mirror of
https://github.com/open-webui/open-webui.git
synced 2026-08-22 05:24:48 -06:00
Classic298
3fc491d22f
The Python test suite was deleted in 4527c747b but its dependencies stayed behind, so pytest, pytest-docker and the docker SDK still install into every image variant, and moto joins them for anyone running pip install open-webui[all]. No Python test file remains in the repository, nothing imports these packages, and no CI job runs pytest. They are removed from backend/requirements.txt and from the all extra, which are the only two channels they ship through.
netcat-openbsd goes for the same reason. It was added in January 2024 without a consumer and nc has never been invoked anywhere in the repository, in any script, workflow or compose file. Both the readiness wait and the healthcheck use curl, and the Ollama install script does not ask for it either.
uv.lock is regenerated output, not hand-edited. It drops three of the four packages plus three transitives that nothing else needs, with no version changes and no additions. pytest stays locked because pytest-asyncio in the dev group still requires it. The dependency markers it adds on the CUDA and numpy entries are inert: each one is a superset of the condition its parent already installs under, and the resolved default install set is identical before and after.
This saves roughly 2 MB uncompressed, which is nothing next to the image as a whole. The point is that a production image stops shipping a test framework and a Docker socket client it never uses.
Everything else stays and is load-bearing. The container installs pip packages at runtime for user-authored tools and functions, so it needs git and a working compiler for anything that is not a prebuilt wheel, and libmariadb-dev for the manual MariaDB install. zstd is required for updating Ollama inside the bundled image. black looks dev-only but backs the code formatting endpoint.
Ref: https://github.com/open-webui/open-webui/discussions/28716
226 lines
9.1 KiB
Docker
226 lines
9.1 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# Initialize device type args
|
|
# use build args in the docker build command with --build-arg="BUILDARG=true"
|
|
ARG USE_CUDA=false
|
|
ARG USE_OLLAMA=false
|
|
ARG USE_SLIM=false
|
|
ARG USE_PERMISSION_HARDENING=false
|
|
# Tested with cu117 for CUDA 11 and cu121 for CUDA 12 (default)
|
|
ARG USE_CUDA_VER=cu128
|
|
# any sentence transformer model; models to use can be found at https://huggingface.co/models?library=sentence-transformers
|
|
# Leaderboard: https://huggingface.co/spaces/mteb/leaderboard
|
|
# for better performance and multilangauge support use "intfloat/multilingual-e5-large" (~2.5GB) or "intfloat/multilingual-e5-base" (~1.5GB)
|
|
# IMPORTANT: If you change the embedding model (sentence-transformers/all-MiniLM-L6-v2) and vice versa, you aren't able to use RAG Chat with your previous documents loaded in the WebUI! You need to re-embed them.
|
|
ARG USE_EMBEDDING_MODEL=sentence-transformers/all-MiniLM-L6-v2
|
|
ARG USE_RERANKING_MODEL=""
|
|
ARG USE_AUXILIARY_EMBEDDING_MODEL=TaylorAI/bge-micro-v2
|
|
|
|
# Tiktoken encoding name; models to use can be found at https://huggingface.co/models?library=tiktoken
|
|
ARG USE_TIKTOKEN_ENCODING_NAME="cl100k_base"
|
|
|
|
ARG BUILD_HASH=dev-build
|
|
# Override at your own risk - non-root configurations are untested
|
|
ARG UID=0
|
|
ARG GID=0
|
|
|
|
######## WebUI frontend ########
|
|
FROM --platform=$BUILDPLATFORM node:22-alpine3.20 AS build
|
|
ARG BUILD_HASH
|
|
|
|
# Set Node.js options (heap limit Allocation failed - JavaScript heap out of memory)
|
|
# ENV NODE_OPTIONS="--max-old-space-size=4096"
|
|
|
|
WORKDIR /app
|
|
|
|
# to store git revision in build
|
|
RUN apk add --no-cache git
|
|
|
|
COPY package.json package-lock.json ./
|
|
RUN npm ci --force
|
|
|
|
COPY . .
|
|
ENV APP_BUILD_HASH=${BUILD_HASH}
|
|
RUN npm run build
|
|
|
|
######## WebUI backend ########
|
|
FROM python:3.11-slim-bookworm AS base
|
|
|
|
# Use args
|
|
ARG USE_CUDA
|
|
ARG USE_OLLAMA
|
|
ARG USE_CUDA_VER
|
|
ARG USE_SLIM
|
|
ARG USE_PERMISSION_HARDENING
|
|
ARG USE_EMBEDDING_MODEL
|
|
ARG USE_RERANKING_MODEL
|
|
ARG USE_AUXILIARY_EMBEDDING_MODEL
|
|
ARG UID
|
|
ARG GID
|
|
|
|
# Python settings
|
|
ENV PYTHONUNBUFFERED=1
|
|
|
|
## Basis ##
|
|
ENV ENV=prod \
|
|
PORT=8080 \
|
|
# pass build args to the build
|
|
USE_OLLAMA_DOCKER=${USE_OLLAMA} \
|
|
USE_CUDA_DOCKER=${USE_CUDA} \
|
|
USE_SLIM_DOCKER=${USE_SLIM} \
|
|
USE_CUDA_DOCKER_VER=${USE_CUDA_VER} \
|
|
USE_EMBEDDING_MODEL_DOCKER=${USE_EMBEDDING_MODEL} \
|
|
USE_RERANKING_MODEL_DOCKER=${USE_RERANKING_MODEL} \
|
|
USE_AUXILIARY_EMBEDDING_MODEL_DOCKER=${USE_AUXILIARY_EMBEDDING_MODEL}
|
|
|
|
## Basis URL Config ##
|
|
ENV OLLAMA_BASE_URL="/ollama" \
|
|
OPENAI_API_BASE_URL=""
|
|
|
|
## API Key and Security Config ##
|
|
ENV OPENAI_API_KEY="" \
|
|
WEBUI_SECRET_KEY="" \
|
|
SCARF_NO_ANALYTICS=true \
|
|
DO_NOT_TRACK=true \
|
|
ANONYMIZED_TELEMETRY=false
|
|
|
|
#### Other models #########################################################
|
|
## whisper TTS model settings ##
|
|
ENV WHISPER_MODEL="base" \
|
|
WHISPER_MODEL_DIR="/app/backend/data/cache/whisper/models"
|
|
|
|
## RAG Embedding model settings ##
|
|
ENV RAG_EMBEDDING_MODEL="$USE_EMBEDDING_MODEL_DOCKER" \
|
|
RAG_RERANKING_MODEL="$USE_RERANKING_MODEL_DOCKER" \
|
|
AUXILIARY_EMBEDDING_MODEL="$USE_AUXILIARY_EMBEDDING_MODEL_DOCKER" \
|
|
SENTENCE_TRANSFORMERS_HOME="/app/backend/data/cache/embedding/models"
|
|
|
|
## Tiktoken model settings ##
|
|
ENV TIKTOKEN_ENCODING_NAME="cl100k_base" \
|
|
TIKTOKEN_CACHE_DIR="/app/backend/data/cache/tiktoken"
|
|
|
|
## Hugging Face download cache ##
|
|
ENV HF_HOME="/app/backend/data/cache/embedding/models"
|
|
|
|
## Torch Extensions ##
|
|
# ENV TORCH_EXTENSIONS_DIR="/.cache/torch_extensions"
|
|
|
|
#### Other models ##########################################################
|
|
|
|
WORKDIR /app/backend
|
|
|
|
ENV HOME=/root
|
|
# Create user and group if not root
|
|
RUN if [ $UID -ne 0 ]; then \
|
|
if [ $GID -ne 0 ]; then \
|
|
addgroup --gid $GID app; \
|
|
fi; \
|
|
adduser --uid $UID --gid $GID --home $HOME --disabled-password --no-create-home app; \
|
|
fi
|
|
|
|
RUN mkdir -p $HOME/.cache/chroma
|
|
RUN echo -n 00000000-0000-0000-0000-000000000000 > $HOME/.cache/chroma/telemetry_user_id
|
|
|
|
# Make sure the user has access to the app and root directory
|
|
RUN chown -R $UID:$GID /app $HOME
|
|
|
|
# Install common system dependencies
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends \
|
|
git build-essential pandoc gcc curl jq ca-certificates \
|
|
libmariadb-dev \
|
|
python3-dev \
|
|
ffmpeg libsm6 libxext6 zstd \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# install python dependencies
|
|
COPY --chown=$UID:$GID ./backend/requirements.txt ./requirements.txt
|
|
|
|
# Set UV_LINK_MODE to copy to prevent 0-byte file corruption in QEMU arm64 cross-builds
|
|
ENV UV_LINK_MODE=copy
|
|
|
|
RUN set -e; \
|
|
pip3 install --no-cache-dir uv; \
|
|
if [ "$USE_CUDA" = "true" ]; then \
|
|
# If you use CUDA the whisper and embedding model will be downloaded on first use
|
|
# fix: pin torch<=2.9.1 - torch 2.10.0 aarch64 wheels cause SIGILL on ARM devices (RPi 4 Cortex-A72) #21349
|
|
pip3 install 'torch<=2.9.1' torchvision torchaudio --index-url https://download.pytorch.org/whl/$USE_CUDA_DOCKER_VER --no-cache-dir; \
|
|
uv pip install --system -r requirements.txt --no-cache-dir; \
|
|
python -c "import os; from sentence_transformers import SentenceTransformer; SentenceTransformer(os.environ['RAG_EMBEDDING_MODEL'], device='cpu')"; \
|
|
python -c "import os; from sentence_transformers import SentenceTransformer; SentenceTransformer(os.environ.get('AUXILIARY_EMBEDDING_MODEL', 'TaylorAI/bge-micro-v2'), device='cpu')"; \
|
|
python -c "import os; from faster_whisper import WhisperModel; WhisperModel(os.environ['WHISPER_MODEL'], device='cpu', compute_type='int8', download_root=os.environ['WHISPER_MODEL_DIR'])"; \
|
|
python -c "import os; import tiktoken; tiktoken.get_encoding(os.environ['TIKTOKEN_ENCODING_NAME'])"; \
|
|
python -c "import nltk; nltk.download('punkt_tab')"; \
|
|
else \
|
|
pip3 install 'torch<=2.9.1' torchvision torchaudio --index-url https://download.pytorch.org/whl/cpu --no-cache-dir; \
|
|
uv pip install --system -r requirements.txt --no-cache-dir; \
|
|
if [ "$USE_SLIM" != "true" ]; then \
|
|
python -c "import os; from sentence_transformers import SentenceTransformer; SentenceTransformer(os.environ['RAG_EMBEDDING_MODEL'], device='cpu')"; \
|
|
python -c "import os; from sentence_transformers import SentenceTransformer; SentenceTransformer(os.environ.get('AUXILIARY_EMBEDDING_MODEL', 'TaylorAI/bge-micro-v2'), device='cpu')"; \
|
|
python -c "import os; from faster_whisper import WhisperModel; WhisperModel(os.environ['WHISPER_MODEL'], device='cpu', compute_type='int8', download_root=os.environ['WHISPER_MODEL_DIR'])"; \
|
|
python -c "import os; import tiktoken; tiktoken.get_encoding(os.environ['TIKTOKEN_ENCODING_NAME'])"; \
|
|
python -c "import nltk; nltk.download('punkt_tab')"; \
|
|
fi; \
|
|
fi; \
|
|
mkdir -p /app/backend/data; chown -R $UID:$GID /app/backend/data/; \
|
|
if [ -d /app/backend/data/cache ]; then chmod -R a+rX /app/backend/data/cache; fi; \
|
|
rm -rf /var/lib/apt/lists/*;
|
|
|
|
# Optional: PPTX parsing through unstructured may need spaCy's English model.
|
|
# Keep this out of the default image to avoid the extra image bloat; deployments
|
|
# with read-only site-packages can uncomment it and bake the model in.
|
|
# RUN python -m spacy download en_core_web_sm
|
|
|
|
# Install Ollama if requested
|
|
RUN if [ "$USE_OLLAMA" = "true" ]; then \
|
|
date +%s > /tmp/ollama_build_hash && \
|
|
echo "Cache broken at timestamp: `cat /tmp/ollama_build_hash`" && \
|
|
curl -fsSL https://ollama.com/install.sh | sh && \
|
|
rm -rf /var/lib/apt/lists/*; \
|
|
fi
|
|
|
|
# copy embedding weight from build
|
|
# RUN mkdir -p /root/.cache/chroma/onnx_models/all-MiniLM-L6-v2
|
|
# COPY --from=build /app/onnx /root/.cache/chroma/onnx_models/all-MiniLM-L6-v2/onnx
|
|
|
|
# copy built frontend files
|
|
COPY --chown=$UID:$GID --from=build /app/build /app/build
|
|
COPY --chown=$UID:$GID --from=build /app/CHANGELOG.md /app/CHANGELOG.md
|
|
COPY --chown=$UID:$GID --from=build /app/package.json /app/package.json
|
|
|
|
# copy backend files
|
|
COPY --chown=$UID:$GID ./backend .
|
|
|
|
# The backend rewrites its bundled static assets (favicons, splash, manifest,
|
|
# loader.js, ...) under open_webui/static at startup. Make that directory
|
|
# writable by an arbitrary UID -- which under OpenShift's restricted SCC is
|
|
# always a member of GID 0 -- so those writes don't fail with EACCES and crash
|
|
# the boot log with "[Errno 13] Permission denied". `chmod -R g=u` mirrors the
|
|
# owner bits onto the group (the Red Hat arbitrary-UID idiom). This is applied
|
|
# unconditionally because it targets a directory the app writes on every start;
|
|
# the broader, opt-in USE_PERMISSION_HARDENING below covers the rest of /app.
|
|
RUN chgrp -R 0 /app/backend/open_webui/static && \
|
|
chmod -R g=u /app/backend/open_webui/static
|
|
|
|
EXPOSE 8080
|
|
|
|
HEALTHCHECK CMD curl --silent --fail http://localhost:${PORT:-8080}/health | jq -ne 'input.status == true' || exit 1
|
|
|
|
# Minimal, atomic permission hardening for OpenShift (arbitrary UID):
|
|
# - Group 0 owns /app and /root
|
|
# - Directories are group-writable and have SGID so new files inherit GID 0
|
|
RUN if [ "$USE_PERMISSION_HARDENING" = "true" ]; then \
|
|
set -eux; \
|
|
chgrp -R 0 /app /root || true; \
|
|
chmod -R g+rwX /app /root || true; \
|
|
find /app -type d -exec chmod g+s {} + || true; \
|
|
find /root -type d -exec chmod g+s {} + || true; \
|
|
fi
|
|
|
|
USER $UID:$GID
|
|
|
|
ARG BUILD_HASH
|
|
ENV WEBUI_BUILD_VERSION=${BUILD_HASH}
|
|
ENV DOCKER=true
|
|
|
|
CMD [ "bash", "start.sh"]
|