A doorin front of the GPU

Open WebUI with the model server bundled behind it.Accounts, groups, per-model permissions, and an audit log of who asked.

Open WebUI 0.11.38 cores · 16 GBNVIDIA GPUServed on 8080

hub://open-ui

$ dxflow workflow create --identity open-ui hub://open-ui --start --link

01Pick a machinecores, memory and a rate per hour

02Create the workflowpulled from the hub, once

03Run it, then stopstopped when the work is done

The application

Who is asking,and what they may call

The model server is bundled. What this step puts in front of it is everything Ollama has none of.

Accounts and groups

Roles, an approval queue, and permissions carried by the group, not the person.

A key per person

An OpenAI- and Anthropic-shaped API, on the same permissions as their browser.

An audit log

Who called which model, kept on the volume beside the chats.

How you run it

The definition wins,not the settings page

Persistent config is off, so what you pass on the start line is what the deployment is.

OLLAMA_BASE_URLSEmpty, so the bundled server comes up on this machine's card. Name servers here, semicolon separated, and it stands down — the step becomes the gate in front of them.

ADMIN_EMAIL and ADMIN_PASSWORDRegistered on the first start against an empty volume. Set the password then, or change it later from the account page.

ENABLE_SIGNUP and DEFAULT_USER_ROLESignup is off and new accounts arrive pending. Leave both alone unless you mean to open the door.

OLLAMA_NUM_PARALLELRequests one model answers at once. Four suits a 24 GB card holding 7B models, and wants lowering for larger ones.

OLLAMA_MAX_LOADED_MODELSHow many stay resident together. Two by default, and each one costs the VRAM it costs.

OLLAMA_KEEP_ALIVEHow long an idle model holds its VRAM. Five minutes, or -1 to pin the one everybody uses.

as the deployment, or as the gate

$ dxflow workflow start open-ui --override env.app.ADMIN_PASSWORD=something-long --link

$ dxflow workflow start open-ui --override env.app.OLLAMA_BASE_URLS=http://gpu-01:11434 --override resource.app.gpu=

The session

One port in,and nothing else

The model server is behind it, on the loopback, where no request reaches it unasked.

8080Webthe sign-in page and the API

11434Modelsbundled, and bound to localhost

/volumeStorageaccounts, chats, the log and the models

11434 is not publishedIt listens on the loopback inside the container, so every request arrives on 8080 and is asked who it is.

Open it from anywhereStart with --link and the session comes back on an HTTPS address.

Set a password firstADMIN_PASSWORD defaults to dxflow, and everyone can read this page.

Good to know

The deployment,or the gate in front of others

One variable decides which it is, and the rest follows from that.

One or the other, never both

Left empty, OLLAMA_BASE_URLS starts the bundled server on this machine's card. Filled in, it does not start at all — and those runs can give the card back.

The store starts empty

Nothing is baked into the image and nothing is pulled at start, because a model is a decision about a particular card. Pull one after signing in and it stays on the volume.

Sharing one card

Every parallel slot and every resident model costs VRAM. Four and two suit a 24 GB card holding 7B models; bigger models want both turned down.

The card serves generation

Ollama offloads what fits. The interface's own embedding model, for search over uploaded files, is a CPU build and stays there — small enough that it rarely shows.

A key is worth its account

Issue keys from the accounts that will use them. An administrator's key reaches everything and proves nothing about access control.

Access, not spend

It decides whether a user may call a model, never how much. The audit log names who is generating the load; a budget means a metering proxy behind it.

The image

Pulled once,then it stays

Open UI arrives as one image. This is what comes down the first time, and what the disk should have free for it.

3.3Gamd64compressed, the way the registry counts it

3.2Garm64compressed, the way the registry counts it

100GOn diskunpacked, with room to work beside it

ghcr.io/dxflow-ai/open-ui:latestPublished from the hub, pulled on the first start and kept for the ones after it.

Either architectureamd64 and arm64 are both published, and the machine pulls the one it runs.

What it asks for

What it wants,and what it needs

The definition asks for 8 cores and 16 GB. The image comes up on less than that, and a start given --fit trims the ask to whatever the machine actually has.

8 cores · 16 GBAsks forwhat the definition writes down

4 cores · 8 GBRuns onthe least the image comes up on

NVIDIAGPUrequired, and filtered for

The ask is not the floorThe definition writes down what suits the work. The image itself starts on less, which is what the second figure is.

--fit caps it to the hostA start given --fit trims each step to what the machine actually has, for that start alone. The definition is never rewritten.

Machines that fit it

Open UI asks for 8 cores and 16 GB, with an NVIDIA GPU. Cheapest first.

G4dn 2XLarge

$0.940/ hour8 cores · 32 GB · Tesla T4Start this machine

G6 2XLarge

$1.22/ hour8 cores · 32 GB · NVIDIA L4Start this machine

G4dn 4XLarge

$1.50/ hour16 cores · 64 GB · Tesla T4Start this machine

Run Open UI on your own machinePick a machine that meets it, and it opens about a minute after you ask.

Start Open UI Browse workflows