Open WebUI or n8n in Docker can't reach Ollama? Fix it without OLLAMA_HOST=0.0.0.0

Description and use

Containers can now reach Ollama without exposing it to the network, preserving security while enabling local AI workflows.

Problem

Containers running Open WebUI or n8n cannot reach the host‑bound Ollama service because localhost inside a container refers to the container itself, not the host.

Outcome

Containers can now reach Ollama without exposing it to the network, preserving security while enabling local AI workflows.

Workflow

• Test host Ollama availability with curl http://127.0.0.1:11434/api/version
• Test container reachability with docker run --rm --add-host=host.docker.internal:host-gateway curlimages/curl -s http://host.docker.internal:11434/api/version
• For Docker Desktop (Mac/Windows): run Open WebUI with --add-host=host.docker.internal:host-gateway and set OLLAMA_BASE_URL=http://host.docker.internal:11434
• For Linux option A: run Open WebUI with --network=host and set OLLAMA_BASE_URL=http://127.0.0.1:11434
• For Linux option B: configure Ollama to listen on 0.0.0.0:11434, allow Docker network via ufw, deny other access, and use host.docker.internal in containers
• Create a single docker‑compose file with services ollama and open‑webui, no published ports for ollama, and OLLAMA_BASE_URL=http://ollama:11434
• Adjust n8n, Dify, Flowise, or AnythingLLM to use http://ollama:11434 when using the compose file
• Handle IPv6 ECONNREFUSED by using 127.0.0.1 instead of localhost
• Avoid 403 Forbidden by not setting OLLAMA_ORIGINS to * and ensuring reverse proxies send Host: localhost:11434

Evidence

Inside a container, localhost means the container itself, not your computer.

Source

Ollama listens on 127.0.0.1:11434 on the host by default, so the container is knocking on the wrong door.

Source

docker run --rm --add-host=host.docker.internal:host-gateway curlimages/curl -s http://host.docker.internal:11434/api/version

Source

docker run -d -p 127.0.0.1:3000:8080 --add-host=host.docker.internal:host-gateway -e OLLAMA_BASE_URL=http://host.docker.internal:11434 -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:main

Source

docker run -d --network=host -e OLLAMA_BASE_URL=http://127.0.0.1:11434 -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:main

Source

sudo systemctl edit ollama.service # [Service] # Environment="OLLAMA_HOST=0.0.0.0:11434" sudo systemctl daemon-reload && sudo systemctl restart ollama sudo ufw allow from 172.16.0.0/12 to any port 11434 proto tcp sudo ufw deny 11434/tcp

Source

services:
ollama:
image: ollama/ollama
volumes:

• "ollama:/root/.ollama"

open-webui:
image: ghcr.io/open-webui/open-webui:main
environment:

• OLLAMA_BASE_URL=http://ollama:11434

ports:

• "127.0.0.1:3000:8080"

volumes:

• "open-webui:/app/backend/data"

volumes:
ollama: {}
open-webui: {}

Source