[GH-ISSUE #687] Uploading documents connects to external web services such as an AWS ELB? #27707

New Issue

GiteaMirror · 2026-04-25T02:26:54-05:00

GiteaMirror commented

2026-04-25 02:26:54 -05:00

Originally created by @prologic on GitHub (Feb 9, 2024).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/687

Bug Report

Description

Bug Summary:

I tried to upload a document to my locally hosted instance of Ollama Web UI and to my horror I discovered that the Docker container (running Ollaba Web UI) wanted to connect to an AWS ELB?! Naturally I blocked this connection (thanks to LittleSnitch). Then it wanted to connect to another external services, some packages (didn't capture it).

Steps to Reproduce:

Install a filtering/logging firewall like LittleSnitch
Upload a document
Observe external connections made

Expected Behavior:

I don't know wtf this is trying to do, but I really DO NOT expect a locally hosted instance of anything to be connecting externally to some 3rd-party services (within reason of course). This is absurd.

At the very least, could someone please explain why this is happening and what this is even used for? Maybe it's legit and required for some part of the "Upload Document" user journey to work?

Actual Behavior:

I expect locally hosted software to NOT connect to external services. The whole point of using Ollama in the first place is to run local LLM models 😅

Environment

Not really relevant. But Docker container on a Mac.

PS: Your Issue template is too long. Please simplify it, I don't generally have and time and patience to fill out everything asked, especially of a vision impaired person. It also takes some of the "human"(ity) out of helping to contribute to "better" open source software.

Originally created by @prologic on GitHub (Feb 9, 2024). Original GitHub issue: https://github.com/open-webui/open-webui/issues/687 # Bug Report ## Description **Bug Summary:** I tried to upload a document to my locally hosted instance of Ollama Web UI and to my horror I discovered that the Docker container (running Ollaba Web UI) wanted to connect to an AWS ELB?! Naturally I blocked this connection (thanks to LittleSnitch). Then it wanted to connect to another external services, some packages (didn't capture it). **Steps to Reproduce:** - Install a filtering/logging firewall like LittleSnitch - Upload a document - Observe external connections made **Expected Behavior:** I don't know wtf this is _trying_ to do, but I **really** DO NOT expect a locally hosted instance of anything to be connecting externally to some 3rd-party services (_within reason of course_). This is absurd. At the very least, could someone please explain why this is happening and what this is even used for? Maybe it's legit and required for some part of the "Upload Document" user journey to work? **Actual Behavior:** I expect locally hosted software to **NOT** connect to external services. The whole point of using Ollama in the first place is to run local LLM models 😅 ## Environment Not really relevant. But Docker container on a Mac. PS: Your Issue template is too long. Please simplify it, I don't generally have and time and patience to fill out everything asked, especially of a vision impaired person. It also takes some of the "human"(ity) out of helping to contribute to "better" open source software.

GiteaMirror closed this issue

2026-04-25 02:26:54 -05:00

GiteaMirror commented

2026-04-25 02:26:55 -05:00

@prologic commented on GitHub (Feb 9, 2024):

FWIW blocking the two connections didn't appear to affect the functionality of Uploading a document. I was later able to select it and use it in context with #, so I'm really confused as to why those connections are even necessary at all 🤔

@prologic commented on GitHub (Feb 9, 2024): FWIW blocking the two connections didn't appear to affect the functionality of Uploading a document. I was later able to select it and use it in context with `#`, so I'm really confused as to why those connections are even necessary at all 🤔

GiteaMirror commented

2026-04-25 02:26:55 -05:00

@tjbck commented on GitHub (Feb 9, 2024):

Hi, Thanks for reporting this issue. Could you verify that AWS ELB connection is 100% occurring from the webui-side? Our backend code does no contain any code that explicitly makes connection with AWS ELB, so my guess is the request is made from one of our dependency libraries. If you could narrow down what part of the code making the connection, that would be tremendously helpful, Thanks!

@tjbck commented on GitHub (Feb 9, 2024): Hi, Thanks for reporting this issue. Could you verify that AWS ELB connection is 100% occurring from the webui-side? Our backend code does no contain any code that explicitly makes connection with AWS ELB, so my guess is the request is made from one of our dependency libraries. If you could narrow down what part of the code making the connection, that would be tremendously helpful, Thanks!

GiteaMirror commented

2026-04-25 02:26:56 -05:00

@prologic commented on GitHub (Feb 10, 2024):

Yup makes sense!

I'll try to narrow this down 👌 As you said, If you're not doing this explicitly in this codebase then I consider a sneaky supply chain type of thing 🤣

@prologic commented on GitHub (Feb 10, 2024): Yup makes sense! I'll try to narrow this down 👌 As you said, If you're not doing this explicitly in this codebase then I consider a sneaky supply chain type of thing 🤣

GiteaMirror commented

2026-04-25 02:26:57 -05:00

@prologic commented on GitHub (Feb 10, 2024):

So here we go:

Text version(s):

Docker wants to connect to a046be49099ce4659abbcfa853797f20-5fd7cc9498e4883e.elb.ap-southeast-1.amazonaws.com on TCP port 443 (https)

Docker wants to connect to packages.unstructured.io on TCP port 443 (https)

Screenshots:

@prologic commented on GitHub (Feb 10, 2024): So here we go: Text version(s): ``` Docker wants to connect to a046be49099ce4659abbcfa853797f20-5fd7cc9498e4883e.elb.ap-southeast-1.amazonaws.com on TCP port 443 (https) Docker wants to connect to packages.unstructured.io on TCP port 443 (https) ``` Screenshots: <img width="678" alt="Screenshot 2024-02-10 at 11 12 24" src="https://github.com/ollama-webui/ollama-webui/assets/1290234/022dca20-690f-441e-a8df-7e29d76ae68c"> <img width="636" alt="Screenshot 2024-02-10 at 11 12 55" src="https://github.com/ollama-webui/ollama-webui/assets/1290234/514b7ae1-3f69-4b79-8741-8765b6db8d57">

GiteaMirror commented

2026-04-25 02:26:58 -05:00

@prologic commented on GitHub (Feb 10, 2024):

Note that this is the container itself trying to do this, so something to do with the backend.

@prologic commented on GitHub (Feb 10, 2024): Note that this is the container itself _trying_ to do this, so something to do with the backend.

GiteaMirror commented

2026-04-25 02:26:58 -05:00

@prologic commented on GitHub (Feb 10, 2024):

Doing a search for the 2nd connection yield this:

d11c70cf83/unstructured/utils.py (L287-L319)

Are we using this in the backenda anywhere? 🤔

@prologic commented on GitHub (Feb 10, 2024): Doing a [search](https://github.com/search?q=%22packages.unstructured.io%22&ref=opensearch&type=code) for the 2nd connection yield this: https://github.com/Unstructured-IO/unstructured/blob/d11c70cf83fdb8a08fed2cf01c6c0bd114d817df/unstructured/utils.py#L287-L319 Are we using this in the backenda anywhere? 🤔

GiteaMirror commented

2026-04-25 02:27:00 -05:00

@tjbck commented on GitHub (Feb 10, 2024):

Here's a list of our suspects:

langchain
langchain-community
chromadb
sentence_transformers
pypdf
docx2txt
unstructured
markdown
pypandoc
pandas
openpyxl
pyxlsb
xlrd

@tjbck commented on GitHub (Feb 10, 2024): Here's a list of our suspects: ``` langchain langchain-community chromadb sentence_transformers pypdf docx2txt unstructured markdown pypandoc pandas openpyxl pyxlsb xlrd ```

GiteaMirror commented

2026-04-25 02:27:01 -05:00

@prologic commented on GitHub (Feb 10, 2024):

We are:

cb5520c519/backend/requirements.txt (L25)

Why does it need to connect to an external service? 🤔

@prologic commented on GitHub (Feb 10, 2024): We are: https://github.com/ollama-webui/ollama-webui/blob/cb5520c519dde81bfe08ce358753ab7f11417f97/backend/requirements.txt#L25 Why does it need to connect to an external service? 🤔

GiteaMirror commented

2026-04-25 02:27:01 -05:00

@prologic commented on GitHub (Feb 10, 2024):

I can't figure out this random ELB though, might need some help figuring that one out. But at least we have some culprits now.... The question is, what do we do about it? Blocking both doesn't adversely affect Ollama Web UI in any way that I can tell hmmm

@prologic commented on GitHub (Feb 10, 2024): I can't figure out this random ELB though, might need some help figuring that one out. But at least we have some culprits now.... The question is, what do we do about it? Blocking both doesn't adversely affect Ollama Web UI in any way that I can tell hmmm

GiteaMirror commented

2026-04-25 02:27:01 -05:00

@prologic commented on GitHub (Feb 10, 2024):

Oh wow!

def scarf_analytics():
...

If this library is sending analytics, that's disgusting 😱

@prologic commented on GitHub (Feb 10, 2024): Oh wow! ```python def scarf_analytics(): ... ``` If this library is sending analytics, that's disgusting 😱

GiteaMirror commented

2026-04-25 02:27:02 -05:00

@tjbck commented on GitHub (Feb 10, 2024):

UnstructuredMarkdownLoader seems to be the culprit, investigating more.

@tjbck commented on GitHub (Feb 10, 2024): `UnstructuredMarkdownLoader` seems to be the culprit, investigating more.

GiteaMirror commented

2026-04-25 02:27:03 -05:00

@prologic commented on GitHub (Feb 10, 2024):

Open source libraries and APIs to build custom preprocessing pipelines for labeling, training, or production machine learning pipelines.

www.unstructured.io/

I have half a mind to go yell at this company and ask them to please explain themselves 🤣 Shame on them!

@prologic commented on GitHub (Feb 10, 2024): >Open source libraries and APIs to build custom preprocessing pipelines for labeling, training, or production machine learning pipelines. > > [www.unstructured.io/](https://www.unstructured.io/) I have half a mind to go yell at this company and ask them to please explain themselves 🤣 Shame on them!

GiteaMirror commented

2026-04-25 02:27:03 -05:00

@tjbck commented on GitHub (Feb 10, 2024):

Just reviewed the code, I reckon setting DO_NOT_TRACK env var to True will stop the telemetry, could you try testing it?

@tjbck commented on GitHub (Feb 10, 2024): Just reviewed the code, I reckon setting `DO_NOT_TRACK` env var to `True` will stop the telemetry, could you try testing it?

GiteaMirror commented

2026-04-25 02:27:03 -05:00

@prologic commented on GitHub (Feb 10, 2024):

Love it! Let's do it, happy to test the fix 👌

@prologic commented on GitHub (Feb 10, 2024): Love it! Let's do it, happy to test the fix 👌

GiteaMirror commented

2026-04-25 02:27:04 -05:00

@prologic commented on GitHub (Feb 10, 2024):

And thank you for responding to this so quickly! When you're self hosting and insisting on doing things locally, you really don't expect your software to reach out to the internet without you knowing about it 😅

@prologic commented on GitHub (Feb 10, 2024): And thank you for responding to this so quickly! When you're self hosting and insisting on doing things locally, you really don't expect your software to reach out to the internet without you knowing about it 😅

GiteaMirror commented

2026-04-25 02:27:04 -05:00

@prologic commented on GitHub (Feb 10, 2024):

Some kudos I posted for you 😅

@prologic commented on GitHub (Feb 10, 2024): Some kudos I [posted](https://twtxt.net/twt/me3ac2a) for you 😅

GiteaMirror commented

2026-04-25 02:27:05 -05:00

@justinh-rahb commented on GitHub (Feb 10, 2024):

Good find guys, ya that definitely not nice of them to do. Is there any disclosure from the libary anywhere?

@justinh-rahb commented on GitHub (Feb 10, 2024): Good find guys, ya that definitely not nice of them to do. Is there any disclosure from the libary anywhere?

GiteaMirror commented

2026-04-25 02:27:06 -05:00

@prologic commented on GitHub (Feb 10, 2024):

Good find guys, ya that definitely not nice of them to do. Is there any disclosure from the libary anywhere?

Are you suggesting we file a bug upstream too? It was a bit of a rude surprise to be honest 😅

@prologic commented on GitHub (Feb 10, 2024): > Good find guys, ya that definitely not nice of them to do. Is there any disclosure from the libary anywhere? Are you suggesting we file a bug upstream too? It was a bit of a rude surprise to be honest 😅

GiteaMirror commented

2026-04-25 02:27:06 -05:00

@tjbck commented on GitHub (Feb 10, 2024):

@justinh-rahb none I can find from their readme :/

EDIT: they do mention at the very bottom of their readme to set the environment variable SCARF_NO_ANALYTICS=true.

@tjbck commented on GitHub (Feb 10, 2024): @justinh-rahb none I can find from their [readme](https://github.com/Unstructured-IO/unstructured) :/ EDIT: they do mention at the very bottom of their readme to set the environment variable `SCARF_NO_ANALYTICS=true`.

GiteaMirror commented

2026-04-25 02:27:06 -05:00

@tjbck commented on GitHub (Feb 10, 2024):

Added

ENV SCARF_NO_ANALYTICS true
ENV DO_NOT_TRACK true

with #694, it should disable the telemetry. Please try it out and let me know!

@tjbck commented on GitHub (Feb 10, 2024): Added ``` ENV SCARF_NO_ANALYTICS true ENV DO_NOT_TRACK true ``` with #694, it should disable the telemetry. Please try it out and let me know!

GiteaMirror commented

2026-04-25 02:27:07 -05:00

@justinh-rahb commented on GitHub (Feb 10, 2024):

With RAG being as hot as it is right now, I guess we shouldn't be surprised that some libary authors are cashing in on the user data flowing through their code.

Perhaps it'll be prudent to think about dependency audits in the future. With Ollama now supporting a broad range of CPU-only configurations, it can be integrated into GitHub Actions, along with Ollama-WebUI for thorough end-to-end testing. I'm going to give this a think over the weekend, I seem to recall there being a thread in discussions about using the webUI API directly that may come in handy here, time to do some research...

@justinh-rahb commented on GitHub (Feb 10, 2024): With RAG being as hot as it is right now, I guess we shouldn't be surprised that some libary authors are cashing in on the user data flowing through their code. Perhaps it'll be prudent to think about dependency audits in the future. With Ollama now supporting a broad range of CPU-only configurations, it can be integrated into GitHub Actions, along with Ollama-WebUI for thorough end-to-end testing. I'm going to give this a think over the weekend, I seem to recall there being a thread in discussions about using the webUI API directly that may come in handy here, time to do some research...

GiteaMirror commented

2026-04-25 02:27:07 -05:00

@tjbck commented on GitHub (Feb 13, 2024):

@prologic has the issue been resolved with the latest release?

@tjbck commented on GitHub (Feb 13, 2024): @prologic has the issue been resolved with the latest release?

GiteaMirror commented

2026-04-25 02:27:08 -05:00

@prologic commented on GitHub (Feb 13, 2024):

I pulled the latest Docker image and restarted my local instance and so far so good 😊

@prologic commented on GitHub (Feb 13, 2024): I pulled the latest Docker image and restarted my local instance and so far so good 😊

GiteaMirror commented

2026-04-25 02:27:09 -05:00

@tjbck commented on GitHub (Feb 14, 2024):

I'll close this issue for now, feel free to open new issues if you encounter any spywares from the dependency supply chain, thanks!

@tjbck commented on GitHub (Feb 14, 2024): I'll close this issue for now, feel free to open new issues if you encounter any spywares from the dependency supply chain, thanks!

GiteaMirror commented

2026-04-25 02:27:09 -05:00

@aswani-ms commented on GitHub (Jun 21, 2024):

Do you have an example code how to upload a document programatically through an api? is it possible

@aswani-ms commented on GitHub (Jun 21, 2024): Do you have an example code how to upload a document programatically through an api? is it possible

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#27707