Catalog / AI & LLM

vLLM + Open WebUI

High-throughput OpenAI-compatible LLM inference server with a browser chat UI

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace0.32.0↗ Azure Marketplace0.30.0↗
Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
0.32.0$0.05/hr
Recommended instance: m6i.xlarge · 5-day free trial
2026-10-25Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
0.30.0$0.028/vCPU/hr
Recommended VM: Standard_D4s_v3
2026-10-05Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseApache-2.0
UpstreamvLLM Team
Machine-readableproduct.json · catalog.json
What is vLLM + Open WebUI

vLLM is an open-source, high-throughput inference and serving engine for large language models, built in Python on top of PyTorch. It implements PagedAttention, continuous batching, and tensor parallelism to serve any HuggingFace-compatible transformer model (Llama, Mistral, Qwen, Phi, Gemma, OPT, GPT-J, MPT, Falcon, and 100+ more) through a fully OpenAI-compatible REST API. Any client built for OpenAI (openai-python, openai-node, LangChain, LlamaIndex, AnythingLLM, the OpenAI ChatGPT SDK) connects unchanged - just point the base URL at this instance and pass the local Bearer token. This image ships the CPU build of vLLM 0.26.0, bundled with Open WebUI 0.9.6 as a browser chat front end pre-wired to the local vLLM. Persists nothing externally - models cache to /var/lib/vllm/hf-cache, chats and accounts to /var/lib/open-webui. No vendor lock-in.

LICENSING NOTE

vLLM is Apache-2.0 licensed. Open WebUI is distributed under the source-available Open WebUI License (not an OSI-approved open-source license). The license permits self-hosted use without restriction; deployments with more than 50 end users in any 30-day window that also modify Open WebUI branding (name, logo) require a commercial Enterprise License from Open WebUI Inc. This image ships Open WebUI with the original branding preserved - the 50-user clause does not apply unless the operator rebrands.

What the Lynxroute image adds

Security hardening:

  • Random 32-byte API key generated at first boot, written to /root/vllm-credentials.txt - never baked into the image; the same key is injected into Open WebUI so the chat UI authenticates to vLLM transparently
  • vLLM API server bound to 127.0.0.1:8000 only - reachable only through Nginx with TLS, with --api-key Bearer auth enforced on every /v1/* request
  • Open WebUI bound to 127.0.0.1:8080 only - reachable only through Nginx with TLS
  • First registered user in Open WebUI becomes the workspace administrator; no admin baked in
  • Nginx reverse proxy with TLS, HTTP-to-HTTPS redirect, WebSocket upgrade for streaming chat, security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy)
  • Loading splash page served while the model warms up on first request
  • Anonymous telemetry disabled (VLLM_NO_USAGE_STATS, DO_NOT_TRACK, ANONYMIZED_TELEMETRY)
  • UFW firewall pre-configured - only TCP 22, 80, 443 are exposed; 8000 and 8080 explicitly denied
  • fail2ban, AppArmor
  • CVE scan - every image is scanned for vulnerabilities before release

Out of the box, with no external services:

  • Default tiny model facebook/opt-125m (~250 MB) loaded at first boot - chat and API work immediately, no HuggingFace token required
  • Swap to any HuggingFace-compatible model by editing /etc/vllm/server.env and restarting the service - no rebuild needed
  • No third-party LLM API keys baked in or required - everything runs on-instance

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/vllm-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-ub33kxqn3lfxi/latest \
  --instance-type m6i.xlarge --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer vllm --plan payg-gen2
az vm create -g my-rg -n vllm --size Standard_D4s_v3 \
  --image lynxroute:vllm:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

vLLM 0.32.0 + Open WebUI 0.12.4

AWS · 2026-10-25
  • vLLM upgraded to 0.32.0 (from 0.30.0) - OpenAI-compatible LLM inference server. The default model, the CPU runtime and the API endpoints this image exposes are unchanged. Apache-2.0 unchanged
  • Security (vLLM): fixes for chat-template resource exhaustion (GHSA-4hhp-h66f-j5j7) and a tokenizer bounds error (GHSA-q97c-p368-75c4); untrusted per-request multimodal options are refused by default; cross-origin browser calls to the API are no longer allowed by default (scripts and SDKs are unaffected)
  • Security (Open WebUI): bundled Open WebUI updated to 0.12.4 (from 0.11.4), with the channel message-spoofing fix (GHSA-3vvh-g22g-jq6r) and further upstream security and access-control fixes. Adds optional two-factor sign-in. Open WebUI is source-available under the Open WebUI License, not MIT: its branding may not be altered or removed in a deployment exceeding fifty end users in any rolling thirty-day period
  • Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build