mirror of
https://github.com/open-webui/open-webui.git
synced 2026-09-15 23:32:40 +00:00
ca9ec06c7e
The main and CUDA Docker images get about 21 MB smaller (the nltk package, the punkt_tab data and its zip); slim images, which never downloaded the data, about 6 MB. nltk was in the image for unstructured, which used it to tokenize documents. The Dockerfile download was added for airgapped containers failing on the missing punkt_tab data (#21150; the same request in #16260), the same lookup failed on first use in other setups (#17594, #4642), and the download in start.sh and start_windows.bat came with the Playwright web loader mode and sits in that branch. unstructured 0.22.31, the pinned version, has no nltk references at all and tokenizes with spaCy, nothing else installed requires nltk outside transformers' testing and dev extras, and nothing in the backend imports it, so the pin and both downloads go together. One user-visible consequence: a tool or function that imports nltk inside the container stops working unless it declares nltk in its frontmatter requirements. On an offline instance the package, and any nltk data such as punkt_tab, have to be installed into the image instead. Part of #29721.
222 lines
9 KiB
Docker
222 lines
9 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# Initialize device type args
|
|
# use build args in the docker build command with --build-arg="BUILDARG=true"
|
|
ARG USE_CUDA=false
|
|
ARG USE_OLLAMA=false
|
|
ARG USE_SLIM=false
|
|
ARG USE_PERMISSION_HARDENING=false
|
|
# Tested with cu117 for CUDA 11 and cu121 for CUDA 12 (default)
|
|
ARG USE_CUDA_VER=cu128
|
|
# any sentence transformer model; models to use can be found at https://huggingface.co/models?library=sentence-transformers
|
|
# Leaderboard: https://huggingface.co/spaces/mteb/leaderboard
|
|
# for better performance and multilangauge support use "intfloat/multilingual-e5-large" (~2.5GB) or "intfloat/multilingual-e5-base" (~1.5GB)
|
|
# IMPORTANT: If you change the embedding model (sentence-transformers/all-MiniLM-L6-v2) and vice versa, you aren't able to use RAG Chat with your previous documents loaded in the WebUI! You need to re-embed them.
|
|
ARG USE_EMBEDDING_MODEL=sentence-transformers/all-MiniLM-L6-v2
|
|
ARG USE_RERANKING_MODEL=""
|
|
ARG USE_AUXILIARY_EMBEDDING_MODEL=TaylorAI/bge-micro-v2
|
|
|
|
# Tiktoken encoding name; models to use can be found at https://huggingface.co/models?library=tiktoken
|
|
ARG USE_TIKTOKEN_ENCODING_NAME="cl100k_base"
|
|
|
|
ARG BUILD_HASH=dev-build
|
|
# Override at your own risk - non-root configurations are untested
|
|
ARG UID=0
|
|
ARG GID=0
|
|
|
|
######## WebUI frontend ########
|
|
FROM --platform=$BUILDPLATFORM node:22-alpine3.20 AS build
|
|
ARG BUILD_HASH
|
|
|
|
# Set Node.js options (heap limit Allocation failed - JavaScript heap out of memory)
|
|
# ENV NODE_OPTIONS="--max-old-space-size=4096"
|
|
|
|
WORKDIR /app
|
|
|
|
# to store git revision in build
|
|
RUN apk add --no-cache git
|
|
|
|
COPY package.json package-lock.json ./
|
|
RUN npm ci --force
|
|
|
|
COPY . .
|
|
ENV APP_BUILD_HASH=${BUILD_HASH}
|
|
RUN npm run build
|
|
|
|
######## WebUI backend ########
|
|
FROM python:3.11-slim-bookworm AS base
|
|
|
|
# Use args
|
|
ARG USE_CUDA
|
|
ARG USE_OLLAMA
|
|
ARG USE_CUDA_VER
|
|
ARG USE_SLIM
|
|
ARG USE_PERMISSION_HARDENING
|
|
ARG USE_EMBEDDING_MODEL
|
|
ARG USE_RERANKING_MODEL
|
|
ARG USE_AUXILIARY_EMBEDDING_MODEL
|
|
ARG UID
|
|
ARG GID
|
|
|
|
# Python settings
|
|
ENV PYTHONUNBUFFERED=1
|
|
|
|
## Basis ##
|
|
ENV ENV=prod \
|
|
PORT=8080 \
|
|
# pass build args to the build
|
|
USE_OLLAMA_DOCKER=${USE_OLLAMA} \
|
|
USE_CUDA_DOCKER=${USE_CUDA} \
|
|
USE_SLIM_DOCKER=${USE_SLIM} \
|
|
USE_CUDA_DOCKER_VER=${USE_CUDA_VER} \
|
|
USE_EMBEDDING_MODEL_DOCKER=${USE_EMBEDDING_MODEL} \
|
|
USE_RERANKING_MODEL_DOCKER=${USE_RERANKING_MODEL} \
|
|
USE_AUXILIARY_EMBEDDING_MODEL_DOCKER=${USE_AUXILIARY_EMBEDDING_MODEL}
|
|
|
|
## Basis URL Config ##
|
|
ENV OLLAMA_BASE_URL="/ollama" \
|
|
OPENAI_API_BASE_URL=""
|
|
|
|
## API Key and Security Config ##
|
|
ENV OPENAI_API_KEY="" \
|
|
WEBUI_SECRET_KEY="" \
|
|
SCARF_NO_ANALYTICS=true \
|
|
DO_NOT_TRACK=true \
|
|
ANONYMIZED_TELEMETRY=false
|
|
|
|
#### Other models #########################################################
|
|
## whisper TTS model settings ##
|
|
ENV WHISPER_MODEL="base" \
|
|
WHISPER_MODEL_DIR="/app/backend/data/cache/whisper/models"
|
|
|
|
## RAG Embedding model settings ##
|
|
ENV RAG_EMBEDDING_MODEL="$USE_EMBEDDING_MODEL_DOCKER" \
|
|
RAG_RERANKING_MODEL="$USE_RERANKING_MODEL_DOCKER" \
|
|
AUXILIARY_EMBEDDING_MODEL="$USE_AUXILIARY_EMBEDDING_MODEL_DOCKER" \
|
|
SENTENCE_TRANSFORMERS_HOME="/app/backend/data/cache/embedding/models"
|
|
|
|
## Tiktoken model settings ##
|
|
ENV TIKTOKEN_ENCODING_NAME="cl100k_base" \
|
|
TIKTOKEN_CACHE_DIR="/app/backend/data/cache/tiktoken"
|
|
|
|
## Hugging Face download cache ##
|
|
ENV HF_HOME="/app/backend/data/cache/embedding/models"
|
|
|
|
## Torch Extensions ##
|
|
# ENV TORCH_EXTENSIONS_DIR="/.cache/torch_extensions"
|
|
|
|
#### Other models ##########################################################
|
|
|
|
WORKDIR /app/backend
|
|
|
|
ENV HOME=/root
|
|
# Create user and group if not root
|
|
RUN if [ $UID -ne 0 ]; then \
|
|
if [ $GID -ne 0 ]; then \
|
|
addgroup --gid $GID app; \
|
|
fi; \
|
|
adduser --uid $UID --gid $GID --home $HOME --disabled-password --no-create-home app; \
|
|
fi
|
|
|
|
RUN mkdir -p $HOME/.cache/chroma
|
|
RUN echo -n 00000000-0000-0000-0000-000000000000 > $HOME/.cache/chroma/telemetry_user_id
|
|
|
|
# Make sure the user has access to the app and root directory
|
|
RUN chown -R $UID:$GID /app $HOME
|
|
|
|
# Install common system dependencies
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends \
|
|
git build-essential pandoc gcc curl jq ca-certificates \
|
|
libmariadb-dev \
|
|
ffmpeg libsm6 libxext6 zstd \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# install python dependencies
|
|
COPY --chown=$UID:$GID ./backend/requirements.txt ./requirements.txt
|
|
|
|
# Set UV_LINK_MODE to copy to prevent 0-byte file corruption in QEMU arm64 cross-builds
|
|
ENV UV_LINK_MODE=copy
|
|
|
|
RUN set -e; \
|
|
pip3 install --no-cache-dir uv; \
|
|
if [ "$USE_CUDA" = "true" ]; then \
|
|
# If you use CUDA the whisper and embedding model will be downloaded on first use
|
|
# fix: pin torch<=2.9.1 - torch 2.10.0 aarch64 wheels cause SIGILL on ARM devices (RPi 4 Cortex-A72) #21349
|
|
pip3 install 'torch<=2.9.1' torchvision torchaudio --index-url https://download.pytorch.org/whl/$USE_CUDA_DOCKER_VER --no-cache-dir; \
|
|
uv pip install --system -r requirements.txt --no-cache-dir; \
|
|
python -c "import os; from sentence_transformers import SentenceTransformer; SentenceTransformer(os.environ['RAG_EMBEDDING_MODEL'], device='cpu')"; \
|
|
python -c "import os; from sentence_transformers import SentenceTransformer; SentenceTransformer(os.environ.get('AUXILIARY_EMBEDDING_MODEL', 'TaylorAI/bge-micro-v2'), device='cpu')"; \
|
|
python -c "import os; from faster_whisper import WhisperModel; WhisperModel(os.environ['WHISPER_MODEL'], device='cpu', compute_type='int8', download_root=os.environ['WHISPER_MODEL_DIR'])"; \
|
|
python -c "import os; import tiktoken; tiktoken.get_encoding(os.environ['TIKTOKEN_ENCODING_NAME'])"; \
|
|
else \
|
|
pip3 install 'torch<=2.9.1' torchvision torchaudio --index-url https://download.pytorch.org/whl/cpu --no-cache-dir; \
|
|
uv pip install --system -r requirements.txt --no-cache-dir; \
|
|
if [ "$USE_SLIM" != "true" ]; then \
|
|
python -c "import os; from sentence_transformers import SentenceTransformer; SentenceTransformer(os.environ['RAG_EMBEDDING_MODEL'], device='cpu')"; \
|
|
python -c "import os; from sentence_transformers import SentenceTransformer; SentenceTransformer(os.environ.get('AUXILIARY_EMBEDDING_MODEL', 'TaylorAI/bge-micro-v2'), device='cpu')"; \
|
|
python -c "import os; from faster_whisper import WhisperModel; WhisperModel(os.environ['WHISPER_MODEL'], device='cpu', compute_type='int8', download_root=os.environ['WHISPER_MODEL_DIR'])"; \
|
|
python -c "import os; import tiktoken; tiktoken.get_encoding(os.environ['TIKTOKEN_ENCODING_NAME'])"; \
|
|
fi; \
|
|
fi; \
|
|
mkdir -p /app/backend/data; chown -R $UID:$GID /app/backend/data/; \
|
|
if [ -d /app/backend/data/cache ]; then chmod -R a+rX /app/backend/data/cache; fi; \
|
|
rm -rf /var/lib/apt/lists/*;
|
|
|
|
# Optional: PPTX parsing through unstructured may need spaCy's English model.
|
|
# Keep this out of the default image to avoid the extra image bloat; deployments
|
|
# with read-only site-packages can uncomment it and bake the model in.
|
|
# RUN python -m spacy download en_core_web_sm
|
|
|
|
# Install Ollama if requested
|
|
RUN if [ "$USE_OLLAMA" = "true" ]; then \
|
|
date +%s > /tmp/ollama_build_hash && \
|
|
echo "Cache broken at timestamp: `cat /tmp/ollama_build_hash`" && \
|
|
curl -fsSL https://ollama.com/install.sh | sh && \
|
|
rm -rf /var/lib/apt/lists/*; \
|
|
fi
|
|
|
|
# copy embedding weight from build
|
|
# RUN mkdir -p /root/.cache/chroma/onnx_models/all-MiniLM-L6-v2
|
|
# COPY --from=build /app/onnx /root/.cache/chroma/onnx_models/all-MiniLM-L6-v2/onnx
|
|
|
|
# copy built frontend files
|
|
COPY --chown=$UID:$GID --from=build /app/build /app/build
|
|
COPY --chown=$UID:$GID --from=build /app/CHANGELOG.md /app/CHANGELOG.md
|
|
COPY --chown=$UID:$GID --from=build /app/package.json /app/package.json
|
|
|
|
# copy backend files
|
|
COPY --chown=$UID:$GID ./backend .
|
|
|
|
# The backend rewrites its bundled static assets (favicons, splash, manifest,
|
|
# loader.js, ...) under open_webui/static at startup. Make that directory
|
|
# writable by an arbitrary UID -- which under OpenShift's restricted SCC is
|
|
# always a member of GID 0 -- so those writes don't fail with EACCES and crash
|
|
# the boot log with "[Errno 13] Permission denied". `chmod -R g=u` mirrors the
|
|
# owner bits onto the group (the Red Hat arbitrary-UID idiom). This is applied
|
|
# unconditionally because it targets a directory the app writes on every start;
|
|
# the broader, opt-in USE_PERMISSION_HARDENING below covers the rest of /app.
|
|
RUN chgrp -R 0 /app/backend/open_webui/static && \
|
|
chmod -R g=u /app/backend/open_webui/static
|
|
|
|
EXPOSE 8080
|
|
|
|
HEALTHCHECK CMD curl --silent --fail http://localhost:${PORT:-8080}/health | jq -ne 'input.status == true' || exit 1
|
|
|
|
# Minimal, atomic permission hardening for OpenShift (arbitrary UID):
|
|
# - Group 0 owns /app and /root
|
|
# - Directories are group-writable and have SGID so new files inherit GID 0
|
|
RUN if [ "$USE_PERMISSION_HARDENING" = "true" ]; then \
|
|
set -eux; \
|
|
chgrp -R 0 /app /root || true; \
|
|
chmod -R g+rwX /app /root || true; \
|
|
find /app -type d -exec chmod g+s {} + || true; \
|
|
find /root -type d -exec chmod g+s {} + || true; \
|
|
fi
|
|
|
|
USER $UID:$GID
|
|
|
|
ARG BUILD_HASH
|
|
ENV WEBUI_BUILD_VERSION=${BUILD_HASH}
|
|
ENV DOCKER=true
|
|
|
|
CMD [ "bash", "start.sh"]
|