How to Install Ollama on Windows, Mac and Linux, Safely

Install Ollama only from ollama.com, docs.ollama.com and github.com/ollama/ollama. On Windows, run the signed OllamaSetup.exe (no administrator rights needed); on a Mac, drag the app from Ollama.dmg into Applications; on Linux, run Ollama's install script after reading it, or extract the release tarball by hand. Then check what you downloaded, leave the API bound to 127.0.0.1:11434, and keep it updated.

"How to install Ollama" now sits next to the biggest developer tools in search autocomplete, and most answers stop at "it runs a model". This guide goes further. Every command below comes from Ollama's own documentation, its install scripts or its GitHub repository, fetched on 23 October 2026, plus Docker and Microsoft docs where a step needs them.

Key takeaways

• Ollama's official surfaces are ollama.com, docs.ollama.com and github.com/ollama/ollama. On 23 October 2026 the ollama.com download links redirected to GitHub release assets.
• The local API listens on 127.0.0.1 port 11434 by default, and Ollama's docs say the local API does not require authentication. Anyone who can reach that port can use it, so keep it on loopback unless you put access control in front.
• The Linux install script needs root, creates an ollama system user, writes a systemd service and, on machines with an NVIDIA GPU and no working driver, adds NVIDIA's package repository and installs CUDA drivers. Read it first, or use the manual install.
• Every GitHub release carries a sha256sum.txt covering installers, tarballs and both install scripts. On Windows, also check the Authenticode signer is Ollama Inc.
• Model files are parser input. CVE-2026-7482, a GGUF loader memory read flaw fixed in 0.17.1, is the reminder. Pull models only from publishers you trust.
• Windows and macOS update themselves; Linux updates by re-running the script. Two 2026 Windows updater CVEs affected 0.12.10 through 0.17.5.
• Uninstalling on Linux means removing the service, binary, libraries, the ollama user and group, and /usr/share/ollama, which is where the models live.

What does Ollama install on each operating system?

Ollama runs open weight language models locally: a server (ollama serve) with an HTTP API, the ollama CLI, and on Windows and macOS a desktop app that runs the server and handles updates. Models can be tens to hundreds of gigabytes.

Local models and cloud models are different things

Ollama's download page describes local models and cloud models that run on Ollama's servers (their names end in :cloud). If your policy is local only, Ollama documents a switch for that, covered in the settings section.

How to install Ollama on Windows, step by step

Step 1: Check the requirements

Ollama's Windows page lists Windows 10 22H2 or newer (Home or Pro), NVIDIA driver 551.61 or newer if you have an NVIDIA card, and for AMD Radeon either a ROCm v7 capable driver stack or a Vulkan capable driver. The binaries need at least 4 GB of disk, and models need much more.

Step 2: Get the installer from ollama.com

Go to ollama.com/download and choose Windows. You have two official routes.

The graphical route is OllamaSetup.exe. On 23 October 2026, https://ollama.com/download/OllamaSetup.exe returned a redirect to https://github.com/ollama/ollama/releases/latest/download/OllamaSetup.exe, so the file comes from Ollama's GitHub release either way.

The scripted route, shown on the download page, runs Ollama's PowerShell installer:

irm https://ollama.com/install.ps1 | iex

That one line downloads and runs a script, so it is worth knowing what the script does. We read install.ps1 as served on 23 October 2026. It downloads OllamaSetup.exe to your temp folder, then calls Get-AuthenticodeSignature on it and stops with "Installer signature verification failed" unless the status is Valid and the signer certificate subject contains exactly O=Ollama Inc.. Only then does it run the installer silently with /VERYSILENT /NORESTART /SUPPRESSMSGBOXES. The script itself also carries an Authenticode signature block.

The script header documents three environment variables you can set first:

$env:OLLAMA_VERSION="0.5.7"; irm https://ollama.com/install.ps1 | iex
$env:OLLAMA_INSTALL_DIR="D:\Ollama"; irm https://ollama.com/install.ps1 | iex
$env:OLLAMA_UNINSTALL=1; irm https://ollama.com/install.ps1 | iex

The first pins a version (0.5.7 is Ollama's own example, not a recommendation), the second installs to a different drive, and the third uninstalls. If you would rather read the script before it runs, download it, open it in an editor, and compare its hash with the install.ps1 line in the release's sha256sum.txt (see the verification section).

Step 3: Install per user, or to another drive

The installer does not need administrator rights and installs into your home directory by default. To put the application somewhere else, start the installer with Ollama's documented flag:

OllamaSetup.exe /DIR="d:\some\location"

This moves the program files only. Models are controlled separately by OLLAMA_MODELS, covered below, which is the answer to "how to install Ollama on a different drive" for most people because the models are the large part.

Step 4: Confirm it works

After install, Ollama runs in the background and the ollama command is available in cmd, PowerShell or Windows Terminal. Check the version and pull a small model:

ollama -v
ollama run gemma4:e2b

Ollama's Windows page also shows a quick API check from PowerShell against http://localhost:11434/api/generate. Note the address: localhost, not your machine's network IP.

The standalone Windows CLI for services

For running Ollama as a Windows service, the Windows docs describe a standalone ollama-windows-amd64.zip (CLI and NVIDIA libraries, with separate AMD and MLX packages) that you run with ollama serve under a service wrapper. It has no auto update, so you own patching.

How to install Ollama on a Mac, step by step

Requirements

Ollama's macOS page lists macOS Sonoma (14) or newer. Apple M series Macs get CPU and GPU support; Intel Macs run CPU only. Docker Desktop on macOS cannot pass the GPU through, according to Ollama's FAQ, so run Ollama natively on a Mac if you want GPU speed.

Interactive install

1. Download Ollama.dmg from ollama.com/download. On 23 October 2026 that link redirected to the latest GitHub release asset.
2. Mount the image and drag Ollama into the system wide Applications folder, which is the method Ollama's docs prefer.
3. Start Ollama. On first launch the app checks that the ollama CLI is on your PATH and, if not, asks permission to create a link in /usr/local/bin.

Command line install

The macOS tab on ollama.com/download shows the same one liner as Linux:

curl -fsSL https://ollama.com/install.sh | sh

Reading the script shows what happens on a Mac. It stops a running Ollama, deletes any existing /Applications/Ollama.app, downloads Ollama-darwin.zip from ollama.com, unzips it into /Applications, creates the /usr/local/bin/ollama link (using sudo only if needed), and launches the app hidden unless you set OLLAMA_NO_START. It does not verify a checksum of the zip itself. If you want that check, download Ollama-darwin.zip or Ollama.dmg from the GitHub release and compare it with sha256sum.txt before installing.

How to install Ollama on Linux (Ubuntu, Debian, Fedora and servers)

The install script, and what it actually does

Ollama's Linux page gives one command:

curl -fsSL https://ollama.com/install.sh | sh

On a server you should know exactly what that runs. We read install.sh as served on 23 October 2026. Its SHA-256 matched the install.sh asset in the v0.40.9 GitHub release. In order, it:

1. Wraps everything in a main function so a truncated download does not run half a script.
2. Maps uname -m to amd64 or arm64 and stops on any other architecture. It rejects WSL 1 and tells you to move the distribution to WSL 2.
3. Requires root, or uses sudo if you are not root.
4. Picks a bin directory from /usr/local/bin, /usr/bin or /bin, deletes any old lib/ollama beside it, and downloads and extracts ollama-linux-<arch>.tar.zst (it needs zstd).
5. On NVIDIA Jetson boards, downloads the JetPack 5 or 6 package.
6. If systemd is present, creates an ollama system user and group with home /usr/share/ollama and no login shell, adds that user to the render and video groups if they exist, adds your user to the ollama group, writes /etc/systemd/system/ollama.service, and enables and starts it.
7. Looks for a GPU. If it finds an AMD GPU it downloads the ROCm package. If it finds an NVIDIA GPU without a working CUDA driver, it adds NVIDIA's package repository (with dnf, yum or apt-get), installs cuda-drivers, installs kernel headers, and on Debian enables the contrib component in your apt sources. It may then ask you to reboot.
8. Prints "The Ollama API is now available at 127.0.0.1:11434."

Step 7 surprises people on production hosts. If configuration management owns your GPU drivers, install them first so the script finds them, or use the manual install.

To review before running, download the script to a file, read it, then run it:

curl -fsSL https://ollama.com/install.sh -o install.sh
less install.sh
sh install.sh

To install a specific version, including a pre-release, Ollama documents:

curl -fsSL https://ollama.com/install.sh | OLLAMA_VERSION=0.5.7 sh

The manual install, without the script

Ollama's Linux page documents a manual route that gives you full control. If you are upgrading, Ollama says to remove the old libraries first with sudo rm -rf /usr/lib/ollama.

Download and extract the package:

curl -fsSL https://ollama.com/download/ollama-linux-amd64.tar.zst \
    | sudo tar x -C /usr

For an AMD GPU, also extract the ROCm package; on ARM64, use the ARM64 package instead:

curl -fsSL https://ollama.com/download/ollama-linux-amd64-rocm.tar.zst \
    | sudo tar x -C /usr

curl -fsSL https://ollama.com/download/ollama-linux-arm64.tar.zst \
    | sudo tar x -C /usr

Piping straight into tar means you cannot check a hash first. The verification section below shows the same extraction from a file you have already checked.

Then test it in the foreground, and confirm the version from a second terminal:

ollama serve
ollama -v

Running it as a service (recommended by Ollama)

Create the service account and add yourself to its group:

sudo useradd -r -s /bin/false -U -m -d /usr/share/ollama ollama
sudo usermod -a -G ollama $(whoami)

Create /etc/systemd/system/ollama.service:

[Unit]
Description=Ollama Service
After=network-online.target

[Service]
ExecStart=/usr/bin/ollama serve
User=ollama
Group=ollama
Restart=always
RestartSec=3
Environment="PATH=$PATH"

[Install]
WantedBy=multi-user.target

Then load, enable and start it:

sudo systemctl daemon-reload
sudo systemctl enable ollama
sudo systemctl start ollama
sudo systemctl status ollama

Running as a dedicated non login user is the right default. Two consequences follow. Your user is added to the ollama group, which matters for file access to its home directory, so do not add people to that group casually on a shared machine. And because models live under /usr/share/ollama, deleting that directory deletes every model.

GPU driver prerequisites on Linux

Ollama's Linux page links NVIDIA's CUDA download page and AMD's ROCm quick start. It also notes that the in kernel amdgpu driver may lag behind and recommends AMD's current Linux driver for Radeon cards.

Ubuntu Server and WSL 2

On Ubuntu Server the steps are the same. On WSL 2 without systemd, the script warns and creates no service, so you start ollama serve yourself.

How do you verify the Ollama download?

Download sources are only half of the story. The other half is checking that the bytes you are about to run are the bytes Ollama published.

SHA-256 checksums from the GitHub release

Each GitHub release has a sha256sum.txt asset. For v0.40.9, released 22 October 2026, it lists 16 files: OllamaSetup.exe, Ollama.dmg, Ollama-darwin.zip, ollama-darwin.tgz, the Linux amd64, arm64, ROCm, MLX and JetPack tarballs, the Windows zips, and both install.sh and install.ps1. GitHub's release API also shows a sha256: digest for each asset.

On Linux, download the tarball and the checksum file from the same release, check, then extract from the verified file:

curl -fsSLO https://github.com/ollama/ollama/releases/download/v0.40.9/ollama-linux-amd64.tar.zst
curl -fsSLO https://github.com/ollama/ollama/releases/download/v0.40.9/sha256sum.txt
sha256sum --ignore-missing -c sha256sum.txt
sudo tar x -C /usr < ollama-linux-amd64.tar.zst

sha256sum prints OK next to each file it found and checked. The last line is Ollama's documented sudo tar x -C /usr, fed from the checked file instead of from curl. Replace v0.40.9 with the release you are installing.

On a Mac:

shasum -a 256 Ollama.dmg

Compare the output with the Ollama.dmg line in sha256sum.txt.

On Windows, Microsoft's Get-FileHash does the same job:

Get-FileHash .\OllamaSetup.exe -Algorithm SHA256

A checksum only proves the file matches the release page, so make sure the release page is github.com/ollama/ollama.

Signatures on Windows and macOS

On Windows, check the installer's Authenticode signature with Microsoft's cmdlet before running it:

Get-AuthenticodeSignature .\OllamaSetup.exe | Format-List Status, SignerCertificate

Look for Status : Valid and a signer subject that includes O=Ollama Inc.. That is the same test Ollama's own install.ps1 applies. A NotSigned or HashMismatch status means stop.

On macOS, Gatekeeper checks apps from outside the App Store when you open them. Apple's guidance is that macOS checks the Developer ID signature to confirm the software comes from an identified developer and has not been altered, and by default also requires notarization. If macOS warns that Ollama cannot be checked or is damaged, delete that copy and download it again from ollama.com rather than overriding the warning. Ollama's docs do not state the Mac app's signing status, so rely on the Gatekeeper result you see.

Verify the running install

ollama -v
ollama ps

ollama -v should print the version you meant to install. ollama ps shows what models are loaded and, in the PROCESSOR column, whether each runs on GPU, CPU or both.

How do you avoid fake Ollama downloads and lookalike sites?

Popular AI tools attract search ads, lookalike domains and repackaged builds. The defence:

• Start from a typed address. ollama.com, docs.ollama.com and github.com/ollama/ollama are the official surfaces. Ollama's own pages link between them.
• Prefer links that resolve to GitHub releases. On 23 October 2026, the three download links we tested on ollama.com (Windows, Mac and Linux) each returned a 307 redirect to github.com/ollama/ollama/releases/latest/download/. A file from anywhere else is not the official build.
• Check the hash and the signature as shown above, every time, not just the first time.
• Be wary of one liners in videos and gists. The official one liners are curl -fsSL https://ollama.com/install.sh | sh and irm https://ollama.com/install.ps1 | iex. Anything that pipes a different domain into a shell is someone else's code.

Which models should you trust, and where should you pull them from?

A model is not just data. Ollama parses the model file (GGUF or Safetensors), loads it into memory and runs it, and a malformed file is input to that parser. CVE-2026-7482, published on 4 May 2026, describes a heap out of bounds read in Ollama's GGUF loader before version 0.17.1: a crafted GGUF file sent through /api/create could make the server read past its buffer, and the CVE record says leaked memory could include environment variables, API keys, system prompts and other users' conversations. The fix shipped in 0.17.1. Our post on CVE-2026-7482, the "Bleeding Llama" memory leak covers it in depth.

Per Ollama's docs, ollama pull and ollama run download from the model library on ollama.com; user published models carry the publisher's username (the import guide's example is jmorganca/mymodel); you can build a model from a local GGUF or Safetensors file with a Modelfile FROM line and ollama create; and ollama show --modelfile prints the FROM line with the blob's sha256- digest.

Ollama's documentation pages we fetched do not describe a review or scanning process for models that users push, so we make no claim either way. Practical rules that follow from what is documented:

1. Decide who you trust by namespace. A model under a person's username is that person's upload. Treat it like any third party download.
2. Know the origin of every GGUF you import. See our guide on vetting a model before you download it.
3. Record digests. ollama ls lists each model's ID, and ollama show --modelfile shows the blob digest. Keep those in your inventory so you know what ran.
4. Do not let untrusted clients create models. /api/create was the entry point for CVE-2026-7482. If the API is reachable by others, they can create models.
5. Stay patched. Parser bugs are fixed in new releases; an old Ollama with a new model file is the risky combination.

How do you keep the Ollama API off the network?

This is the setting that matters most. Ollama's FAQ: "Ollama binds 127.0.0.1 port 11434 by default." Its authentication page: "The local API at http://localhost:11434 does not require authentication." On loopback, only processes on the same machine can reach the API. Bound to 0.0.0.0, anyone who can route to port 11434 can run, pull and create models on your hardware and reach endpoints that, as CVE-2026-7482 showed, have had memory safety bugs. Ollama's SECURITY.md asks users to secure access to hosted instances.

How OLLAMA_HOST works on each OS

OLLAMA_HOST sets the bind address. You do not need to set it at all for local use. If you need to change it, here is where it goes, per Ollama's FAQ.

On Linux with systemd:

systemctl edit ollama.service

Add under [Service]:

[Service]
Environment="OLLAMA_HOST=127.0.0.1:11434"

Then:

systemctl daemon-reload
systemctl restart ollama

On macOS, for the app:

launchctl setenv OLLAMA_HOST "127.0.0.1:11434"

Then restart the Ollama app. On Windows, quit Ollama from the taskbar, set OLLAMA_HOST under "Edit environment variables for your account", and start Ollama again from the Start menu.

Ollama's FAQ examples use 0.0.0.0:11434 because they answer "how can I expose Ollama?". We show the safe default. Use 0.0.0.0 only behind a firewall rule or an authenticating proxy.

If you must reach Ollama from another machine

Ollama's FAQ shows an Nginx example that forwards to a loopback bound Ollama. As written it adds no authentication, so add the access control your proxy supports. Treat any tunnel URL as public unless the tunnel enforces login.

Our longer guide on binding Ollama to localhost or the network safely covers proxy and firewall patterns in detail.

The container trap

Ollama's Docker page starts the CPU container like this:

docker run -d -v ollama:/root/.ollama -p 11434:11434 --name ollama ollama/ollama

The -p 11434:11434 flag publishes the container's port on every interface of the host. Docker's port publishing docs say that if you include the localhost address with the publish flag, only the Docker host can reach the port. So for a single machine:

docker run -d -v ollama:/root/.ollama -p 127.0.0.1:11434:11434 --name ollama ollama/ollama

Docker's docs add a warning that in releases older than 28.0.0, hosts on the same layer 2 segment could reach ports published to localhost, so keep Docker current too. On Linux, also check how Docker's published ports interact with your host firewall before you rely on it.

Browser origins

Ollama's FAQ says browser requests from 127.0.0.1 and 0.0.0.0 origins are allowed by default, and OLLAMA_ORIGINS adds more. The FAQ shows how to allow every browser extension at once; allow only the specific extension origin you use instead.

How to check you are not exposed

After any change, restart Ollama and read the log for errors. On Linux:

journalctl -e -u ollama

Then, from a second machine, try port 11434 on this host's address. With the default bind it should be refused.

How to change the model directory and other settings

Store models on a different drive

OLLAMA_MODELS sets the model store. On Windows, set it as a user environment variable (Settings, search "environment variables", "Edit environment variables for your account"), then quit the tray app and relaunch it. On Linux, add it to the service the same way as OLLAMA_HOST:

[Service]
Environment="OLLAMA_MODELS=/data/ollama/models"

Ollama's FAQ notes that with the standard Linux installer, the ollama user needs read and write access to the new directory:

sudo chown -R ollama:ollama /data/ollama/models

Then run systemctl daemon-reload and systemctl restart ollama. On a Mac, set it with launchctl setenv and restart the app.

Do not point it at a shared or world writable location: anyone who can write there can change what your server loads.

Settings that affect security or exposure

To see every environment variable your version accepts, run ollama serve --help.

The local only switch in ~/.ollama/server.json:

{
  "disable_ollama_cloud": true
}

Restart Ollama afterwards and check the log for the confirmation line.

Your Ollama key

After ollama signin, your instance uses a key pair to talk to ollama.com; the FAQ puts the public key at ~/.ollama/id_ed25519.pub on macOS and /usr/share/ollama/.ollama/id_ed25519.pub on Linux. Treat the .ollama directory as sensitive and run ollama signout on machines you hand back.

How to keep Ollama patched

How updates arrive on each OS

Ollama's FAQ explains the mechanism. On macOS and Windows, the app downloads updates automatically; you click the menu bar or taskbar icon and choose "Restart to update". You can also download the latest version manually from ollama.com. On Linux, re-run the install script:

curl -fsSL https://ollama.com/install.sh | sh

or re-extract the tarball (remove /usr/lib/ollama first, per the manual install note):

curl -fsSL https://ollama.com/download/ollama-linux-amd64.tar.zst \
    | sudo tar x -C /usr

On Windows, %LOCALAPPDATA%\Ollama\upgrade.log records update activity, which is useful when you need to prove a machine actually updated.

Why the updater itself has been a target

On 29 April 2026, CERT Polska published two vulnerabilities in Ollama for Windows, both listed as affecting versions 0.12.10 through 0.17.5:

• CVE-2026-42248: the Windows update verification routine returned success without checking any signature, and because updates install silently, a tampered update could install unnoticed.
• CVE-2026-42249: the updater built file paths from HTTP response headers without validation, allowing path traversal outside the staging directory.

Both advisory descriptions involve an attacker who can tamper with or influence the update download. Neither the CVE records nor the CERT Polska advisory name a fixed version, so we will not either. Ollama's current release on 23 October 2026 was v0.40.9, well past the affected range, but check the release notes rather than assuming. Our posts on CVE-2026-42248, unsigned Windows updates and CVE-2026-42249, update path traversal have the detail.

If ollama -v on Windows shows a version in the 0.12.10 to 0.17.5 range, reinstall from a signature checked OllamaSetup.exe rather than relying on the updater.

A simple patch routine

1. Watch github.com/ollama/ollama/releases and the repository's security advisories.
2. Inventory where Ollama runs: laptops, GPU servers, containers. Containers update only when you pull a new ollama/ollama image and recreate them.
3. On Linux servers, pin with OLLAMA_VERSION if you need change control, and move the pin on a schedule.
4. After updating, check ollama -v on every host. A desktop app that downloaded an update but was never restarted is still on the old version.

How to uninstall Ollama cleanly

Windows

Ollama registers an uninstaller. Use Settings, then Add or remove programs, then Ollama. You can also use the script variable documented in install.ps1:

$env:OLLAMA_UNINSTALL=1; irm https://ollama.com/install.ps1 | iex

If you set OLLAMA_MODELS to a custom location, the uninstaller will not remove those models; delete that folder yourself. Check %HOMEPATH%\.ollama and %LOCALAPPDATA%\Ollama for leftovers, and remove the OLLAMA_HOST, OLLAMA_MODELS and similar variables from your account.

macOS

Ollama's macOS page lists these removals:

sudo rm -rf /Applications/Ollama.app
sudo rm /usr/local/bin/ollama
rm -rf "$HOME/Library/Application Support/Ollama"
rm -rf "$HOME/Library/Saved Application State/com.electron.ollama.savedState"
rm -rf ~/Library/Caches/com.electron.ollama/
rm -rf ~/Library/Caches/ollama
rm -rf ~/Library/WebKit/com.electron.ollama
rm -rf ~/.ollama

One correction: Ollama's page writes two of these paths as "~/Library/..." inside double quotes. The shell does not expand ~ inside quotes, so those two lines would silently do nothing. We changed them to "$HOME/Library/...", which keeps the quotes for the spaces in the path and expands correctly. Also unset any variables you set with launchctl setenv. The last line deletes all your models.

Linux

Ollama's Linux page gives the full sequence. Stop and remove the service:

sudo systemctl stop ollama
sudo systemctl disable ollama
sudo rm /etc/systemd/system/ollama.service

Remove the libraries and the binary:

sudo rm -r $(which ollama | tr 'bin' 'lib')
sudo rm $(which ollama)

Run which ollama on its own first and read the path it prints, because both commands act on it.

Remove the models, the service user and the group:

sudo userdel ollama
sudo groupdel ollama
sudo rm -r /usr/share/ollama

If you moved models with OLLAMA_MODELS, delete that directory too, and remove any override.conf under /etc/systemd/system/ollama.service.d/. If the install script added NVIDIA's repository and drivers, those stay; remove them only if nothing else on the machine needs the GPU.

Containers

Stop and remove the container, then remove the ollama named volume, which holds the models.

Common Ollama install errors and how to fix them

GPU not detected, or everything runs on CPU

Run ollama ps. If it shows 100% CPU, check the server log. On Linux, Ollama's troubleshooting page suggests nvidia-smi, sudo nvidia-modprobe -u, reloading with sudo rmmod nvidia_uvm then sudo modprobe nvidia_uvm (also the fix after suspend and resume), rebooting, and updating the driver. For AMD, check membership of the render and video groups and the ROCm driver version; an old ROCm 6 driver makes discovery time out and fall back to CPU. On Windows, check you meet the NVIDIA 551.61 driver minimum, and on some RX 6000 class cards rely on Vulkan, which Ollama enables by default.

Port 11434 already in use

Usually a second Ollama is already running, such as the app or service plus a manual ollama serve. Stop one. Do not "fix" it by binding a second instance to 0.0.0.0.

"Could not connect to ollama app" or "is it running?"

The CLI is a client; it needs the server. On Windows and macOS, start the Ollama app. On Linux, check sudo systemctl status ollama and read journalctl -u ollama --no-pager --follow --pager-end. If you changed OLLAMA_HOST on the server, check that the client you are using points at the address the server now listens on.

Out of memory, or the model loads very slowly

Ollama's FAQ explains that parallel requests multiply context memory and that models stay loaded for 5 minutes by default. Use a smaller model, lower OLLAMA_NUM_PARALLEL or OLLAMA_MAX_LOADED_MODELS, and unload with ollama stop <model>.

Linux: /tmp is mounted noexec

Set OLLAMA_TMPDIR to a directory the Ollama user can write, such as /usr/share/ollama/, per the troubleshooting page.

Model pulls fail behind a corporate proxy

Set HTTPS_PROXY and install the proxy certificate as a system certificate. Ollama says not to set HTTP_PROXY.

Where Safeguard fits, honestly

Safeguard does not install Ollama, verify its installers, inspect model files or monitor port 11434. Everything above works without it, and we make no claim that Safeguard scans models. The link is what happens when Ollama becomes part of software you ship. Teams build applications on Ollama's official Python or JavaScript client libraries, or package the ollama/ollama image into their own containers. Those libraries and images bring their own dependencies and their own CVEs. Safeguard scans repositories, container images and SBOM files (for example safeguard scan --dir . or safeguard scan --image <name> from the CLI, with results written as JSON under ./output), matches components against vulnerability databases, and shows which of your projects contain a given component and version. With autonomous remediation switched on, it can open fix pull requests that move a vulnerable dependency to a safe version, and Gold Open Source gives you the safe version for a CVE without a login.

Common mistakes

• Copying OLLAMA_HOST=0.0.0.0 from a tutorial. It removes the only barrier in front of an API that has no authentication. Keep the default, and add a proxy with access control if you need remote access.
• Running the container with -p 11434:11434. That publishes the API on every host interface. Use -p 127.0.0.1:11434:11434.
• Running curl | sh on a production GPU server without reading it. The Linux script can add NVIDIA's repository and install drivers. Read it first, or use the manual tarball install.
• Pulling any model with an attractive name. A username namespace is a third party upload. Know the publisher, and record digests.
• Assuming the desktop app is up to date. Updates apply on restart. Check ollama -v.
• Forgetting the models when uninstalling. On Linux they live in /usr/share/ollama; with a custom OLLAMA_MODELS they are wherever you put them.

FAQ

How do I install Ollama on Windows 11?

Download OllamaSetup.exe from ollama.com/download and run it; it installs in your account without administrator rights. Or run irm https://ollama.com/install.ps1 | iex in PowerShell, which downloads the same installer and refuses to run it unless its Authenticode signature is valid and from Ollama Inc. Windows 10 22H2 and later are supported.

How do I install Ollama on Ubuntu?

Run curl -fsSL https://ollama.com/install.sh | sh after reading the script, or download ollama-linux-amd64.tar.zst from the GitHub release, check it against sha256sum.txt, extract it to /usr, and create the ollama user and systemd service as shown above. The same steps work on Ubuntu Server.

How do I install Ollama on a different drive?

On Windows, run OllamaSetup.exe /DIR="d:\some\location" for the program, and set OLLAMA_MODELS as a user environment variable for the models, which take most of the space. On Linux, set OLLAMA_MODELS in the systemd service and chown the directory to ollama:ollama.

Is it safe to expose Ollama on my network?

Not on its own. Ollama's docs say the local API does not require authentication, and the default bind is 127.0.0.1:11434. If other machines need it, put a reverse proxy with authentication in front of a loopback bound Ollama, or restrict the port with a firewall to known hosts.

Is the Ollama install script safe?

It is Ollama's own script, served from ollama.com, and on 23 October 2026 it matched the install.sh hash in the GitHub release. It needs root, creates a service user and service, and may add NVIDIA's repository and drivers. Download it, read it and run it, or use the manual install if you want full control.

How do I update Ollama?

On Windows and macOS, the app downloads updates; click "Restart to update". On Linux, re-run the install script or re-extract the latest tarball. Confirm with ollama -v. For containers, pull the new image and recreate the container.

How do I completely uninstall Ollama on Linux?

Stop, disable and delete the systemd service, remove the binary and its lib/ollama directory, then run sudo userdel ollama, sudo groupdel ollama and sudo rm -r /usr/share/ollama. That last step deletes your models. Also remove any custom OLLAMA_MODELS directory and systemd override.

Can Ollama run without internet access?

Ollama runs models locally, and you can turn off its cloud features with OLLAMA_NO_CLOUD=1 or disable_ollama_cloud in ~/.ollama/server.json. You still need network access to download Ollama and to pull models, unless you import model files you already have with a Modelfile and ollama create.

Fix it without waiting for upstream

Ollama itself is a runtime you update from its own releases. The applications you build around it are a different matter: client libraries, web frameworks and base images that each carry their own vulnerabilities and their own maintainers' release schedules. That is where the following applies.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

None of these demos install Ollama or inspect models; they show the application side. To try the CLI yourself, download it from https://safeguard.sh/download and follow the setup guide at https://docs.safeguard.sh/docs/cli .

The first demo is a real CLI session. After install, safeguard opens the interactive terminal, you ask it to fix the lodash CVE in a repo, and it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing. The same approval flow applies to a JavaScript or Python app that calls a local Ollama server and carries a vulnerable dependency.

Click through it at your own pace, or open it full screen.

The second demo sets up the Safeguard runner on your own machine, approves it with its device code, and then scans from the terminal. On a local GPU box kept private, this is how you would scan its projects without sending source code elsewhere; see how the local runner and offline mode work.

Click through it at your own pace, or open it full screen.

The third demo shows the desktop app sending work to a computer running the CLI, with each command approved before it runs. On a shared GPU server that runs Ollama for a team, it keeps a person in charge of every command that touches that machine.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Ollama: Download page
• Ollama Docs: Linux
• Ollama Docs: Windows
• Ollama Docs: macOS
• Ollama Docs: FAQ
• Ollama Docs: Hardware support
• Ollama Docs: Troubleshooting
• Ollama Docs: Authentication
• Ollama Docs: API introduction
• Ollama Docs: CLI reference
• Ollama Docs: Docker
• Ollama Docs: Importing a model
• Ollama Docs: Modelfile reference
• Ollama Docs: Quickstart
• Ollama: install.sh
• Ollama: install.ps1
• Ollama on GitHub: Release v0.40.9
• Ollama on GitHub: v0.40.9 sha256sum.txt
• Ollama on GitHub: SECURITY.md
• CVE.org: CVE-2026-42248
• CVE.org: CVE-2026-42249
• CVE.org: CVE-2026-7482
• CERT Polska: Vulnerabilities in Ollama software (CVE-2026-42248, CVE-2026-42249)
• Docker Docs: Port publishing and mapping
• Microsoft Learn: Get-AuthenticodeSignature
• Microsoft Learn: Get-FileHash
• Apple Support: Safely open apps on your Mac

Last reviewed: 23 October 2026. Ollama ships releases often, and install scripts, supported versions and settings change between them; check the linked Ollama pages before you install.