Open WebUI in 2026: What Self-Hosting It Actually Requires

Open WebUI is usually listed as one entry in a "best self-hosted ChatGPT" roundup, sitting next to LibreChat and LobeChat. It is not really the same kind of decision, because the thing you install is not a model and not a full AI platform. It is a front end: a chat interface, a user system, a knowledge base and a pile of extensions wrapped around models that run somewhere else.

That distinction decides almost everything below. The software itself has no licence fee, the repository carries 158,000 GitHub stars as of November 7, 2026, and the install is one Docker command. The cost and the risk live in the parts the command does not show you: where the data volume goes, which image tag you pinned, and what the licence quietly changed in 2025.

1. It Is a Front End, So Your Bill Is Somewhere Else

Open WebUI ships no model weights. You point it at something that serves a model: Ollama on the same machine, Ollama on another host, or any OpenAI-compatible API with a key. The chat experience - model picker, per-user accounts, retrieval over your own documents, web search, pipelines - is the product. The inference is yours to pay for, whether that is a GPU in the corner of the room or a per-token API bill.

This is why "self-hosted" and "private" are not the same claim. Running the interface on your own server does keep conversations and documents on your hardware, but if the backend is a cloud API, prompts still leave the building. If privacy is the actual goal, the model has to be local too, and then the hardware requirement moves from a small VM to something with a GPU.

The feature set is broader than a chat window: retrieval over uploaded documents, web search, tool and pipeline extensions, and an ecosystem that now includes Open Terminal, Knowledge Base Sync for mirroring folders and repos into knowledge bases, and Open WebUI Computer for driving a machine from the browser. None of that changes the core shape - interface here, inference there.

2. The Install: One Command, Three Flags That Decide Whether It Survives

The documented Docker install is a single line:

docker run -d -p 3000:8080 -v open-webui:/app/backend/data --name open-webui ghcr.io/open-webui/open-webui:main

Three parts of that line matter more than the rest. -p 3000:8080 maps the UI to port 3000 while the container listens on 8080, which is why every reverse-proxy tutorial quotes 8080. -v open-webui:/app/backend/data is the persistent volume - drop it and every chat, user and uploaded document disappears with the next container. And the named volume is also what you have to back up, because it holds the database and the files.

The flag that is not in the command is the one people lose sleep over: WEBUI_SECRET_KEY. Without a fixed value, recreating the container invalidates sessions and logs everyone out. Set it once and keep it - generate one with openssl rand -hex 32 - and pass it as -e WEBUI_SECRET_KEY=... on every run. The same applies to WEBUI_AUTH=False, which turns off logins for a single-user setup and cannot be reversed later on the same data volume, so it is a decision to make before anyone starts using the instance.

Two more installation facts are worth knowing before you pick a tag. WebSocket support is required, so any proxy in front of it has to forward upgrade headers or the chat will stall. And the Python path only supports 3.11 and 3.12 - the documentation states that 3.13 is not supported yet and installs on it fail or break at runtime, which rules out "just use the newest Python" on a fresh server.

Tags: :main and :latest are the same rolling image rebuilt whenever a change lands on main, and :latest does not mean "newest stable release". :dev is the pre-release nightly, useful for testing the next version on a second instance, and it must never share a data volume with production because dev builds can run migrations a release image cannot read back. :main-slim cuts the image size but downloads Whisper and embedding models on first use. :cuda needs --gpus all and the Nvidia Container Toolkit; :ollama bundles Ollama in the same container. For anything you intend to keep, pin a version tag such as :vX.Y.Z, which never moves.

3. The Licence Clause That Most Roundups Still Skip

Calling Open WebUI "open source" without a caveat is out of date. With v0.6.6, released April 19, 2025, the project added a branding protection clause to its otherwise permissive licence: you may not remove, alter or obscure the Open WebUI name and logo in a deployment or distribution unless you are covered by one of three exceptions.

• Your deployment serves 50 or fewer users in a rolling 30-day window, in which case you may rebrand.
• You are a substantive contributor and have specific prior written permission for the branding change.
• You hold an enterprise licence that explicitly allows it.

The project's own licence FAQ is direct about the consequence: v0.6.6 and later is not an OSI-approved open source licence. All code merged up to and including v0.6.5 remains BSD-3-Clause, and anyone who dislikes the new terms can fork from that release with no restrictions. The source is still public and still developed in the open; what changed is that "permissive" now comes with one condition attached, and that condition is about the brand rather than the code.

In practice this splits cleanly along deployment size. A team running it internally for fifty people or fewer can white-label it or leave the branding alone, either way. An agency reselling a "custom AI platform" to clients, or a company that wants its own logo in the footer, is past that line and needs the enterprise licence - and adding a small company logo counts as co-branding even at the bottom of the page. A plain-text administrative notice such as "Managed by your organisation", set smaller than the smallest standard text size and without logos or brand styling, is the permitted middle ground.

Pricing: There is no licence fee to run Open WebUI for your own users - you pay for the server, the storage, and whatever the models cost. Enterprise and proprietary licences exist for white-label deployments, priority support and custom features, and the project does not publish a price for them; it directs buyers to sales. Anyone quoting a fixed enterprise number is guessing.

4. Where It Falls Short

The rolling tags are a production trap. :main is rebuilt on every merge, so "docker pull and restart" is an unplanned upgrade that can change behaviour underneath your users. The documentation says to pin version tags for reproducible or production deployments; most outage stories about self-hosted chat UIs start with someone treating a rolling tag as a stable one.

It does not make the model cheap. The interface being free moves no cost. A local 7B model on a laptop is slow and weak; a larger local model needs a GPU that costs more than a year of API credits for a small team. Most "we self-host to save money" projects discover they self-host to save privacy instead, and pay for it in hardware and maintenance.

The operations are yours. Volume backups, secret-key rotation, proxy WebSocket configuration, database migrations on upgrade, and the fact that dev and production volumes must stay separate - none of that is handled for you. And when the licence question comes up during procurement, "it is open source" is not an answer that survives contact with a legal team that reads the v0.6.6 FAQ.

Single-user mode is one-way. Turning authentication off is convenient for a home lab and a footgun for anything that later needs accounts, because the setting cannot be switched back on the same data.

How to Choose

Open WebUI is the right pick when you want a multi-user chat front end over models you already run, with retrieval and extensions, and you are willing to own the deployment. It is the wrong pick when the actual requirement is a single desktop app for document chat, or when you need white-label branding at scale without buying a licence.

If you are still deciding between interfaces rather than committing to one, the seven-way comparison of self-hosted chat UIs covers the field, including LibreChat for provider breadth, LobeChat for interface polish and AnythingLLM for document-first desktop use.

Whichever you pick, do the same three checks before you invite users: is the data volume backed up, is the image tag pinned, and does your proxy pass WebSockets. Those three account for most of the difference between a demo that impressed everyone on Friday and a service that is still running on Monday.