mirrors/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-11-15 18:55:07 +03:00
Code Issues Packages Projects Releases Wiki Activity
20,711 Commits 2 Branches 181 Tags
dev
Commit Graph

154 Commits

  • feat: build the Docker image from locked, hash-verified dependencies (#33981) 
    The image used to install only the directly pinned packages and resolved everything below them fresh from PyPI on every build, so the same commit could produce different images. The standard and slim images now install from lock files that pin every package with hashes, except PyTorch and its few own dependencies, which still come from the PyTorch index so the CPU and CUDA variants keep working. A new CI check fails when a requirements file changes without regenerating its lock, and the script that regenerates them sits next to the requirements.

Fixes #33979
    Classic298 · 2026-11-09 21:42:59 +09:00
    1c58242b4f
  • fix: Ollama image ships without Ollama when its download fails during the build (#33944) 
    The amd64 :ollama images of Open WebUI 0.13.1 and 0.13.2 ship without the ollama command (the arm64 images are fine). During the 0.13.1 build, downloading the Ollama install script failed with a server error, but the build did not notice and kept going, and 0.13.2 then reused that broken result from the build cache. The build now stops when Ollama is not installed after the install script ran, so a failed download can no longer produce a broken image. With this change the next build also installs Ollama fresh instead of reusing the broken cached result.

Fixes #33942
    Classic298 · 2026-11-09 06:41:07 +09:00
    842cd1fa95
  • fix: Docker, frontend CI and pip builds fail when the ONNX runtime GPU download times out (#33917) 
    Installing the frontend dependencies makes the onnxruntime-node package download its GPU binaries from GitHub releases, and the whole install fails whenever that download times out. Neither the frontend build nor the Docker image uses those binaries (the image only ships the built frontend), so the Docker build, the frontend CI and building the Python package now skip that download with ONNXRUNTIME_NODE_INSTALL_CUDA=skip. The regular CPU binaries are part of the npm package and are not affected.
    Classic298 · 2026-11-08 20:00:07 +09:00
    d67c707027
  • chore: Python 3.12 and Debian 13 base image (#32861) 
    The Docker image now runs Python 3.12 on Debian 13 (trixie) instead of Python 3.11 on Debian 12, and the pip install docs recommend 3.12. Image size stays about the same: the slim image is 1 MB smaller and the standard image is about 50 MB larger, mostly from the newer ffmpeg and pandoc that Debian 13 ships. Admins should know that custom functions, tools and anything installed with pip inside the container now run on Python 3.12, so a package that only has builds for 3.11 needs a newer version. Installing with pip still works on both Python 3.11 and 3.12.
    Classic298 · 2026-10-22 04:51:57 +09:00
    a915df8ce1
  • refac
    Timothy Jaeryang Baek · 2026-10-05 09:24:43 +04:00
    51f0e01258
  • refac
    Timothy Jaeryang Baek · 2026-09-06 17:38:21 -04:00
    30eed12513
  • refac
    Timothy Jaeryang Baek · 2026-09-06 17:35:49 -04:00
    a1c02098aa
  • refac
    Timothy Jaeryang Baek · 2026-09-06 16:59:40 -04:00
    3361a972b3
  • chore: stop shipping uv in the Docker image (#29728) 
    The Docker image gets about 50 MB smaller on disk (about 20 MB off the pull). uv is only needed to run the requirements install, but it is pip-installed into the image and stays there. It is now bind-mounted from the uv image for that RUN only, pinned to 0.12.10, so the runtime image never contains it. This is the pattern uv's own Docker guide recommends for the case.

Uninstalling uv at the end of the same RUN would also keep it out of the layer; the mount was preferred because it fixes the uv version and the mounted layer is cached by the builder across rebuilds.

pip stays available in the container, so hand-installing optional packages the way requirements.txt describes keeps working; only running uv inside the container goes away. The build now requires BuildKit (the syntax directive alone was a comment to the classic builder, this line makes it mandatory), needs access to ghcr.io next to PyPI, and the uv version is a pin to bump by hand, like the base images.

Part of #29721.
    Classic298 · 2026-09-06 16:58:05 -04:00
    517617b601
  • refac
    Timothy Jaeryang Baek · 2026-09-06 16:55:28 -04:00
    91f8775b28
  • refac
    Timothy Jaeryang Baek · 2026-09-06 16:48:30 -04:00
    cb942bb94c
  • chore: drop nltk, unused at the pinned versions (#29725) 
    The main and CUDA Docker images get about 21 MB smaller (the nltk package, the punkt_tab data and its zip); slim images, which never downloaded the data, about 6 MB.

nltk was in the image for unstructured, which used it to tokenize documents. The Dockerfile download was added for airgapped containers failing on the missing punkt_tab data (#21150; the same request in #16260), the same lookup failed on first use in other setups (#17594, #4642), and the download in start.sh and start_windows.bat came with the Playwright web loader mode and sits in that branch.

unstructured 0.22.31, the pinned version, has no nltk references at all and tokenizes with spaCy, nothing else installed requires nltk outside transformers' testing and dev extras, and nothing in the backend imports it, so the pin and both downloads go together.

One user-visible consequence: a tool or function that imports nltk inside the container stops working unless it declares nltk in its frontmatter requirements. On an offline instance the package, and any nltk data such as punkt_tab, have to be installed into the image instead.

Part of #29721.
    Classic298 · 2026-09-06 16:39:05 -04:00
    ca9ec06c7e
  • chore: drop python3-dev from the Docker image (#29731) 
    The apt layer of the Docker image shrinks by about 60 MB. python3-dev installs Debian's own interpreter with its headers, and nothing in the image uses it.

The image's Python is the /usr/local build from the base image, which ships its own headers, and it is also the interpreter that installs tool and function requirements at runtime, so Debian's headers were never on the include path of anything built in the container. The zlib headers python3-dev pulled in stay through libmariadb-dev, which also brings the OpenSSL headers, so the optional mariadb connector still builds; the only other header package that goes with it is libexpat1-dev, which nothing in the pinned tree builds against.

Part of #29721.
    Classic298 · 2026-09-06 16:19:10 -04:00
    039c4d665e
  • fix: download nltk data somewhere a non-root UID can read (#28866) 
    nltk.download picks the first entry of nltk.data.path that already exists and is
writable. None do here, so punkt_tab lands in /root/nltk_data, and /root is mode
0700. The corpus is then unreachable whenever the container does not run as
root:

    nltk.data.find('tokenizers/punkt_tab')
    LookupError: Resource punkt_tab not found.

/usr/local/share/nltk_data is already on nltk.data.path, so nothing changes at
the read side.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
    Sebastian · 2026-08-24 17:19:15 -04:00
    4d5084025f
  • chore: drop test-only dependencies from the Docker image and the published package (#28726) 
    The Python test suite was deleted in 4527c747b but its dependencies stayed behind, so pytest, pytest-docker and the docker SDK still install into every image variant, and moto joins them for anyone running pip install open-webui[all]. No Python test file remains in the repository, nothing imports these packages, and no CI job runs pytest. They are removed from backend/requirements.txt and from the all extra, which are the only two channels they ship through.

netcat-openbsd goes for the same reason. It was added in January 2024 without a consumer and nc has never been invoked anywhere in the repository, in any script, workflow or compose file. Both the readiness wait and the healthcheck use curl, and the Ollama install script does not ask for it either.

uv.lock is regenerated output, not hand-edited. It drops three of the four packages plus three transitives that nothing else needs, with no version changes and no additions. pytest stays locked because pytest-asyncio in the dev group still requires it. The dependency markers it adds on the CUDA and numpy entries are inert: each one is a superset of the condition its parent already installs under, and the resolved default install set is identical before and after.

This saves roughly 2 MB uncompressed, which is nothing next to the image as a whole. The point is that a production image stops shipping a test framework and a Docker socket client it never uses.

Everything else stays and is load-bearing. The container installs pip packages at runtime for user-authored tools and functions, so it needs git and a working compiler for anything that is not a prebuilt wheel, and libmariadb-dev for the manual MariaDB install. zstd is required for updating Ollama inside the bundled image. black looks dev-only but backs the code formatting endpoint.

Ref: https://github.com/open-webui/open-webui/discussions/28716
    Classic298 · 2026-08-17 13:56:08 -07:00
    3fc491d22f
  • refac 
    Co-Authored-By: Solaris-star <67425364+solaris-star@users.noreply.github.com>
    Timothy Jaeryang Baek · 2026-08-17 00:01:38 -07:00
    0480ca9653
  • refac
    Timothy Jaeryang Baek · 2026-08-10 00:05:55 -06:00
    5b8975b7da
  • fix(docker): make open_webui/static writable by an arbitrary UID (OpenShift) (#26664) 
    The backend rewrites its bundled static assets under open_webui/static on
startup. Under OpenShift's restricted SCC the container runs as a random UID
(member of GID 0), which cannot write to the root-owned static dir, so boot
logs fill with '[Errno 13] Permission denied: .../static/*'.

Give GID 0 the owner's permissions on that directory (chgrp 0 + chmod g=u),
the standard Red Hat arbitrary-UID idiom. Applied unconditionally since the
app writes there on every start; complements the opt-in USE_PERMISSION_HARDENING.
    Sebastian · 2026-07-27 01:55:53 -04:00
    8f9e9398f8
  • refac
    Timothy Jaeryang Baek · 2026-06-19 15:28:52 +02:00
    8b9e28b503
  • refac
    Timothy Jaeryang Baek · 2026-05-11 01:02:45 +09:00
    e8e9141061
  • refac
    Timothy Jaeryang Baek · 2026-04-24 17:34:12 +09:00
    2419899ac6
  • avoid silent failure of pip/uv install in Dockerfile (#22598)
    Jan Kessler · 2026-03-11 15:40:54 -05:00
    1b1abdd30c
  • Add support for mariadb-vector as backing vector DB (#21931)
    Code with love · 2026-03-08 17:13:14 -05:00
    265d1b2824
  • fix: pin torch to prevent startup errors on ARM devices (#21385) 
    * fix: rpi

* Update requirements-min.txt

* Update requirements.txt

* Update pyproject.toml
    Classic298 · 2026-02-13 14:28:23 -06:00
    370a677a38
  • fix: bundle NLTK punkt_tab in Docker image for airgapped environments (#21165) 
    Pre-download NLTK punkt_tab during Docker build instead of at runtime.
This fixes document extraction failures in offline/airgapped environments
where the container cannot download the tokenizer data after restarts.
Fixes #21150
    Classic298 · 2026-02-05 15:11:00 -05:00
    9ed8f50d40
  • refac
    Timothy Jaeryang Baek · 2026-01-30 10:13:14 -05:00
    a6ed0ef9f4
  • refac
    Timothy Jaeryang Baek · 2026-01-09 20:25:51 +04:00
    74c4af6e11
  • infra: dockerfile base image
    Timothy Jaeryang Baek · 2025-12-23 10:15:05 +04:00
    758325a203
  • refac: dockerfile PYTHONUNBUFFERED
    Timothy Jaeryang Baek · 2025-12-11 14:05:34 -05:00
    4c4b9d19a1
  • refac: conditional USE_PERMISSION_HARDENING
    Timothy Jaeryang Baek · 2025-08-28 20:19:47 +04:00
    0ebe4f8f84
  • refac: dockerfile
    Timothy Jaeryang Baek · 2025-08-28 19:42:28 +04:00
    be373e9fd4
  • Ensure data directory exists before chown
    Everett Wilber · 2025-08-27 18:46:31 -04:00
    a60b0a108a
  • Fix syntax error in Dockerfile pip install command
    Everett Wilber · 2025-08-27 18:40:17 -04:00
    f4dde86b36
  • Fix Dockerfile syntax for conditional installation
    Everett Wilber · 2025-08-27 18:37:49 -04:00
    fcc1e2729c
  • Fix syntax error in conditional for Ollama installation
    Everett Wilber · 2025-08-27 18:35:00 -04:00
    b2d1aa3c6e
  • Add USE_SLIM argument to Dockerfile
    Everett Wilber · 2025-08-27 18:20:23 -04:00
    d2fdf6999b
  • Merge pull request #16622 from SebLz/fix/arbitrary-uid 
    Fix/arbitrary uid
    Tim Jaeryang Baek · 2025-08-15 14:55:40 +04:00
    dfc9412117
  • feat: add Docker publish workflow for multi-architecture builds 
    fix: Dockerfile: make image arbitrary-UID friendly for OpenShift (group 0 + g+rwX, SGID, no fixed USER)
    LIESLEN · 2025-08-14 13:54:31 +02:00
    4525ac687b
  • refac/fix: dockerfile ollama cache issue
    Timothy Jaeryang Baek · 2025-08-14 02:55:38 +04:00
    115231c0e5
  • chore
    Timothy Jaeryang Baek · 2025-07-17 17:53:36 +04:00
    86e46ebe6a
  • better handling of frontend updates, following svelte docs
    Jan Kessler · 2025-05-13 09:51:51 +02:00
    dfd4037132
  • Update Dockerfile
    Mister-Hope · 2025-04-24 13:59:57 +08:00
    5f69424215
  • revert
    Timothy Jaeryang Baek · 2025-04-06 19:12:08 -07:00
    2be08f27ea
  • Bump Python base Docker image to 3.12
    Juan Calderon-Perez · 2025-04-06 18:10:38 -04:00
    89e7913ff2
  • build: add one missing --no-cache-dir for pip3 install in Dockerfile
    Peter Dave Hello · 2025-03-24 20:45:16 +08:00
    aaf47486da
  • refac
    Timothy J. Baek · 2024-10-25 22:33:26 -07:00
    1cd036e768
  • refac
    Timothy J. Baek · 2024-10-25 21:46:14 -07:00
    780591e991
  • fix: tiktoken encoding model issue
    Timothy J. Baek · 2024-10-25 21:38:28 -07:00
    50dcad0f73
  • fix: Fix typos
    Yuta Hayashibe · 2024-10-14 16:22:07 +09:00
    12516c8a45
  • enh: tiktoken/token splitter support
    Timothy J. Baek · 2024-10-13 02:07:50 -07:00
    dff3732fcd