Community Apps

vLLM

By OrcVole

High-throughput OpenAI-compatible LLM inference server

0.32.0 10240MB Updated 22 Oct 2026
Package Website Documentation
ai llm inference openai
Install this app
In your Cloudron dashboard, open the App Store, choose "Community apps" and paste this URL:
https://raw.githubusercontent.com/OrcVole/vllm-cloudron/main/CloudronVersions.json

Description

0.32.0

vLLM is a high-throughput inference server for large language models with the most widely supported OpenAI-compatible API of the self-hosted options. This package runs it as a Cloudron app: one install serves one model at https://<location>/v1, protected by a generated API key, with weights cached locally and every OpenAI-style client able to connect unchanged.

This is CPU inference (amd64). It will not match GPU speed and it is not meant to: it gives integrations, automations and privacy-sensitive workloads a fully self-hosted OpenAI endpoint on the server you already run. Pair it with a chat frontend, an AI gateway, embeddings and a vector store to complete a private AI stack on Cloudron.

Unofficial community package. Not affiliated with the vLLM project or Cloudron.

Screenshot

Recent Changes

  • Base image cloudron/base 6.0.0 to 6.0.1: Ubuntu security updates, including the removal of the compromised eMudhra emSign ECC Root CA - G3 from the trusted certificates.

  • Update vLLM 0.31.0 to 0.32.0. Breaking changes from upstream's notes:

    • Default CORS origins are now none (they were every origin). A browser page on another origin

  • can no longer call the API unless the server is started with --allowed-origins (add it to

  • LLM_EXTRA_ARGS). Same-origin pages, including this package's landing page, and non-browser clients

  • are unaffected.

    • transformers>=5.16.1,<5.20.0 and tokenizers>=0.23.2 are required (the image ships transformers

  • 5.19.0 and tokenizers 0.23.3). Python 3.10 support is dropped; this package ships its own CPython 3.12.15.

    • Removed: cascade attention (--disable-cascade-attn now only warns), --mamba-cache-mode all, the

  • torch.compile sequence parallelism and AsyncTP passes. max_tokens is now an upper bound on output

  • rather than reserved from the context window.

  • Security (upstream's own Security section): fixes for GHSA-4hhp-h66f-j5j7 (chat template resource

  • exhaustion, #50300), GHSA-q97c-p368-75c4 (tokenizer max_token_id, #59491) and GHSA-frvg-qw88-hww9

  • (P2P ZMQ socket exhaustion, #51504); CORS no longer allows every origin by default (#61009); dependency

  • bumps including aiohttp>=3.14.3 and pillow>=12.3.0.

  • Fix: the store description showed the upstream version as 0.30.0; it now follows the manifest.