Skip to content
Ollama with Open WebUI product logo
  • AWS· soonComing soon on Amazon Web Services
  • Azure· soonComing soon on Microsoft Azure
  • GCP· nextGoogle Cloud is next on the roadmap
Coming soon

Ollama with Open WebUI

A private AI chat server: Ollama 0.35.1 runs the models and Open WebUI v0.11.4 is the chat interface, with the Apache-2.0 qwen2.5:1.5b model already installed so it answers on first boot. Models and conversations stay on your own server, no API key for any hosted model provider is needed, and two helper scripts pull new models and back up accounts, chats and documents.

Version
v0.35.1
Operating system
Ubuntu 24.04 LTS
Architecture
x86_64
Support
Community

What's installed

Every package and version on the image, identical on every cloud it ships on. Nothing else is installed.

  • Ollama 0.35.1
  • Open WebUI v0.11.4
  • qwen2.5:1.5b model (Apache-2.0)
  • Docker 29.8.2 with Compose 5.6.0
  • Apache 2.4.58
  • Webmin 2.670

LicensingOpen source (Ollama MIT, Open WebUI BSD-3-Clause based, bundled model Apache-2.0), no licence key required

Deploy anywhere

Ollama with Open WebUI on AWS and Azure.

Google Cloud is next on the roadmap. One clean-room build, one first-boot credential model, one patch cadence — identical on every cloud you run. Every identifier below is the real one; copy it and launch.

  1. AWS
    Coming soon

    Amazon Web Services

    AMI · v0.35.1

    AWS AMI ID
    ami-0461f6a0521393457
    Released
    Root volume
    gp3 · 40 GiB
    Instance types
    • t3a.xlarge
    • t3.xlarge
    • m6a.xlarge
    • m6a.2xlarge
    Regions
    • us-east-1
    AWS launch steps
  2. Azure
    Coming soon

    Microsoft Azure

    Compute Gallery image · v0.35.1

    Azure Compute Gallery image ID
    …/galleries/provencloud/images/ollama/versions/2026.10.1
    Released
    OS disk
    Premium_LRS · 64 GiB
    Gallery
    provencloud
    Definition
    ollama
    Resource group
    provencloud-images-rg
    VM sizes
    • Standard_D4as_v7
    • Standard_D4as_v5
    • Standard_D8as_v7
    • Standard_B4ms
    Regions
    • eastus
    Azure launch steps
AWS

Getting started on Amazon Web Services

From launch to signed in, step by step.

  1. Launch in us-east-1 on a t3a.xlarge or larger with TCP 22, 80 and 8000 open; never open 11434. Wait two to three minutes.

  2. Open http://<instance-public-ip>/ and create your account straight away: the first account becomes the administrator, and public sign-up then closes.

  3. Start chatting with the bundled qwen2.5:1.5b. Add models over SSH with sudo bash /home/ubuntu/iscripts/ai-model.sh pull llama3.2:3b; they appear without a restart.

  4. Back up accounts, chats and documents with sudo bash /home/ubuntu/iscripts/ai-backup.sh (the page is briefly unavailable while it copies).

  5. Webmin: port 8000, username admin, your EC2 Instance ID as the password. SSH as ubuntu with your key pair.

Security posture

What this AWS image does and does not ship with, one fact per line.

  • Clean-room build on Canonical's official Ubuntu 24.04 LTS image: Docker, Ollama and Open WebUI come from their official sources at pinned versions, and nothing is copied from any third-party image.

  • No Open WebUI account ships: the first visitor creates the administrator, and public sign-up then closes by itself; if it is reopened, newcomers wait as pending until approved.

  • The Ollama API has no authentication, so it and Open WebUI's own port listen on localhost only and the web server on port 80 is the single way in - verified unreachable from the internet with every port open.

  • Each server replaces the image's placeholder session-signing key with its own on first boot, so a session from one deployment is worthless on another.

  • The bundled model's Apache-2.0 licence was read from the model itself before capture; models you pull later carry their own licences.

  • The backup script refuses to report success unless the accounts database is really inside the archive.

  • The Webmin password is set from EC2 instance metadata (IMDSv2) at first boot; SSH is key-only.

  • The web interface is HTTP-only so it works at a bare IP: put it behind TLS before exposing it publicly.

Azure

Getting started on Microsoft Azure

From launch to signed in, step by step.

  1. Deploy the gallery image in eastus on Standard_D4as_v7 or larger with TCP 22, 80 and 8000 open in your network security group; never open 11434. Choose ubuntu as the administrator username. Wait about two minutes.

  2. Open http://<vm-public-ip>/ and create your account straight away: the first account becomes the administrator, and public sign-up then closes.

  3. Chat with the bundled qwen2.5:1.5b, or add models with sudo bash ~/iscripts/ai-model.sh pull llama3.2:3b. Back up with sudo bash ~/iscripts/ai-backup.sh.

  4. Webmin: port 8000, username admin. SSH as ubuntu with your key.

  5. The password is your VM ID: in the Azure portal open the virtual machine, choose Properties and copy VM ID - a 36-character value such as 02aab8a4-74ef-476e-8182-f6d2ba4166a6, typed exactly as shown in lower case.

Security posture

What this Azure image does and does not ship with, one fact per line.

  • Clean-room build on Canonical's official Ubuntu 24.04 LTS image from the Azure Marketplace.

  • No Open WebUI account ships: the first visitor creates the administrator, and public sign-up then closes by itself; if it is reopened, newcomers wait as pending until approved.

  • The Ollama API has no authentication, so it and Open WebUI's own port listen on localhost only and the web server on port 80 is the single way in - verified unreachable from the internet with every port open.

  • Each server replaces the image's placeholder session-signing key with its own on first boot, so a session from one deployment is worthless on another.

  • The bundled model's Apache-2.0 licence was read from the model itself before capture; models you pull later carry their own licences.

  • The backup script refuses to report success unless the accounts database is really inside the archive.

  • The Webmin password is set from the VM's own vmId read from Azure IMDS; the ubuntu account ships password-locked with an empty authorized_keys.

  • Microsoft's documented Linux certification checks: 13 passed, 0 failures, with VM extension provisioning confirmed.

  • The web interface is HTTP-only: put it behind TLS before exposing it publicly.