Artificial Intelligence (AI) Azure

Open WebUI on Ubuntu 24.04 on Azure User Guide

| Product: Open WebUI on Ubuntu 24.04 LTS on Azure

Overview

Open WebUI is the leading open source, self hosted AI chat interface: a feature rich web front end for large language models that fronts a local Ollama backend and any OpenAI compatible API. It gives you a polished chat workspace in your browser with retrieval over your own documents, model and prompt management, and multi user workspaces with role based access control.

The cloudimg image ships Open WebUI as a two service Docker Compose project under /opt/open-webui: a bundled local Ollama backend so the appliance is usable on its own, and the Open WebUI web app bound to loopback 127.0.0.1:8080, both fronted by nginx on port 80. nginx is configured for the WebSocket traffic the live interface relies on and is ready for your TLS certificate.

Secure by default, no default login: the image ships with no administrator and no user rows. The first account you register becomes the administrator, so your first visit lands on the sign up screen. A open-webui-firstboot.service oneshot pulls the newest images, brings the stack up, resolves the instance URL and writes a root only instance info note on first boot, then disables itself.

Always current: AI tooling moves fast, so the image does not pin a stale version. On first boot the stack runs docker compose pull to fetch the newest Open WebUI and Ollama images, so every launch runs current software rather than the version frozen at build time.

What is included:

  • Open WebUI (rolling release, verified at 0.10.2) as ghcr.io/open-webui/open-webui:main
  • A bundled local Ollama backend (ollama/ollama:latest) on the private Docker network
  • Docker Engine with the Compose plugin from the official Docker repository
  • open-webui.service managing the Compose stack, bound to 127.0.0.1:8080
  • nginx reverse proxy on port 80, WebSocket aware, ready for TLS
  • open-webui-firstboot.service for the first boot pull, start and info note
  • Ubuntu 24.04 LTS base, fully patched
  • 24/7 cloudimg support, 24h response SLA

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet with a subnet. Open WebUI itself is lightweight, but running language models is memory hungry. Recommended VM size: Standard_D4s_v5 (4 vCPU, 16 GB RAM) so a small to mid size model runs comfortably on CPU. For faster inference launch on an optional NVIDIA GPU VM such as the Standard_NC or Standard_ND series. Language model files are large, so expand the OS disk (or attach a data disk) before pulling bigger models.

Step 1: Deploy from the Azure Portal

Search the Marketplace for Open WebUI on Ubuntu 24.04, choose your VM size, and attach an NSG that allows TCP 22 (SSH) from your management network and TCP 80 / 443 (the interface) from the networks that need it. Front port 80 with TLS in production (see the HTTPS section below).

Step 2: Deploy from the Azure CLI

RG="open-webui-prod"; LOCATION="eastus"; VM_NAME="open-webui-01"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/open-webui-ubuntu-24-04/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
az group create --name "$RG" --location "$LOCATION"
az network vnet create -g "$RG" --name owui-vnet --address-prefix 10.90.0.0/16 --subnet-name owui-subnet --subnet-prefix 10.90.1.0/24
az network nsg create -g "$RG" --name owui-nsg
az network nsg rule create -g "$RG" --nsg-name owui-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp
az network nsg rule create -g "$RG" --nsg-name owui-nsg --name allow-web --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 443 --access Allow --protocol Tcp
az vm create -g "$RG" --name "$VM_NAME" --image "$GALLERY_IMAGE_ID" \
  --size Standard_D4s_v5 --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name owui-vnet --subnet owui-subnet --nsg owui-nsg --public-ip-sku Standard

Step 3: Connect via SSH

ssh azureuser@<vm-ip>

Step 4: Verify the services are running

Docker runs the Compose stack, Open WebUI listens on loopback 127.0.0.1:8080, and nginx fronts the interface on port 80 and proxies its WebSocket traffic.

sudo systemctl is-active docker open-webui nginx
ss -tln | grep -E ':80 |127.0.0.1:8080'
curl -s -o /dev/null -w 'GET /health -> HTTP %{http_code}\n' http://127.0.0.1/health

All three services report active, Open WebUI is bound to 127.0.0.1:8080, nginx is bound to :80, and the health endpoint returns HTTP 200 through nginx.

docker, open-webui and nginx services active, Open WebUI bound to 127.0.0.1:8080, nginx on port 80, and the health endpoint returning HTTP 200

Step 5: Secure by default, no admin ships

Nothing sensitive ships in the image. Open WebUI reports the onboarding state because it has zero users, so every instance starts at the sign up screen. The per VM instance info note in /root is root only and contains no credential, only the resolved URL.

curl -s http://127.0.0.1/api/config | jq '{onboarding, version}'
sudo stat -c '%n perms=%a owner=%U:%G' /root/open-webui-info.txt
sudo grep -E '^OPEN_WEBUI_URL|^NOTE' /root/open-webui-info.txt

The config reports onboarding: true (no admin exists), the note is 600 root:root, and it tells you that the first account you create at the sign up screen becomes the administrator.

Open WebUI reporting onboarding true with zero users, and a root only instance info note that holds no credential, only the resolved interface URL

Step 6: Create your administrator account

Open http://<vm-ip>/ in your browser. Because no administrator ships, Open WebUI shows its Create Admin Account sign up screen. Enter a Name, an Email and a strong Password, then click Create Admin Account. This first account is the administrator, so pick a real password.

The Open WebUI sign up screen where you create the first administrator account; no admin ships in the image

After creating the admin you are signed in automatically and land in the chat workspace, with the model selector at the top and the prompt box ready.

The Open WebUI chat workspace immediately after creating the administrator, with the model selector and the prompt box ready

Step 7: Pull a model and start chatting

A local Ollama backend is bundled, so you can pull a model straight from the interface. Open the model selector at the top of the chat and use Manage Models (or Settings then Models) to download a model such as llama3.2 or phi3. Smaller models fit the default disk; expand the disk first for larger ones.

The Open WebUI model management panel, where you pull a model from the bundled local Ollama backend

Once a model is downloaded, select it in the chat and send a prompt. You can also connect an OpenAI compatible provider under Settings then Connections to use hosted models alongside the local ones.

The Open WebUI settings showing the bundled local Ollama connection and where to add an OpenAI compatible provider

Step 8: The runtime stack

docker --version
nginx -v
sudo docker compose -f /opt/open-webui/docker-compose.yml ps
curl -s http://127.0.0.1/api/config | jq -r .version

Docker runs the two container Compose stack, nginx fronts it, both the openwebui-app and openwebui-ollama containers report Up, and Open WebUI reports its running version.

Docker and nginx versions, the openwebui-app and openwebui-ollama containers both Up, and the running Open WebUI version reported through the API

Step 9: Data, persistence and staying current

Open WebUI data (users, chats, settings) and the Ollama models live in Docker named volumes captured into the image, and the first boot service keeps every instance current.

sudo docker volume ls --format '{{.Name}}' | grep openwebui
systemctl is-enabled open-webui-firstboot.service
apt-mark showhold
sudo docker images --format '{{.Repository}}:{{.Tag}} {{.Size}}'

The openwebui_open-webui and openwebui_ollama volumes hold the data, the first boot service has already run once and disabled itself on this instance, there are no held packages so the OS security baseline is intact, and the baked images are present so the stack starts immediately while the first boot pull fetches any newer release.

The Open WebUI and Ollama Docker volumes, the first boot service state, an intact OS patch baseline with no held packages, and the baked container images on disk

Step 10: Enable HTTPS

nginx already fronts Open WebUI on port 80 and is ready for TLS. Point a DNS record at your VM, then obtain a certificate with certbot:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain> --agree-tos -m <your-email> --redirect

certbot installs the certificate, rewrites the nginx server block for TLS, and sets up automatic renewal. Your interface is then served over HTTPS. Open WebUI is a secure context web app, so serving it over HTTPS also enables browser features such as voice input.

Managing the service

sudo systemctl is-active open-webui nginx docker

All three report active. The Compose stack is managed by open-webui.service; use sudo systemctl restart open-webui to restart it and sudo docker compose -f /opt/open-webui/docker-compose.yml logs -f to follow the container logs live. To refresh to the newest release at any time, run sudo docker compose -f /opt/open-webui/docker-compose.yml pull then sudo systemctl restart open-webui. Back up the instance by snapshotting the OS disk or exporting the openwebui_open-webui volume while the service is stopped.

Support

cloudimg provides 24/7 support for this image via email and live chat: deployment, nginx TLS termination, model backends, GPU acceleration, upgrades and performance tuning. Email support@cloudimg.co.uk.

This is a repackaged open source software product with additional charges for cloudimg support services. Open WebUI and Ollama are trademarks of their respective owners. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.