This question comes up pretty often: “How can I access my Joplin notes remotely through a web browser or from another device?”
For me, exposing my notes directly to the public internet was not an acceptable option. Even if a web UI is password protected, it still creates another internet-facing service that could potentially be attacked or misconfigured.
Instead, I took a different approach: run a complete Joplin Desktop installation on an always-on server and remotely access the desktop over VNC.
The important part is that the VNC server is not exposed to the public internet. It is only reachable from my local network or through my VPN.
So rather than turning Joplin into a web application, this setup effectively gives me a small, always-on remote Joplin workstation that I can securely connect to from almost anywhere.
How it works
Joplin Desktop, including the full Electron application, runs inside a Docker container based on Ubuntu 24.04.
Because Joplin is a graphical application, the container also includes a lightweight desktop environment:
| Component | Purpose |
|---|---|
| Ubuntu 24.04 | Base operating system |
| Joplin Desktop | The actual Joplin application |
| Openbox | Lightweight window manager |
| Xvfb | Virtual display for running graphical applications headlessly |
| x11vnc | Makes the virtual desktop accessible through VNC |
| xfce4-terminal | Terminal access inside the desktop |
| Thunar | File manager |
| xfce4-taskmanager | Basic process/resource monitoring |
The container runs continuously on my server and Joplin syncs normally to my S3 sync target.
That makes the container essentially another Joplin computer — except it is always running and available remotely.
From a laptop, tablet, or phone, I simply connect with a VNC client and use the normal Joplin Desktop interface.
Why I consider this safer than exposing a web interface
The main security advantage is that the Joplin environment itself is never published to the internet.
Access is limited to devices that are either:
- connected to my local network, or
- connected to my private VPN.
There is no port-forwarding or public Joplin/VNC service required.
The setup also adds a few additional safeguards.
VNC authentication:
The VNC server requires a password configured through the VNC_PASSWORD environment variable in docker-compose.yml.
Non-root operation:
Joplin, Openbox, and x11vnc all run as an unprivileged joplin user inside the container rather than as root.
Pinned and verified software:
The Joplin package and Docker base image are pinned to specific versions. The Joplin .deb is verified against a SHA256 checksum during the build so the downloaded package must match the expected file.
None of those measures make a system magically immune to compromise, but they reduce the attack surface significantly compared with exposing another application directly to the public internet.
The VPN is effectively the security boundary.
Persistent Joplin data
Joplin's configuration and local database are stored in a Docker named volume:
joplin-config
It is mounted inside the container at:
/home/joplin/.config
Because the data lives in the Docker volume rather than the disposable container filesystem, the Joplin profile survives container restarts, upgrades, and rebuilds.
Joplin also syncs to S3, so this instance stays synchronized with my other Joplin installations.
Connecting remotely
Once the container is running:
- Connect to the server through the local network or VPN.
- Open a VNC client.
- Connect to:
<server-ip>:5900
- Enter the configured VNC password.
- The Openbox desktop appears with Joplin available normally.
Right-clicking the desktop opens the application menu for Joplin, the terminal, file manager, task manager, and other utilities.
Updating Joplin
Updating the container is intentionally simple.
Change the Joplin version and SHA256 values in docker-compose.yml:
JOPLIN_VERSION
and
JOPLIN_SHA256
The checksum for a new Joplin release can be calculated with:
wget -qO- https://github.com/laurent22/joplin/releases/download/vX.X.X/Joplin-X.X.X.deb | sha256sum
Then rebuild and redeploy the container.
Because the Joplin profile is stored in the persistent Docker volume, rebuilding the container does not remove the existing Joplin configuration or local note database.
The basic idea
The architecture is essentially:
Your device → VPN/LAN → VNC → Docker container → Joplin Desktop → Joplin sync target
There is no special Joplin web frontend and no Joplin service exposed publicly.
You're simply remotely controlling a normal Joplin Desktop installation running on an always-on machine.
For anyone who wants remote access to their full Joplin environment without putting their notes behind another internet-facing web application, this has been a simple and reliable solution for me.