You can run Phi-3 privately on a Linux VPS by placing Ollama and Open WebUI in Docker, storing both model files and application data on persistent volumes, and exposing only the web interface through an HTTPS reverse proxy. Ollama supplies the model and API; Open WebUI supplies the browser experience. A GPU is optional for Phi-3 Mini, but your VPS must be sized for the context length, number of users and response speed you actually need.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What you are building
The finished stack has three layers:
- Ollama: the model runtime and HTTP API. It downloads and serves the
phi3model on port 11434. - Open WebUI: the authenticated browser interface that sends prompts to Ollama and stores users, chats and settings.
- Reverse proxy: the public HTTPS entry point. It forwards browser traffic to Open WebUI while keeping Ollama’s API private.
Open WebUI’s official quick-start documentation states: “Open WebUI has no models of its own.” Install Phi-3 in Ollama first, then configure Open WebUI to use the Ollama API. Phi-3 Mini is listed by Ollama as a 3.8-billion-parameter model with a 2.3 GB download. Microsoft’s 2024 technical report describes the same model as having 3.8 billion parameters, training on 3.3 trillion tokens, and reporting 69% on MMLU and 8.38 on MT-Bench. Those benchmark scores describe published evaluations, not guaranteed speed or answer quality on your VPS.
As an Amazon Associate I earn from qualifying purchases.
That separation also explains the most common setup mistake: installing Open WebUI successfully, but expecting a model selector to contain a model automatically. The selector is populated from the Ollama API connection. The runtime, model files, interface database and public gateway are separate responsibilities, so each should be tested independently.
Choose the deployment layout
Separate Ollama and Open WebUI containers
This is the most flexible layout. Each service can be upgraded, restarted and backed up independently. Both containers join one private Docker network, and Open WebUI addresses Ollama by its Compose service name on port 11434. Use this arrangement when you expect to change runtimes, add another model, or operate the services separately.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
It also gives clearer diagnostics. If the model list is empty, you can test Ollama from inside its own container, then test DNS and HTTP access from the WebUI container. A private network means no host port mapping is needed for Ollama, reducing accidental exposure.
Single bundled container
Open WebUI publishes an :ollama image that bundles the interface and Ollama for a simpler installation. It reduces the number of services to manage, but gives you less separation when troubleshooting or upgrading. Open WebUI also publishes main, slim and cuda image variants. Choose a tag deliberately and pin a version when the project’s release process provides a suitable immutable tag.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →A bundled image can be appropriate for a personal sandbox or a short-lived test. For a service holding several users’ conversations, separate lifecycle control usually makes maintenance and rollback easier. Whichever layout you choose, record the image tag, volume names and environment variables before changing it.
Private versus public access
For one person or a small trusted group, expose only the reverse proxy and require strong accounts. Never publish port 11434 directly to the Internet unless you have a deliberate, authenticated remote-client design. An unprotected Ollama endpoint can allow outsiders to consume CPU, GPU, memory and bandwidth.
Open WebUI accounts are not a substitute for network isolation. Keep the Ollama listener on the Docker network or a private interface, limit firewall rules to the WebUI host where possible, and treat logs and chat data as sensitive. Public multi-user operation needs capacity for authentication, proxying, monitoring, abuse handling and backups in addition to inference.
VPS requirements and sizing
There is no universal minimum RAM or vCPU figure established by the cited documentation. A useful size depends on the model’s context length, simultaneous conversations, desired first-token latency and whether other services share the host. The 2.3 GB download is the model artifact, not the complete memory requirement: runtime overhead, the active context and concurrent requests require additional RAM.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall| Workload | Practical starting approach | What to watch |
|---|---|---|
| One private user, occasional prompts | CPU-only VPS with enough memory for Phi-3 plus the operating system and containers | Generation speed and swap activity |
| Several users or long conversations | More RAM and vCPUs, or a GPU-capable VPS | Queueing, context growth and concurrent memory use |
| Interactive, low-latency use | GPU VPS with CUDA support, Docker GPU support and the NVIDIA container runtime/toolkit | GPU availability in your region, driver compatibility and hourly cost |
| Public service | Capacity beyond the model alone for proxy, authentication, monitoring and backups | Abuse, disk durability and bandwidth |
CPU inference is simpler and generally cheaper. A GPU can reduce latency, especially with concurrent users, but it adds driver and runtime requirements. Do not infer expected tokens per second from the 3.8B parameter count; measure the deployed workload and adjust context, concurrency or machine size.
Plan the bill, not just the processor
Compare the complete monthly cost of a CPU VPS and a GPU VPS. Include persistent disk, snapshots or backup storage, bandwidth, public IPv4 or equivalent networking charges, and any reverse-proxy service. GPU instances may be billed hourly and may not be available in every region. A cheaper CPU instance can be the better choice for one occasional user, while a GPU can justify its premium when several people need responsive streaming at the same time.
Provider offerings change frequently. Before ordering, verify current regions, RAM and vCPU configurations, GPU model and availability, storage durability, transfer limits, billing unit and cancellation terms. A provider category link such as VPS hosting for Ollama or GPU VPS is useful only if those current details are checked.
Prepare the Linux VPS
- Use a current Linux distribution with Docker Engine and the Docker Compose plugin.
- Point a domain name at the VPS if you plan to use HTTPS. A reverse proxy can then obtain and renew a certificate for the WebUI.
- Allow SSH and the reverse-proxy ports in the VPS firewall. Keep port 11434 closed to the public network.
- Allocate persistent disk space for the downloaded model, Open WebUI’s database and future backups. The Phi-3 download alone is 2.3 GB according to Ollama’s documentation.
- Use a non-root administrative account where possible, apply security updates and restrict SSH with keys.
Install Docker using the current instructions for your Linux distribution. Package names and repository commands change, so follow Docker’s maintained documentation for your release rather than copying an old installer.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Also decide where backups will live before downloading the model. A second disk or remote backup target protects against a failed VPS disk; a snapshot on the same host does not provide the same recovery safety. Leave free capacity for a second model, temporary image layers and backup staging rather than filling the disk with the initial 2.3 GB artifact.
Install Ollama and Phi-3
Ollama installed on the VPS host
Install Ollama using its current Linux instructions, then download and start the model:
ollama pull phi3
ollama run phi3The model name used by Ollama’s Phi-3 quick start is exactly phi3. After the interactive test, exit the session and leave the Ollama service running so Open WebUI can call its API. Confirm the model is present with:
ollama listThe first pull can take time because the model artifact is downloaded to local storage. A successful interactive run proves that Ollama can load the model locally; it does not prove that a separate Docker container can reach the API. Perform that network test after configuring the WebUI.
If Open WebUI runs in Docker while Ollama runs on the host, the container must be able to reach the host listener. Open WebUI documents using a Docker host-gateway mapping and an Ollama listener bound to an interface visible from Docker. Bind that listener only to a private interface or protect it with firewall rules; do not bind port 11434 openly without authentication.
Ollama in Docker
When Ollama is containerized, mount a named volume at /root/.ollama. That directory contains model files; without the volume, recreating the container forces another download and can appear to delete your models.
Pull the model from inside the running container, not from an unrelated host installation. Running ollama list in the wrong environment is a common reason an administrator believes the model vanished.
Run Open WebUI with persistent data
For a quick host-Ollama deployment, the official Open WebUI command is:
Free tools Windows power users keep installed
One-click scans. No signup required.
docker run -d -p 3000:8080
--add-host=host.docker.internal:host-gateway
-v open-webui:/app/backend/data
-e WEBUI_SECRET_KEY="$(openssl rand -hex 32)"
--name open-webui --restart always
ghcr.io/open-webui/open-webui:mainThe host port 3000 maps to Open WebUI’s container port 8080. The open-webui:/app/backend/data volume preserves users, chats and settings when the container is replaced. Generate a stable secret before the first production start and retain it securely. Changing WEBUI_SECRET_KEY later can invalidate existing sessions.
Do not treat this direct port mapping as the final public security boundary. Bind the service to localhost or an internal interface, then put it behind a reverse proxy that provides HTTPS, authentication and request limits.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Keep the generated secret out of a public Compose file and shell history where practical. If you rotate it, plan for users to sign in again and verify that existing data remains readable. The volume protects application state; the secret protects session handling, so both belong in your recovery documentation.
Use Docker Compose for a separated stack
Compose makes the network and volumes explicit. This example keeps Ollama private to the Compose network and persists both kinds of data:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesservices:
ollama:
image: ollama/ollama:latest
volumes:
- ollama:/root/.ollama
restart: unless-stopped
open-webui:
image: ghcr.io/open-webui/open-webui:main
depends_on:
- ollama
ports:
- "127.0.0.1:3000:8080"
environment:
OLLAMA_BASE_URL: http://ollama:11434
WEBUI_SECRET_KEY: replace-with-a-stable-random-secret
volumes:
- open-webui:/app/backend/data
restart: unless-stopped
volumes:
ollama:
open-webui:Save the file, start it, and download Phi-3 inside the Ollama container:
docker compose up -d
docker compose exec ollama ollama pull phi3
docker compose exec ollama ollama listThe service name ollama resolves through Docker’s internal DNS. Do not use localhost for OLLAMA_BASE_URL in the Open WebUI container: there, localhost means the WebUI container itself.
For a GPU deployment, select the Open WebUI CUDA-capable image and configure Docker’s GPU support. CUDA requires a compatible host driver, the NVIDIA container runtime/toolkit and a VPS provider that actually supplies an available GPU. Keep the same persistent mounts and verify GPU access before assuming inference is accelerated.
The latest and main tags are convenient for testing but can change. For reproducible production updates, use a deliberately selected release tag when the project publishes one, document the previous tag, and retain backups before pulling a new image.
Connect Open WebUI to Ollama
Both services in Compose
Set OLLAMA_BASE_URL=http://ollama:11434, as in the example above. The port is internal and does not need a host mapping.
Ollama on the host, WebUI in Docker
Set:
OLLAMA_BASE_URL=http://host.docker.internal:11434Include --add-host=host.docker.internal:host-gateway in the container command, or the equivalent Compose extra_hosts entry. Ensure Ollama listens on the private interface Docker can reach, not only on loopback.
Ollama on another server
Set OLLAMA_BASE_URL to that server’s reachable URL. Prefer a private network or VPN path, firewall the API to the WebUI host, and add authentication at the network boundary. A public unauthenticated Ollama URL is not a safe shortcut.
Verify from the WebUI
- Open the WebUI in your browser and create the first administrator account.
- Go to Settings → Admin → Connections → Manage Ollama API Connections.
- Enter the correct base URL for your layout and save it.
- Check the model list. It should contain
phi3after the pull completes. - Start a new chat, select Phi-3 and send a short prompt. Confirm that streaming output appears before exposing the service to other users.
If the list remains empty, check the URL from inside the WebUI container and confirm that the pull completed in the same Ollama environment. A working browser connection to Open WebUI alone does not establish a working model connection.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Put the interface behind HTTPS
Use a reverse proxy such as the one already operated in your server environment to terminate TLS and forward requests to 127.0.0.1:3000 (or the internal WebUI service). Configure:
- Automatic certificate issuance and renewal for your domain.
- WebSocket forwarding, because interactive sessions and streaming responses may use upgraded connections.
- Generous streaming and idle timeouts. A proxy that times out long generations makes chats appear frozen.
- Authentication, rate limits and access logs appropriate to your users.
- No route from the public Internet to Ollama’s 11434 endpoint.
Test both a normal page load and a long response through the proxy. If the page loads but generation hangs, inspect WebSocket handling and proxy buffering/timeouts before changing the model.
Use HTTPS even for a small private deployment when it is accessed outside the VPS. It protects credentials and chat traffic in transit. Restrict administrative access separately where your proxy supports it, and review access logs for unexpected requests or sustained generation activity.
Persistence, backups and upgrades
Back up both volumes. The Ollama volume contains model files; the Open WebUI volume contains chats, users and settings. Backing up only the WebUI volume does not preserve the model, and backing up only Ollama does not preserve conversations.
Before a major upgrade, stop or quiesce writes as appropriate for your backup method, create restorable copies of both volumes, and record the image tags and environment variables. A simple update cycle is:
docker compose pull
docker compose up -dAfterward, verify that both containers are healthy, ollama list still shows phi3, the WebUI can connect, and an existing chat opens. Anonymous container storage is not a backup strategy; explicitly mount the named volumes shown above.
Test a restore periodically rather than assuming a backup is usable. Restore into a temporary project or replacement host, confirm that the model appears and that an existing chat opens, then record the procedure. Keep enough disk space for image layers during an update, and remove obsolete images only after the new deployment has been validated.
Recommended Free Tools
Troubleshoot the common failures
Phi-3 is missing from the model selector
- Run
ollama listin the same environment where Ollama runs and confirm the exact namephi3. - Check
OLLAMA_BASE_URLfor the correct host, service name and port. - Confirm that the WebUI container can resolve and reach Ollama on the Docker network or host-gateway address.
- Restart or reload the connection after the pull finishes.
Connection refused
Check whether Ollama is listening only on loopback while the WebUI is in another network namespace. Inspect container DNS, host firewall rules and the listener address. In a separated Compose setup, use http://ollama:11434, not a host address.
The chat hangs behind a proxy
Verify WebSocket forwarding, streaming support, proxy buffering and read/idle timeouts. Test the WebUI directly on its private port to distinguish a proxy problem from an Ollama or model problem.
Chats or models disappeared after an update
Inspect the container mounts. Open WebUI must mount /app/backend/data; Ollama must mount /root/.ollama. Recreating a container without those named volumes starts with empty storage. Restore the appropriate volume backup if it was deleted.
Responses are slow or run out of memory
Reduce context length and simultaneous requests, then observe memory and swap usage. Swap can prevent an immediate crash but may make generation extremely slow and should be used cautiously. If the workload still exceeds the host, move to a larger VPS or a GPU machine. Parameter count alone cannot predict the required capacity.
Recommended Free Tools
GPU use is no faster than CPU
Confirm that the VPS actually allocated a GPU, that the host driver and NVIDIA container runtime are installed, and that the selected CUDA-capable container can see the device. A CUDA image alone does not create GPU access. Compare the same prompt and concurrency under an observed workload before deciding whether the added cost is worthwhile.
Compare the main choices before you scale
| Decision | Option A | Option B | Choose based on |
|---|---|---|---|
| Inference hardware | CPU-only | GPU with CUDA | CPU simplicity and lower cost versus lower latency under concurrency |
| Packaging | Separate Ollama and WebUI services | Bundled :ollama image |
Independent upgrades and troubleshooting versus fewer moving parts |
| Audience | Private single-user access | Multi-user public access | Basic account protection versus stronger proxy controls, monitoring and capacity |
| Networking | Internal Docker connection | Remote Ollama server | Simple private DNS versus secured private routing and firewall policy |
| Storage | Local persistent disk | Backed-up or replicated storage | Convenience versus recovery from disk or host failure |
For a first deployment, separate containers on one VPS provide a clear failure boundary and an easy upgrade path. A bundled image is reasonable when simplicity matters more than independent lifecycle control.
Revisit the choice when your usage changes. Moving from a private single-user setup to a public service changes the security, monitoring, backup and capacity requirements even if the model remains Phi-3. Moving Ollama to another server can free GPU resources, but it adds network latency and requires a secured remote connection.
Operational checklist
- Phi-3 was pulled with the documented
phi3name and appears inollama list. - Open WebUI’s stable secret is stored outside the Compose file’s public repository.
- Both
/root/.ollamaand/app/backend/dataare persistent volumes. - Only the reverse proxy is Internet-facing; port 11434 is private.
- HTTPS, authentication, WebSocket forwarding and streaming timeouts are tested.
- Backups of both volumes have been created and a restore procedure is documented.
- CPU/GPU choice is based on observed latency, context and concurrency rather than an assumed minimum.
- Image tags and update dates are recorded so a rollback is possible.
- Current provider pricing, regions, GPU availability and storage terms have been checked.
Frequently Asked Questions
How do I run Phi-3 on my own VPS?
Install Ollama on the VPS or run it in Docker, pull the documented model with ollama pull phi3, then connect Open WebUI to Ollama’s port 11434. Keep the model directory persistent and expose only Open WebUI through an HTTPS reverse proxy.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhy does Open WebUI show no models?
Open WebUI does not include models. Run ollama list where Ollama is installed, confirm phi3 is present, and verify OLLAMA_BASE_URL points to the correct service name, host-gateway address or private remote URL.
Can Phi-3 run without a GPU?
Yes. Phi-3 Mini can run with CPU inference, which is usually simpler and cheaper. A GPU is an option when concurrent users or response latency justify CUDA, the NVIDIA runtime/toolkit and a compatible provider.
What VPS size does Phi-3 require?
The cited documentation does not establish a universal minimum RAM or vCPU count. Size from context length, concurrency, latency goals and other services on the host. The 2.3 GB download is not the complete runtime memory requirement.
Should Ollama port 11434 be public?
Normally no. Keep it on the private Docker network, a private interface or a firewall-restricted link. Expose it publicly only for a deliberate remote-client design with authentication and network controls.
Free tools Windows power users keep installed
One-click scans. No signup required.
Where are chats and models stored?
Mount Ollama’s model directory at /root/.ollama and Open WebUI’s application data at /app/backend/data. Back up both volumes because one contains model files and the other contains users, chats and settings.
What does WEBUI_SECRET_KEY do?
It is the stable secret used for Open WebUI session handling. Generate it before the first production start, keep it private and avoid changing it casually because existing sessions can be invalidated.
Why does a chat hang only when accessed through my proxy?
Check WebSocket forwarding, streaming support, proxy buffering and read or idle timeouts. Test the WebUI on its private port to separate a proxy fault from an Ollama, network or model fault.
The Bottom Line
For most first deployments, run separate Ollama and Open WebUI containers on one Linux VPS, pull phi3 into a persistent Ollama volume, store WebUI data in its own volume, and connect them over a private Docker network. Put only Open WebUI behind an HTTPS reverse proxy, keep port 11434 closed, and choose CPU or GPU capacity from measured context, concurrency and latency needs. Back up both volumes before upgrades so your model files and conversations can be restored together.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
