adibhanna/zennotes repository overview

⁠ZenNotes (self-hosted)

Keyboard-first, Vim-friendly Markdown notes. Your notes stay as ordinary .md files on disk — no database, no lock-in. This image runs the self-hosted web app + Go server: open it in a browser and edit a vault mounted from your host.

• 🌐 Website: https://zennotes.org⁠
• 📦 Source: https://github.com/ZenNotes/zennotes⁠
• 🏗️ Multi-arch: linux/amd64, linux/arm64

⁠Quick start

The server binds to 0.0.0.0 inside the container, so it requires an auth token — it refuses to start without one. Generate a token and pass it in:

TOKEN=$(openssl rand -hex 32)

docker run -d --name zennotes \
  -p 127.0.0.1:7878:7878 \
  -e ZENNOTES_AUTH_TOKEN="$TOKEN" \
  -v "$HOME/Notes/ZenNotesVault:/workspace" \
  -v "$HOME/zennotes-data:/data" \
  --read-only --tmpfs /tmp \
  --cap-drop ALL --security-opt no-new-privileges \
  adibhanna/zennotes:latest

echo "Open http://localhost:7878 and log in with: $TOKEN"

Paste the token into the browser when prompted. After login the browser uses a session cookie, so you won't need to re-enter it on refresh.

⁠docker compose

services:
  zennotes:
    image: adibhanna/zennotes:latest
    container_name: zennotes
    restart: unless-stopped
    ports:
      - "127.0.0.1:7878:7878"
    environment:
      ZENNOTES_AUTH_TOKEN: "change-me-to-a-long-random-string"
    volumes:
      - ./vault:/workspace   # your notes (plain Markdown)
      - ./data:/data         # server config
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true

⁠Volumes

⁠Configuration

⁠Tags

• latest — most recent release
• X.Y.Z / X.Y — pinned versions (e.g. 2.0.1, 2.0)

⁠Features

Plain-file Markdown vault · Vim mode & leader-key flows · command palette · edit / split / preview modes · tasks, tags, search, archive, trash · daily notes · KaTeX math, Mermaid, TikZ, JSXGraph diagrams · wiki links & callouts · first-party MCP server for AI tools.

⁠Security

The image runs as a non-root user (uid 65532) by default. The quick-start and compose examples above also run it read-only, with /tmp on tmpfs and all Linux capabilities dropped — recommended.

It requires an auth token and warns periodically if exposed on a non-loopback bind over plain HTTP. If you expose it beyond your LAN, put it behind a reverse proxy, terminate TLS there, and set ZENNOTES_BEHIND_TLS=1 plus ZENNOTES_TRUSTED_PROXIES.

Full guide: Self-Host with Docker⁠