[GH-ISSUE #59] feat: Clean up orphaned persistent workspace data when a user is deleted in Open WebUI #32

New issue

Open

opened 2026-10-18 21:13:35 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-18 21:13:35 +00:00

Owner

Originally created by @scetu on GitHub (Sep 14, 2026).
Original GitHub issue: https://github.com/open-webui/terminals/issues/59

When a user account is deleted in Open WebUI, their persistent terminal workspace on the orchestrator host is never removed. On the Docker backend this is TERMINALS_DOCKER_DATA_DIR/<user_id> (plus <user_id>/contexts/ for per-chat contexts); on Kubernetes it's the per-user PVC. The orchestrator only learns about users at request time (JWT validation against Open WebUI), so a deletion is invisible to it and the data persists indefinitely.

Why

Data retention / GDPR-style policies require that a deleted user's personal data be deleted too. Today an operator has to manually find and delete the directory, which is easy to miss and leaves no audit trail.

Suggested approach

Periodic reconciliation in the reaper sweep: list workspace roots under the data dir (or per-user PVCs on K8s) and compare against the current Open WebUI user list (GET /api/v1/auths/ in JWT mode; for API-key mode, document that operators must supply the list or accept manual cleanup).
Quarantine before delete: move orphaned dirs to a quarantine/ location with a grace period (e.g. new setting TERMINALS_ORPHAN_RETENTION_DAYS, default 30) so accidental deletions and account re-creation are recoverable.
Log every quarantine/deletion (user id, path, size, timestamp) for audit.
Optional admin API + admin UI button: POST /api/v1/terminals/orphans/cleanup with a dry-run flag.

Originally created by @scetu on GitHub (Sep 14, 2026). Original GitHub issue: https://github.com/open-webui/terminals/issues/59 When a user account is deleted in Open WebUI, their persistent terminal workspace on the orchestrator host is never removed. On the Docker backend this is TERMINALS_DOCKER_DATA_DIR/<user_id> (plus <user_id>/contexts/<hash> for per-chat contexts); on Kubernetes it's the per-user PVC. The orchestrator only learns about users at request time (JWT validation against Open WebUI), so a deletion is invisible to it and the data persists indefinitely. # Why Data retention / GDPR-style policies require that a deleted user's personal data be deleted too. Today an operator has to manually find and delete the directory, which is easy to miss and leaves no audit trail. # Suggested approach - Periodic reconciliation in the reaper sweep: list workspace roots under the data dir (or per-user PVCs on K8s) and compare against the current Open WebUI user list (GET /api/v1/auths/ in JWT mode; for API-key mode, document that operators must supply the list or accept manual cleanup). - Quarantine before delete: move orphaned dirs to a quarantine/ location with a grace period (e.g. new setting TERMINALS_ORPHAN_RETENTION_DAYS, default 30) so accidental deletions and account re-creation are recoverable. - Log every quarantine/deletion (user id, path, size, timestamp) for audit. - Optional admin API + admin UI button: POST /api/v1/terminals/orphans/cleanup with a dry-run flag.

bsakaguchi referenced this issue

2026-10-18 21:13:50 +00:00

[PR #32] [CLOSED] Add Kubernetes scheduling overrides for terminal pods #55