Tip: Joplin works well with Firejail and can be run securely inside its sandbox

Lounge
1

/home/user/.local/bin/run-joplin.sh

#!/bin/sh
firejail \
  --appimage \
  --noprofile \
  --env=XDG_SESSION_TYPE=wayland \
  --env=WAYLAND_DISPLAY="$WAYLAND_DISPLAY" \
  --whitelist="$HOME/Downloads" \
  --read-only="$HOME/Downloads" \
  --whitelist="$HOME/Pictures" \
  --read-only="$HOME/Pictures" \
  --whitelist="$HOME/.local/share/icons" \
  --read-only="$HOME/.local/share/icons" \
  --whitelist="$HOME/.local/share/fonts" \
  --read-only="$HOME/.local/share/fonts" \
  --whitelist="$HOME/.config/fontconfig" \
  --read-only="$HOME/.config/fontconfig" \
  --whitelist="$HOME/Dropbox/app/Joplin" \
  --whitelist="$HOME/.config/Joplin" \
  --whitelist="$HOME/.config/joplin-desktop" \
  --whitelist="$HOME/Your-Joplin-Backup-Folder" \
  --whitelist="$HOME/Applications/Joplin.AppImage" \
  -- \
  "$HOME/Applications/Joplin.AppImage" \
    --no-sandbox \
    --enable-features=UseOzonePlatform \
    --ozone-platform=wayland \
    "$@"

/home/user/.local/share/applications/appimagekit-joplin.desktop

TryExec=/home/user/.local/bin/run-joplin.sh
Exec=/home/user/.local/bin/run-joplin.sh %u

Joplin does not appear to use the ~/.cache directory.

The --no-sandbox option is required because it disables Joplin's built-in Chromium/Electron sandbox, allowing Firejail to handle sandboxing instead.

If you want to block all network access, simply add the --net=none \ option.

Try exporting to PDF or JEX — you'll see that the Firejail sandboxing is doing a fantastic job.