Bottom line up front: OpenWebUI gives you a ChatGPT-style interface running entirely on your own hardware. Your prompts never leave your machine. Setup takes about 20 minutes if you already have Docker installed. Here's exactly how to do it.

If you've been using ChatGPT or Claude for work, you've been feeding your queries to cloud servers you don't control. For most people that's a calculated trade-off. For developers handling client code, legal teams reviewing contracts, or security researchers doing threat modeling, it's a liability.

OpenWebUI solves this. It's a polished, full-featured web interface for local language models — think the ChatGPT UI, but the model runs on your CPU or GPU, processes data locally, and sends exactly zero tokens to any external server.

This guide walks you through a complete production-ready setup: OpenWebUI + Ollama on Docker, with encrypted backup of your conversation history and config.

What Is OpenWebUI (and Why It Beats a Raw Terminal)

Ollama alone is powerful — you can pull models and chat via ollama run llama3 in your terminal. But raw terminal chat has real friction: no conversation history UI, no file uploads, no system prompt management, no multi-model switching.

OpenWebUI wraps Ollama in a browser interface with:

Persistent conversation history stored locally in SQLite
Multi-model switching mid-session (compare Llama 3.3 vs Mistral on the same prompt)
File upload and RAG — chat with your PDFs, CSVs, and code files without sending them anywhere
System prompt presets — define personas like "Code Reviewer" or "Legal Summarizer"
User accounts — run it as a shared team tool on your LAN
Image generation — connect to a local Stable Diffusion instance
Voice input/output — uses local Whisper models for transcription

All of it runs in your browser, backed entirely by local compute. There's no telemetry that can't be disabled, no account required, no SaaS subscription.

Prerequisites

Before starting, make sure you have:

```bash

Docker and Docker Compose

docker --version # 24.x or higher

docker compose version # v2.x

At least 8GB RAM free (16GB recommended for 7B+ models)

20GB+ free disk space for models

```

If you're on macOS, Docker Desktop handles both. On Linux, install the Docker Engine directly — avoid Snap packages, they have permission issues with volume mounts.

You don't need a GPU. Modern CPUs handle 7B parameter models at 10-20 tokens/second, which is perfectly usable for most tasks. GPU acceleration (NVIDIA CUDA or Apple Metal) is optional but will speed things up significantly.

Step 1: Install Ollama

Ollama manages your local model downloads and serves them via a local REST API that OpenWebUI connects to.

macOS / Linux:

```bash

curl -fsSL https://ollama.com/install.sh | sh

```

Windows:

Download the installer from ollama.com. It runs as a system service.

Verify it's running:

```bash

curl http://localhost:11434/api/tags

Should return {"models":[]}

```

Pull your first model. For a privacy workflow, Llama 3.3 70B is the quality benchmark — but for most machines, start with a quantized 7B or 8B:

```bash

Fast, capable, fits in 8GB RAM

ollama pull llama3.2

Stronger reasoning, needs 16GB+

ollama pull llama3.3:70b-instruct-q4_K_M

Excellent for code

ollama pull qwen2.5-coder:7b

Mistral for multilingual or EU compliance scenarios

ollama pull mistral:7b-instruct

```

Models are stored in ~/.ollama/models on macOS/Linux or C:\Users\\.ollama\models on Windows. Plan for 4-8GB per model.

Step 2: Deploy OpenWebUI with Docker Compose

Create a dedicated directory for your setup:

```bash

mkdir -p ~/private-ai/openwebui && cd ~/private-ai/openwebui

```

Create a docker-compose.yml:

```yaml

services:

open-webui:

image: ghcr.io/open-webui/open-webui:main

container_name: open-webui

restart: unless-stopped

ports:

- "3000:8080"

volumes:

- open-webui-data:/app/backend/data

environment:

- OLLAMA_BASE_URL=http://host.docker.internal:11434

- WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY}

- ENABLE_SIGNUP=false

extra_hosts:

- "host.docker.internal:host-gateway"

volumes:

open-webui-data:

driver: local

```

Create a .env file for secrets:

```bash

Generate a secure random key

WEBUI_SECRET_KEY=$(openssl rand -hex 32)

echo "WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY}" > .env

```

Important: Add .env to your .gitignore immediately if this directory is version controlled.

Start it:

```bash

docker compose up -d

```

Open http://localhost:3000 in your browser. The first time, you'll create an admin account — this is stored locally, not sent anywhere.

Step 3: Configure for Maximum Privacy

The default OpenWebUI install is already private, but these settings lock it down further.

In Settings → General:

Disable "Usage Data Sharing" (off by default, but verify)
Disable "Enable Community Sharing"

In Settings → Interface:

Turn off "Show Suggested Follow-Up Questions" if you don't want any external API calls (this feature can optionally use external services)

Disable model auto-updates if you want a pinned, audited version:

```yaml

In docker-compose.yml, pin to a specific version instead of :main

image: ghcr.io/open-webui/open-webui:v0.5.x

```

Verify no outbound traffic. On macOS:

```bash

Monitor network connections from the container

lsof -i -n -P | grep docker

```

On Linux, use ss -tunap or nethogs. You should see connections only to localhost:11434 (Ollama) and nothing hitting external IPs.

Step 4: Set Up Document Chat (Local RAG)

This is the feature that replaces tools like ChatPDF or Claude's document upload — except your documents never leave your machine.

OpenWebUI has built-in RAG (Retrieval-Augmented Generation) using a local embedding model. Enable it:

Go to Admin Panel → Documents
Set the embedding model to nomic-embed-text (pull it first: ollama pull nomic-embed-text)
Upload documents via the paperclip icon in any chat

For legal docs, financial reports, or client code, this means you can ask questions like "What are the indemnification clauses in this contract?" without the document touching any cloud server.

Supported formats: PDF, DOCX, TXT, CSV, Markdown, code files.

Step 5: Back Up Your Config and Conversation History

OpenWebUI stores everything — conversations, uploaded documents, user settings — in a Docker named volume (open-webui-data). If your container is deleted or you migrate machines, you lose everything unless you back it up.

The volume lives at:

```bash

Find the actual path

docker volume inspect open-webui-data | grep Mountpoint

```

Typically: /var/lib/docker/volumes/openwebui_open-webui-data/_data

Automated encrypted backup with Tresorit:

For a zero-knowledge encrypted sync of your AI workspace — including conversation history and any documents you've uploaded — Tresorit Business is the right tool here. Unlike Dropbox or Google Drive, Tresorit uses end-to-end encryption where even Tresorit can't read your files. For a local AI setup where privacy is the whole point, using a cloud backup that can inspect your files would undercut the entire effort.

Set up a selective sync folder pointing to your OpenWebUI data directory, and your conversation history is encrypted-at-rest and backed up off-site automatically.

Affiliate Disclosure: This article may contain affiliate links. If you make a purchase through these links, we may earn a small commission at no extra cost to you. We only recommend products we genuinely believe in. This helps support our work and allows us to continue providing free content.

But for anything touching client data, proprietary code, medical records, financial models, or legal documents — local is the only defensible choice.

Troubleshooting Common Issues

OpenWebUI can't connect to Ollama:

```bash

Check Ollama is running

curl http://localhost:11434/api/tags

Check the container can reach host

docker exec open-webui curl http://host.docker.internal:11434/api/tags

```

If the container can't reach the host, the extra_hosts mapping may not be working on your Docker version. Alternative: use network_mode: host in the compose file (Linux only).

Model responses are very slow:

Check whether Ollama is using CPU or GPU acceleration:

```bash

ollama ps # Shows active models and their memory type

```

For macOS with Apple Silicon, Ollama uses Metal by default — verify with ollama run llama3.2 and check for GPU usage in Activity Monitor → GPU History.

"Connection refused" on port 3000:

```bash

docker compose ps # Is the container running?

docker compose logs -f # Check for startup errors

```

The container needs 30-60 seconds to initialize on first run.

Keeping Your Entire AI Stack Encrypted

OpenWebUI handles the interface and model connectivity. For the rest of your AI workspace — system prompt templates, RAG document libraries, project-specific configs, notes on model behavior — you want the same zero-knowledge encryption on your file storage.

Proton Drive is worth considering here as a direct replacement for Google Drive or iCloud for your AI project files. It's end-to-end encrypted, open-source clients, and the free tier gives you 1GB to start. For a self-hosted AI practitioner who's already taken the trouble to keep data local, mixing in an unencrypted cloud sync for your configs is a gap worth closing.