rule create -g "$RG" --nsg-name owui-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name owui-nsg --name allow-web --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 443 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:open-webui-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_D4s_v5 --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name owui-vnet --subnet owui-subnet --nsg owui-nsg --public-ip-sku Standard

ssh azureuser@<vm-ip>

Docker runs the Compose stack, Open WebUI listens on loopback 127.0.0.1:8080, and nginx fronts the interface on port 80 and proxies its WebSocket traffic.

sudo systemctl is-active docker open-webui nginx ss -tln | grep -E ':80 |127.0.0.1:8080' curl -s -o /dev/null -w 'GET /health -> HTTP %{http_code}\n' http://127.0.0.1/health

All three services report active. Open WebUI is bound to 127.0.0.1:8080, nginx is bound to :80, and the health endpoint returns HTTP 200 through nginx.

Nothing sensitive ships in the image. Open WebUI reports the onboarding state because it has zero users, so every instance starts at the sign-up screen. The per-VM instance info note in /root is root-only and contains no credential, only the resolved URL.

curl -s http://127.0.0.1/api/config | jq '{onboarding, version}'
sudo stat -c '%n perms=%a owner=%U:%G' /root/open-webui-info.txt
sudo grep -E '^OPEN_WEBUI_URL|^NOTE' /root/open-webui-info.txt

The config reports onboarding: true (no admin exists), and the note is 600 root:root. The note tells you that the first account you create at the sign-up screen becomes the administrator.

Open http://<vm-ip>/ in your browser. Because no administrator ships, Open WebUI shows its Create Admin Account sign-up screen. Enter a Name, an Email and a strong Password, then select Create Admin Account. This first account is the administrator, so choose a strong password.

After you create the admin account, you are signed in automatically and land in the chat workspace, with the model selector at the top and the prompt box ready.

A local Ollama backend is bundled, so you can pull a model straight from the interface. Open the model selector at the top of the chat and use Manage Models (or Settings then Models) to download a model such as llama3.2 or phi3. Smaller models fit the default disk. Expand the disk first for larger ones.

Once a model is downloaded, select it in the chat and send a prompt. You can also connect an OpenAI-compatible provider under Settings then Connections to use hosted models alongside the local ones.

docker --version nginx -v sudo docker compose -f /opt/open-webui/docker-compose.yml ps curl -s http://127.0.0.1/api/config | jq -r .version

Docker runs the two-container Compose stack and nginx fronts it. Both the openwebui-app and openwebui-ollama containers report Up, and Open WebUI reports its running version.

Open WebUI data (users, chats, settings) and the Ollama models live in Docker named volumes captured into the image. The first-boot service keeps every instance current.

sudo docker volume ls --format '{{.Name}}' | grep openwebui systemctl is-enabled open-webui-firstboot.service apt-mark showhold
sudo docker images --format '{{.Repository}}:{{.Tag}} {{.Size}}'

The openwebui_open-webui and openwebui_ollama volumes hold the data. The first-boot service has already run once and disabled itself on this instance. There are no held packages, so the OS security baseline is intact. The baked-in images are present, so the stack starts immediately while the first-boot pull fetches any newer release.

nginx already fronts Open WebUI on port 80 and is ready for TLS. Point a DNS record at your VM, then obtain a certificate with certbot:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain> --agree-tos -m <your-email> --redirect

certbot installs the certificate, rewrites the nginx server block for TLS and sets up automatic renewal. Your interface is then served over HTTPS. Open WebUI is a secure-context web app, so serving it over HTTPS also enables browser features such as voice input.