01 // HOMELABDocker / ComposeApple Silicon MacNVIDIA GPU~9 min read & lab

Ollama + Open WebUI Operations: Installation, Persistence, Backup, Upgrade & Safe Restore

Pin exact container image tags, map host bind mounts for SQLite & vector stores, run a 10-second pre-upgrade snapshot, and practice full rollback.

[KEY VERIFIED TAKEAWAY / TL;DR]In Tinker AI Lab's reproducible verification of "Ollama + Open WebUI Operations: Installation, Persistence, Backup, Upgrade & Safe Restore" (tested on Linux HomeLab (Ubuntu 24.04 · Docker Compose v2.29) & macOS Host + Docker WebUI with Ollama 0.5.7, Open WebUI v0.5.10, SQLite 3 (webui.db), verified 2026-10-23): Pin exact container image tags, map host bind mounts for SQLite & vector stores, run a 10-second pre-upgrade snapshot, and practice full rollback. Offline capability is classified as "Requires Explicit Env Vars to Disable Outbound Calls" (Set `SCARF_NO_ANALYTICS=true`, `DO_NOT_TRACK=true`, and local `RAG_EMBEDDING_ENGINE=ollama` so Open WebUI does not contact HuggingFace or analytics servers.), with key operational boundary: Upgrading Open WebUI runs automatic Alembic schema migrations on `/app/backend/data/webui.db`; simply changing the Docker image tag back to an older version WITHOUT restoring your backup tar will fail to boot.

REPRODUCIBILITY MANIFEST // TESTED SPECS & LIMITS

Last Verified: 2026-10-23

Tested Hardware & OS

Linux HomeLab (Ubuntu 24.04 · Docker Compose v2.29) & macOS Host + Docker WebUI

Pinned Stack & Model Versions

Ollama 0.5.7Open WebUI v0.5.10SQLite 3 (webui.db)

Offline & Network Boundary

Requires Explicit Env Vars to Disable Outbound Calls

Set `SCARF_NO_ANALYTICS=true`, `DO_NOT_TRACK=true`, and local `RAG_EMBEDDING_ENGINE=ollama` so Open WebUI does not contact HuggingFace or analytics servers.

Known Limits & Failure Modes

Upgrading Open WebUI runs automatic Alembic schema migrations on `/app/backend/data/webui.db`; simply changing the Docker image tag back to an older version WITHOUT restoring your backup tar will fail to boot.
Anonymous or unnamed Docker volumes are easily wiped by `docker compose down -v`; always use explicit host path bind mounts (`./tinker-local-ai-data`).

Hit an edge-case failure?Open Troubleshooter →

1. Directory Layout & Version-Pinned Docker Compose

Official quick-start commands use `:main` and internal named volumes. In long-term HomeLab operation, `:main` means an unattended pull can break your UI or database overnight. Our verified Compose stack pins `ollama/ollama:0.5.7` and `ghcr.io/open-webui/open-webui:v0.5.10`, and binds all stateful data under `./tinker-local-ai-data/{ollama,open-webui}`.

Table 1: Stateful Host Bind Mounts & Backup Frequency Policy

Host Bind Path	Container Path	Stored Assets	Backup Strategy
./tinker-local-ai-data/open-webui/webui.db	/app/backend/data/webui.db	Users, chat history, system prompts, knowledge metadata	Stop container & tar before every version upgrade
./tinker-local-ai-data/open-webui/vector_db	/app/backend/data/vector_db	ChromaDB local vector embeddings & uploads	Included in open-webui data snapshot
./tinker-local-ai-data/ollama/models	/root/.ollama/models	GGUF model blobs & custom Modelfile manifests	Exclude blobs from daily tar; back up manifests only

Pre-Upgrade Backup & Full Disaster Recovery Drill

# [Step 1] Stop WebUI container cleanly to flush SQLite WAL journal
docker compose stop open-webui

# [Step 2] Create timestamped backup of chats, users, prompts & vector DB
tar -czf openwebui-state-$(date +%F-%H%M).tar.gz ./tinker-local-ai-data/open-webui

# [Step 3] Upgrade image tag in docker-compose.yml and start
docker compose up -d

# [Step 4] Emergency Rollback if the new version fails:
docker compose stop open-webui
rm -rf ./tinker-local-ai-data/open-webui
tar -xzf openwebui-state-2026-10-23-0900.tar.gz
# Revert image tag in docker-compose.yml, then:
docker compose up -d

2. Auditing Outbound Connections for True Offline Operation

Even on a local server, Open WebUI can inadvertently send traffic outside your LAN if: (1) OpenAI API connections are left enabled in Admin Settings -> Connections, or (2) the default `sentence-transformers/all-MiniLM-L6-v2` embedding engine tries to fetch weights from `huggingface.co`. Disable unused cloud API providers in the admin panel and pre-pull your embedding model via Ollama before disconnecting from the internet.

3. Online SQLite `.backup` API vs Cold Tar Snapshot Integrity

Open WebUI stores chats and user settings in SQLite (`/app/backend/data/webui.db`), which often creates temporary `-wal` and `-shm` write-ahead log files during active sessions. Copying `webui.db` with `cp` or `tar` while a user is mid-generation can capture a half-committed WAL frame (`database disk image is malformed`). Either run `docker compose stop open-webui` for 5 seconds before running `tar`, or invoke `sqlite3 webui.db ".backup webui-safe.db"` for an atomic online snapshot.

FIELD Q&A // 常见实测疑问与边界解答

Frequently Asked Questions & Edge Cases

Q: Why does Open WebUI hang for 60 seconds on startup when I unplug my ethernet cable?

By default, Open WebUI probes `https://api.openai.com/v1/models` on startup to populate its model dropdown. Set `ENABLE_OPENAI_API=false` and `OFFLINE_MODE=true` in your container environment variables to eliminate the timeout.

Q: What happens if I lose or change `WEBUI_SECRET_KEY` during container recreation?

`WEBUI_SECRET_KEY` signs all active JWT login sessions and encrypted credentials. If it changes on container restart, all logged-in users are immediately signed out with `401 Unauthorized`. Pin a static secret string in your `docker-compose.yml`.

REPRODUCIBLE ARTIFACT // 配套可参数化附件

Ollama + Open WebUI Persistent Stack with Backup & Rollback Safety

Pinned versions, explicit bind-mounted volumes for 30-second backup/restore, telemetry disabled, and KV cache optimization.

docker-compose.ollama-webui.yml ↗

Open WebUI Host PortOllama Image VersionOpen WebUI VersionHost Backup Mount PathKV Cache Quantization

Edit variables above to update the configuration live

# Tinker AI Verified Stack — Ollama + Open WebUI (Guide #3)
# Pre-upgrade backup: tar -czf backup-$(date +%F).tar.gz ./tinker-local-ai-data

services:
  ollama:
    image: ollama/ollama:0.5.7
    container_name: tinker-ollama
    restart: unless-stopped
    ports:
      - "127.0.0.1:11434:11434"
    environment:
      - OLLAMA_HOST=0.0.0.0:11434
      - OLLAMA_FLASH_ATTENTION=1
      - OLLAMA_KV_CACHE_TYPE=q8_0
      - OLLAMA_NUM_PARALLEL=2
      - OLLAMA_KEEP_ALIVE=15m
    volumes:
      - ./tinker-local-ai-data/ollama:/root/.ollama

  open-webui:
    image: ghcr.io/open-webui/open-webui:v0.5.10
    container_name: tinker-open-webui
    restart: unless-stopped
    depends_on:
      - ollama
    ports:
      - "127.0.0.1:3000:8080"
    environment:
      - OLLAMA_BASE_URL=http://ollama:11434
      - RAG_EMBEDDING_ENGINE=ollama
      - RAG_EMBEDDING_MODEL=bge-m3:latest
      - ENABLE_RAG_HYBRID_SEARCH=true
      - RAG_TOP_K=5
      - SCARF_NO_ANALYTICS=true
      - DO_NOT_TRACK=true
    extra_hosts:
      - "host.docker.internal:host-gateway"
    volumes:
      - ./tinker-local-ai-data/open-webui:/app/backend/data

More Reproducible Engineering Guides

View All 42 Guides →

Local AI / HomeLab

Apple Silicon Mac Local Model Benchmark: Fixed Tasks, Quantization, Context & Speed

Verified 2026-10-23 →

Local AI / HomeLab

NVIDIA PC Model Loading & VRAM Diagnostics: Spotting PCIe Shared-Memory Spillover

Verified 2026-10-23 →

Local AI / HomeLab

Local Document Q&A (RAG): Downloadable Sample Corpus, Citation Check & Failure Cases

Verified 2026-10-23 →