Skip to main content
All configuration lives in .env (copy from .env.example). Variables are grouped from most-to-least-frequently-changed.

​
Required

VarDefaultPurpose
ADMIN_EMAILadmin@open-computer-use.devAdmin account created on first Open WebUI startup. Change.
ADMIN_PASSWORDchange-meAdmin password. Change.
WEBUI_SECRET_KEYchange-meOpen WebUI session signing. Generate with openssl rand -hex 32.
PUBLIC_BASE_URLhttp://localhost:8081Browser-reachable URL of the Computer Use Server. The single source of truth — baked into the system prompt and returned to the Open WebUI filter via the X-Public-Base-URL response header. Must match what the user’s browser can actually hit.
OPENAI_API_KEY—LLM provider key (any OpenAI-compatible).
OPENAI_API_BASE_URL—Override provider base URL (OpenRouter, Azure, LiteLLM, self-hosted vLLM).
MCP_API_KEY—Bearer token for the MCP endpoint. Leave empty for local dev; set for anything exposed beyond localhost.
POSTGRES_PASSWORDopenwebuiPostgreSQL password. Change for production.

​
Optional features

Each feature group is all-or-nothing — uncomment the full block to enable.

​
Vision (describe-image skill)

VISION_API_KEY=
VISION_API_URL=https://api.openai.com/v1
VISION_MODEL=gpt-4o

​
Claude Code sub-agent

ANTHROPIC_AUTH_TOKEN=
ANTHROPIC_BASE_URL=https://api.anthropic.com
Running through a corporate gateway (LiteLLM / Azure / Bedrock)? See Claude Code gateway recipe.

​
Settings Wrapper (per-user skills + PATs)

MCP_TOKENS_URL=
MCP_TOKENS_API_KEY=
The Settings Wrapper stores encrypted per-user Personal Access Tokens (GitLab, Jira, Confluence, …) and gates custom skills by user email. Optional — without it everyone gets the same 13 built-in skills.

​
Tuning

Change only if you know why.
VarDefaultEffect
MCP_PORT8081Computer Use Server port
OPENWEBUI_PORT3000Open WebUI port
DOCKER_IMAGEopen-computer-use:latestSandbox image tag
CONTAINER_MEM_LIMIT2gPer-sandbox memory cap
CONTAINER_CPU_LIMIT1.0Per-sandbox CPU cap
COMMAND_TIMEOUT120bash_tool wall-clock timeout (s)
SUB_AGENT_TIMEOUT3600Sub-agent wall-clock timeout (s)
SINGLE_USER_MODE(unset)See table below.
TOOL_RESULT_MAX_CHARS50000Truncate/upload threshold for oversized tool results.
TOOL_RESULT_PREVIEW_CHARS2000Size of preview the model sees after truncation.
SUB_AGENT_DEFAULT_MODELsonnetClaude Code default model name.
SUB_AGENT_MAX_TURNS25Sub-agent autonomy cap.
CONTAINER_MAX_AGE_HOURS24Idle-sandbox garbage collection.
DATA_MAX_AGE_DAYS7File retention under /data.

​
SINGLE_USER_MODE

ValueX-Chat-IdBehavior
unsetYesIsolated container per chat id
unsetNoShared default container + warning appended to every tool response
trueanyAlways one default container; header ignored
falseYesStrict: isolated container per chat id
falseNoReject with an error
Use true for Claude Desktop / single-user setups. Use false for production multi-user.

​
Gateway deploy (routing Claude through a proxy)

Leave all commented for the standard Anthropic API. Uncomment as a group when Claude Code goes through a gateway: 
ANTHROPIC_MODEL=
ANTHROPIC_DEFAULT_SONNET_MODEL=
ANTHROPIC_DEFAULT_OPUS_MODEL=
ANTHROPIC_DEFAULT_HAIKU_MODEL=
CLAUDE_CODE_SUBAGENT_MODEL=
CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=
DISABLE_PROMPT_CACHING=
DISABLE_PROMPT_CACHING_SONNET=
DISABLE_PROMPT_CACHING_OPUS=
DISABLE_PROMPT_CACHING_HAIKU=

​
Advanced

OPENWEBUI_VERSION=0.8.12           # pinned Open WebUI version for the build
ENABLE_OPENAI_API_SSL_VERIFY=true

​
Open WebUI container env (separate from the server)

These live on the open-webui service, not the Computer Use Server. They’re already set by docker-compose.webui.yml; you only set them yourself if you embed Open WebUI in your own compose/Kubernetes/Portainer stack:
VarDefaultEffect if unset
CHAT_RESPONSE_MAX_TOOL_CALL_RETRIES200Upstream default of 30 truncates multi-step tasks.
TOOL_RESULT_MAX_CHARS50000Large tool results truncate silently.
TOOL_RESULT_PREVIEW_CHARS2000Preview size after truncation/upload.
ORCHESTRATOR_URL(empty)Internal URL of the Computer Use Server. Seeded into both Tool and Filter valves by init.sh.
See Open WebUI integration for the full embedding checklist.