mirror of
https://github.com/open-webui/open-webui.git
synced 2026-03-10 07:43:10 -05:00
issue: Docker on Windows: Container ignores all environment variables (OIDC, LOG_LEVEL, etc.) #6589
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/open-webui#6589
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @MindNudgeLab on GitHub (Oct 5, 2025).
Check Existing Issues
Installation Method
Docker
Open WebUI Version
v0.6.32 (pulled from the :main tag). The issue was also reproduced on the :community and :v0.6.25 tags.
Ollama Version (if applicable)
latest tag.
Operating System
Windows 11
Browser (if applicable)
Chrome (latest version), tested in standard and Incognito mode.
Confirmation
README.md.Expected Behavior
When OIDC environment variables are correctly set in docker-compose.yml, the application should read them on startup. The startup log should reflect the configured log level (e.g., GLOBAL_LOG_LEVEL: DEBUG). When a user accesses the UI, they should be redirected to the OIDC provider's login page to begin the authentication flow.
Actual Behavior
The application completely ignores all environment variables provided in the docker-compose.yml file.
The startup log consistently shows GLOBAL_LOG_LEVEL: INFO, even when LOG_LEVEL: debug is explicitly set.
The application fails to initiate the OIDC flow because it is ignoring the OIDC_ENABLED: "true" variable. This results in a "500: Internal Error" page when the browser hits the /auth redirect.
The most critical finding is that docker exec [container] printenv proves all environment variables are correctly present inside the container. There is a direct contradiction between the environment Docker provides and the configuration the application actually uses.
Steps to Reproduce
Start with a clean Windows 11 machine running the latest version of Docker Desktop.
Use the local-ai-packaged project structure, which has a main docker-compose.yml and a separate supabase/docker/docker-compose.yml, all sharing the same localai_default network.
Ensure the root .env file contains the required Supabase keys for ${ANON_KEY} and ${JWT_SECRET}.
Use the following configuration for the open-webui service in the main docker-compose.yml:
open-webui:
image: ghcr.io/open-webui/open-webui:main
pull_policy: always
container_name: open-webui
restart: unless-stopped
ports:
- "3000:8080"
environment:
# --- OIDC Settings for Supabase Auth ---
OIDC_ENABLED: "true"
OIDC_ISSUER_URL: "http://supabase-kong:8000/auth/v1"
OIDC_CLIENT_ID: "${ANON_KEY}"
OIDC_CLIENT_SECRET: "${JWT_SECRET}"
OIDC_SCOPES: "openid email profile"
OIDC_REDIRECT_URI: "https://[your-public-url]/oidc/callback"
OIDC_LOGOUT_REDIRECT_URI: "https://[your-public-url]"
volumes:
- open-webui-data:/app/backend/data
networks:
- localai_default
Ensure any previous open-webui volumes are deleted (docker volume rm open-webui-data) for a 100% clean start.
Start all services using the project's start_services.py script.
Verification Step 1: Run docker exec open-webui printenv. Observe that all environment variables, including LOG_LEVEL=debug and OIDC_ENABLED=true, are present and correct in the output.
Verification Step 2: Run docker logs open-webui. Observe that the application log shows GLOBAL_LOG_LEVEL: INFO, proving the environment variables from the compose file were ignored by the application at startup.
Final Result: Access the public URL (e.g., via ngrok). Observe the "500: Internal Error" page, as the app is trying to authenticate but has not loaded the necessary OIDC configuration.
Logs & Screenshots
1. docker logs open-webui Output
Loading WEBUI_SECRET_KEY from file, not provided as an environment variable.
Generating WEBUI_SECRET_KEY
Loading WEBUI_SECRET_KEY from .webui_secret_key
INFO [alembic.runtime.migration] Context impl SQLiteImpl.
INFO [alembic.runtime.migration] Will assume non-transactional DDL.
INFO [alembic.runtime.migration] Running upgrade -> 7e5b5dc7342b, init
INFO [alembic.runtime.migration] Running upgrade 7e5b5dc7342b -> ca81bd47c050, Add config table
INFO [alembic.runtime.migration] Running upgrade ca81bd47c050 -> c0fbf31ca0db, Update file table
INFO [alembic.runtime.migration] Running upgrade c0fbf31ca0db -> 6a39f3d8e55c, Add knowledge table
INFO [alembic.runtime.migration] Running upgrade 6a39f3d8e55c -> 242a2047eae0, Update chat table
INFO [alembic.runtime.migration] Running upgrade 242a2047eae0 -> 1af9b942657b, Migrate tags
INFO [alembic.runtime.migration] Running upgrade 1af9b942657b -> 3ab32c4b8f59, Update tags
INFO [alembic.runtime.migration] Running upgrade 3ab32c4b8f59 -> c69f45358db4, Add folder table
INFO [alembic.runtime.migration] Running upgrade c69f45358db4 -> c29facfe716b, Update file table path
INFO [alembic.runtime.migration] Running upgrade c29facfe716b -> af906e964978, Add feedback table
INFO [alembic.runtime.migration] Running upgrade af906e964978 -> 4ace53fd72c8, Update folder table and change DateTime to BigInteger for timestamp fields
INFO [alembic.runtime.migration] Running upgrade 4ace53fd72c8 -> 922e7a387820, Add group table
INFO [alembic.runtime.migration] Running upgrade 922e7a387820 -> 57c599a3cb57, Add channel table
INFO [alembic.runtime.migration] Running upgrade 57c599a3cb57 -> 7826ab40b532, Update file table
INFO [alembic.runtime.migration] Running upgrade 7826ab40b532 -> 3781e22d8b01, Update message & channel tables
INFO [alembic.runtime.migration] Running upgrade 3781e22d8b01 -> 9f0c9cd09105, Add note table
INFO [alembic.runtime.migration] Running upgrade 9f0c9cd09105 -> d31026856c01, Update folder table data
INFO [alembic.runtime.migration] Running upgrade d31026856c01 -> 018012973d35, Add indexes
INFO [alembic.runtime.migration] Running upgrade 018012973d35 -> 3af16a1c9fb6, update user table
INFO [alembic.runtime.migration] Running upgrade 3af16a1c9fb6 -> 38d63c18f30f, Add oauth_session table
INFO [alembic.runtime.migration] Running upgrade 38d63c18f30f -> a5c220713937, Add reply_to_id column to message
WARNI [open_webui.env]
WARNING: CORS_ALLOW_ORIGIN IS SET TO '*' - NOT RECOMMENDED FOR PRODUCTION DEPLOYMENTS.
INFO [open_webui.env] VECTOR_DB: chroma
INFO [open_webui.env] Embedding model set: sentence-transformers/all-MiniLM-L6-v2
WARNI [langchain_community.utils.user_agent] USER_AGENT environment variable not set, consider setting it to identify your requests.
Creating knowledge table
Migrating data from document table to knowledge table
Converting 'chat' column to JSON
Renaming 'chat' column to 'old_chat'
Adding new 'chat' column of type JSON
Dropping 'old_chat' column
Primary Key: {'name': None, 'constrained_columns': []}
Unique Constraints: [{'name': 'uq_id_user_id', 'column_names': ['id', 'user_id']}]
Indexes: [{'name': 'tag_id', 'column_names': ['id'], 'unique': 1, 'dialect_options': {}}]
Creating new primary key with 'id' and 'user_id'.
Dropping unique constraint: uq_id_user_id
Dropping unique index: tag_id
██████╗ ██████╗ ███████╗███╗ ██╗ ██╗ ██╗███████╗██████╗ ██╗ ██╗██╗
██╔═══██╗██╔══██╗██╔════╝████╗ ██║ ██║ ██║██╔════╝██╔══██╗██║ ██║██║
██║ ██║██████╔╝█████╗ ██╔██╗ ██║ ██║ █╗ ██║█████╗ ██████╔╝██║ ██║██║
██║ ██║██╔═══╝ ██╔══╝ ██║╚██╗██║ ██║███╗██║██╔══╝ ██╔══██╗██║ ██║██║
╚██████╔╝██║ ███████╗██║ ╚████║ ╚███╔███╔╝███████╗██████╔╝╚██████╔╝██║
╚═════╝ ╚═╝ ╚══════╝╚═╝ ╚═══╝ ╚══╝╚══╝ ╚══════╝╚═════╝ ╚═════╝ ╚═╝
v0.6.32 - building the best AI user interface.
https://github.com/open-webui/open-webui
Fetching 30 files: 100%|██████████| 30/30 [00:36<00:00, 1.21s/it]
INFO: Started server process [1]
INFO: Waiting for application startup.
2025-10-04 05:05:50.350 | INFO | open_webui.utils.logger:start_logger:162 - GLOBAL_LOG_LEVEL: INFO
2025-10-04 05:05:50.350 | INFO | open_webui.main:lifespan:553 - Installing external dependencies of functions and tools...
2025-10-04 05:05:50.369 | INFO | open_webui.utils.plugin:install_frontmatter_requirements:283 - No requirements found in frontmatter.
2. docker exec open-webui printenv Output
PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=f93c4070561a
AUTH_PROVIDER=supabase
OLLAMA_BASE_URL=http://ollama:11434
SUPABASE_PROJECT_ID=local
SUPABASE_URL=http://supabase-kong:8000
SUPABASE_SERVICE_ROLE_KEY=[REDACTED_SERVICE_ROLE_KEY]
LOG_LEVEL=debug
SUPABASE_JWT_SECRET=[REDACTED_JWT_SECRET]
WEBUI_URL=https://officially-exact-snapper.ngrok-free.app
SUPABASE_ANON_KEY=[REDACTED_ANON_KEY]
ENABLE_PERSISTENT_CONFIG=False
LANG=C.UTF-8
GPG_KEY=A035C8C19219BA821ECEA86B64E628F8D684696D
PYTHON_VERSION=3.11.13
PYTHON_SHA256=8fb5f9fbc7609fa822cb31549884575db7fd9657cbffb89510b5d7975963a83a
ENV=prod
PORT=8080
USE_OLLAMA_DOCKER=false
USE_CUDA_DOCKER=false
USE_CUDA_DOCKER_VER=cu128
USE_EMBEDDING_MODEL_DOCKER=sentence-transformers/all-MiniLM-L6-v2
USE_RERANKING_MODEL_DOCKER=
OPENAI_API_BASE_URL=
OPENAI_API_KEY=
WEBUI_SECRET_KEY=
SCARF_NO_ANALYTICS=true
DO_NOT_TRACK=true
ANONYMIZED_TELEMETRY=false
WHISPER_MODEL=base
WHISPER_MODEL_DIR=/app/backend/data/cache/whisper/models
RAG_EMBEDDING_MODEL=sentence-transformers/all-MiniLM-L6-v2
RAG_RERANKING_MODEL=
SENTENCE_TRANSFORMERS_HOME=/app/backend/data/cache/embedding/models
TIKTOKEN_ENCODING_NAME=cl100k_base
TIKTOKEN_CACHE_DIR=/app/backend/data/cache/tiktoken
HF_HOME=/app/backend/data/cache/embedding/models
HOME=/root
WEBUI_BUILD_VERSION=1db8dec4f52fc0fa8f8f7bfbb8ea5bde41fee17d
DOCKER=true
Additional Information
This appears to be an issue specific to how the container entrypoint or the application itself ingests environment variables on Docker for Windows. The networking between containers is confirmed to be working correctly via curl. The issue persists across multiple image tags (:main, :community, v0.6.25, etc.) and various configuration methods (environment:, env_file:, hardcoded values). The direct contradiction between the printenv output and the application's actual behavior is the key indicator of a bug.