快速开始与安装（3/10）

Keep Tool and Function creation restricted to administrators and review all code before importing. By default, only administrators can create, import, and manage Tools and Functions. Do not grant workspace permissions to untrusted users. Treat third-party Tools with the same scrutiny as any code running on your infrastructure. Never import Tools without reviewing their source code first. Details
Disable automatic dependency installation and disable code execution if not needed. Set ENABLE_PIP_INSTALL_FRONTMATTER_REQUIREMENTS=false to prevent Tools from pulling in arbitrary packages at runtime. If your deployment does not require in-chat code execution, disable it entirely (ENABLE_CODE_EXECUTION=false, ENABLE_CODE_INTERPRETER=false). If it is needed, isolate it with Open Terminal (container-isolated) rather than relying on the legacy pyodide or jupyter engines, and never expose a jupyter engine without securing the Jupyter instance. Keep direct connections and direct tool servers disabled. Details

Data Protection

Restrict data sharing, file uploads, and API key access. Set maximum file sizes, file count limits, and restrict allowed file extensions. Disable community sharing (ENABLE_COMMUNITY_SHARING=false) and admin bulk export (ENABLE_ADMIN_EXPORT=false) if not operationally needed. Keep API key creation restricted to administrators and enable endpoint restrictions to limit which routes each key can access. Details
Encrypt data at rest and maintain regular backups. For SQLite, use an encrypted filesystem. For PostgreSQL, use disk-level or Transparent Data Encryption. Maintain regular backups, store them in a separate security domain, and periodically test your restore procedure. Details

Keep SSRF protections, outbound TLS verification, and network restrictions enabled. Do not enable local web fetch. The default configuration blocks access to private IP ranges and cloud provider metadata endpoints; extend the blocklist to include internal domains specific to your environment. Do not disable certificate verification for outbound connections. For air-gapped environments, enable offline mode so Open WebUI stops making its own outbound calls, and isolate the instance at the network level to close the connections it does not control. Details

Use official container images, or build from source. Pull images from ghcr.io/open-webui/open-webui or openwebui/open-webui on Docker Hub. For full supply chain control, build directly from source using the provided Dockerfile. Do not use unofficial or third-party images. Details
Pin to a specific release version and validate updates before deploying. Use a tagged release rather than :main or :latest. Review changelogs before upgrading. Validate new versions in a staging environment before rolling them out to production, and maintain the ability to roll back. Do not auto-update production deployments. Details

Run as non-root with minimal capabilities on a segmented network. Use a non-root UID/GID, read-only filesystem mounts where possible, drop all unnecessary Linux capabilities, and set --security-opt=no-new-privileges. Apply restrictive permissions (e.g., 0700) to the data directory. Use PostgreSQL with strong credentials on a separate network segment, not accessible from the public internet. Details

Enable audit logging at METADATA level or higher and forward to your SIEM. Always audit authentication endpoints. Configure retention and forward logs to your organization's log aggregation infrastructure. Use JSON log format and enable OpenTelemetry for distributed tracing if supported. Details
Monitor for anomalies. Track CPU, memory, network, and disk usage. Integrate with your alerting infrastructure to detect unexpected compute usage, outbound network activity, or storage consumption early. Details
Maintain an incident response plan. Define procedures for compromised accounts, unauthorized access, and unexpected resource consumption. Know how to disable user accounts, revoke sessions (requires Redis), rotate the secret key, and review audit logs.