Hi there 
I wanted for a long time to run Joplin a bit isolated on my machines. I know there is a firejail profile for Joplin, but I did not want to use a setuid program, so I ended up going for some bubblewrap based script.
I tried to restrict the scope - ubuntu 24 or newer, wayland only. The goals are:
- sandbox with bubblewrap
- run the appimage, checking that the latest is run, and that its checksum is ok
- have the joplin data mounted from the host so it is persistent
- have a joplin "data dropping" folder shared with the host to be able to exchange files
- otherwise, joplin cannot access anything more on the host - no reason joplin can read my whole system
- all assumptions checked in code and abort loudly on any issue
- for now no network limitation, but I think I will look in the future at limiting the sandbox network so it can only talk to the joplin cloud endpoint, nothing else - this is on my todo
The script has grown quite long (both a curse and a blessing being able to write code using agentic ai), but seems to work well so far.
Comments etc welcome, ideally on the github repo through issues / pull requests: see https://github.com/jerabaul29/config_scripts_snippets/tree/main/scripts/joplin .