Updating Open WebUI

Overview

Keeping Open WebUI updated ensures you have the latest features, security patches, and bug fixes. You can update manually or automate the process using container update tools.

Before Updating

• Backup your data — especially before releases that include database migrations, since they can be hard to undo. Check release notes for breaking changes
• Clear browser cache after updating (Ctrl+F5 / Cmd+Shift+R)
• Multiple workers/replicas? Run migrations with UVICORN_WORKERS=1 first, or set ENABLE_DB_MIGRATIONS=False on all but one instance

Manual Update

Docker Run

# 1. Stop and remove the container (data in the volume is preserved)
docker rm -f open-webui

# 2. Pull the latest image
docker pull ghcr.io/open-webui/open-webui:main

# 3. Recreate the container
docker run -d -p 3000:8080 \
  -v open-webui:/app/backend/data \
  -e WEBUI_SECRET_KEY="your-secret-key" \
  --name open-webui --restart always \
  ghcr.io/open-webui/open-webui:main

For NVIDIA GPU support, add --gpus all to the docker run command.

Docker Compose

docker compose pull
docker compose up -d

Make sure your docker-compose.yml includes WEBUI_SECRET_KEY:

docker-compose.yml

services:
  open-webui:
    image: ghcr.io/open-webui/open-webui:main
    ports:
      - "3000:8080"
    volumes:
      - open-webui:/app/backend/data
    environment:
      - WEBUI_SECRET_KEY=your-secret-key
    restart: unless-stopped

volumes:
  open-webui:

Set WEBUI_SECRET_KEY to avoid logout on every update

Without a persistent WEBUI_SECRET_KEY, a new key is generated each time the container is recreated, invalidating all sessions. Generate one with openssl rand -hex 32 and keep it across updates.

Pinning a Version

By default the :main tag always points to the latest build. For production, pin a specific release:

ghcr.io/open-webui/open-webui:v0.6.52
ghcr.io/open-webui/open-webui:v0.6.52-cuda
ghcr.io/open-webui/open-webui:v0.6.52-ollama

Rolling Back

If an update causes problems, pin the previous version:

docker rm -f open-webui
docker pull ghcr.io/open-webui/open-webui:v0.6.51
docker run -d -p 3000:8080 -v open-webui:/app/backend/data \
  -e WEBUI_SECRET_KEY="your-secret-key" \
  --name open-webui ghcr.io/open-webui/open-webui:v0.6.51

---

Automated Updates

warning

Automated updates can break your deployment if a release includes breaking changes or migration issues. Review release notes before auto-updating production systems, and always have a backup.

Choosing a Tool

Feature	Watchtower	WUD	Diun
Auto-updates containers	✅	❌ (manual via UI)	❌
Web interface	❌	✅	❌
Notifications	✅	✅	✅
Docker 29+	✅ (forks)	✅	✅
Best for	Homelabs	Visual monitoring	Notification-only

Watchtower

note

The original containrrr/watchtower is unmaintained and broken on Docker 29+. Use the nickfedor/watchtower fork instead.

One-time update:

docker run --rm \
  -v /var/run/docker.sock:/var/run/docker.sock \
  nickfedor/watchtower --run-once open-webui

Continuous (check every 6 hours):

docker run -d --name watchtower --restart unless-stopped \
  -v /var/run/docker.sock:/var/run/docker.sock \
  nickfedor/watchtower --interval 21600 open-webui

Set WATCHTOWER_CLEANUP=true to auto-remove old images. See Watchtower docs for scheduling, notifications, and monitor-only mode.

What's Up Docker (WUD)

Web UI for monitoring container updates and triggering them manually. See WUD documentation for setup.

Diun

Notification-only — alerts you when updates are available (email, Slack, Discord, Telegram, etc.) without touching your containers. See Diun documentation for setup.

---

Backup & Restore

All data (chats, users, uploads) lives in the open-webui Docker volume.

Backup:

docker run --rm -v open-webui:/data -v $(pwd):/backup \
  alpine tar czf /backup/openwebui-$(date +%Y%m%d).tar.gz /data

Restore:

docker stop open-webui
docker run --rm -v open-webui:/data -v $(pwd):/backup \
  alpine sh -c "rm -rf /data/* && tar xzf /backup/openwebui-20250216.tar.gz -C /"
docker start open-webui

For database-specific recovery, see the Manual Database Migration guide.