Memos with Docker: a private, self-hosted notes timeline (Linux, Windows, Mac)

What you get in one minute#

Memos is a free, self-hosted notes app: you jot a thought, it lands in a timeline with Markdown and #tags, and everything stays in one folder on a machine you control.

Logo: the official Memos project (github.com/usememos/memos)

It suits quick capture, a private journal, a checklist scratchpad, or a small shared notebook. It is lightweight: one container and, by default, a SQLite database.

At a glance:

• What it is: a web app with a timeline of short Markdown notes, tags, checklists, attachments and optional sharing.
• Where your data lives: one folder with memos_prod.db (SQLite) and an assets/ folder for uploads.
• First user is the admin: the first account you create becomes the instance admin, so create it before anyone else can reach the page.
• Close the door after that: switch on "Disallow user registration" and keep "Allow public access" off.
• Memos start private: a new memo defaults to PRIVATE. Share links are a separate door, covered below.
• Project status: alive and maintained. Releases now use calendar versions such as 26.11.0, and old 0.x installs have a required upgrade path.

How it fits together#

You open Memos in a browser, optionally through an HTTPS proxy. The container writes everything to one data folder, and a backup is a copy of that folder.

Drawn for this guide from the official docs and Dockerfile. The HTTPS door (dashed) is optional.

Before you start#

You need Docker with Compose and a few minutes. Memos itself is small.

The image ships for linux/amd64, linux/arm64 and linux/arm/v7, so Apple Silicon and a Raspberry Pi 4 or newer work.

Check Docker on each system:

docker --version
docker compose version

Checklist:

• [ ] Docker and Compose answer the two commands above
• [ ] Port 5230 is free on the machine (or you pick another host port in Step 2)
• [ ] You will back up the data folder (see "Updates and backups")
• [ ] For the HTTPS section only: a domain with a DNS record pointing to the server, and ports 80 and 443 free

Tested on 2026-11-05: not run. Linux = not run, Windows = not run, Mac = not run. Commands come from the official docs and release files read on that date; any output shown is labelled as expected.

Step 1: Create the data folder#

Memos keeps everything in one folder. We use ~/docker_volumes/memos, as all DIY Lab Hub guides do, with data for Memos and backups for archives.

Linux#

mkdir -p ~/docker_volumes/memos/{data,backups}
cd ~/docker_volumes/memos

Windows (PowerShell)#

New-Item -ItemType Directory -Force "$HOME\docker_volumes\memos\data", "$HOME\docker_volumes\memos\backups" | Out-Null
cd "$HOME\docker_volumes\memos"

Mac (Terminal)#

Same commands as Linux:

mkdir -p ~/docker_volumes/memos/{data,backups}
cd ~/docker_volumes/memos

Check it worked. The data folder exists and is empty:

ls -la ~/docker_volumes/memos/data

On Windows use Get-ChildItem "$HOME\docker_volumes\memos\data".

Step 2: Write the Compose file and start Memos#

This is the official compose file with three changes: the image is pinned to 26.11.0 (the docs use stable), the data folder is the one from Step 1, and the port is published on 127.0.0.1 only. Until you have created the admin, only your own machine can reach the sign-up page.

Linux#

cd ~/docker_volumes/memos
cat > docker-compose.yml << 'EOF'
services:
  memos:
    image: neosmemo/memos:26.11.0
    container_name: memos
    restart: unless-stopped
    ports:
      - "127.0.0.1:5230:5230"
    volumes:
      - ./data:/var/opt/memos
EOF
docker compose up -d
docker compose ps
docker compose logs --tail=20 memos

Windows (PowerShell)#

cd "$HOME\docker_volumes\memos"
@'
services:
  memos:
    image: neosmemo/memos:26.11.0
    container_name: memos
    restart: unless-stopped
    ports:
      - "127.0.0.1:5230:5230"
    volumes:
      - ./data:/var/opt/memos
'@ | Set-Content -Encoding ascii docker-compose.yml
docker compose up -d
docker compose ps
docker compose logs --tail=20 memos

Mac (Terminal)#

Same commands as Linux:

cd ~/docker_volumes/memos
cat > docker-compose.yml << 'EOF'
services:
  memos:
    image: neosmemo/memos:26.11.0
    container_name: memos
    restart: unless-stopped
    ports:
      - "127.0.0.1:5230:5230"
    volumes:
      - ./data:/var/opt/memos
EOF
docker compose up -d
docker compose ps
docker compose logs --tail=20 memos

Check it worked. docker compose ps shows memos running. The image's entrypoint script prints one line at start (expected, from the script in the repository at the release tag):

memos: starting as UID:GID 10001:10001

The container runs as a non-root user (UID 10001). The entrypoint fixes the ownership of the mounted folder for you. If the log warns that /var/opt/memos is not writable, see "Troubleshooting".

Tip: There is no version: line in the file. Current Compose ignores it and warns about it.

Step 3: Create the admin account and close the door#

The first account you create becomes the instance admin. Do this now, on the same machine, before you open anything to your network.

Linux#

Open http://localhost:5230 in a browser on the server (or tunnel it from your laptop: ssh -N -L 5230:127.0.0.1:5230 <your-user>@<your-server-address>, then open http://localhost:5230).

Windows (PowerShell)#

Open http://localhost:5230 in your browser. Docker Desktop publishes the port on your own PC.

Mac (Terminal)#

Open http://localhost:5230 in your browser.

Then do these four things, in this order:

1. On the setup page ("Set up your instance"), create the admin with a long, unique password. Store it in a password manager.
2. Open Settings, then System, and find the group Access and policies.
3. Switch Disallow user registration on. This stops strangers creating accounts from the sign-up page.
4. Leave Allow public access off. With it off, signed-out visitors cannot browse public memos.

Check it worked. Open http://localhost:5230 in a private browser window. You should be sent to the sign-in page, and the sign-up page should say "Sign-ups are closed" (the text comes from the app's own English strings at the release tag; we did not run it).

Tip: The docs do not state the default of "Disallow user registration", so do not assume it is on. Open the switch and look. In 26.11.0 the page is Settings, then System; older notes call it "Instance".

Tip: Keep the port on 127.0.0.1 until step 3 above is finished. Before the first account exists, whoever reaches the page first becomes the admin.

Step 4: Write a memo and check who can see it#

Memos has four visibility levels. Knowing them matters more than any setting.

Per the docs, instance admins can also read and manage other people's private memos, so share the admin password with nobody.

Linux#

Open the composer from the sidebar and paste this test memo (from the official Getting Started page):

# Welcome to Memos
This is my first memo.
- [x] Install Memos
- [ ] Write a real note
Trying #memos and #getting-started

Check the visibility shown in the editor says PRIVATE, then save.

Windows (PowerShell)#

Same steps in the browser as Linux. Nothing runs in PowerShell here.

Mac (Terminal)#

Same steps in the browser as Linux.

Check it worked. The memo appears in the timeline with the checklist and two tags.

Tip: Memos has share links: a link to one memo that opens without signing in, even for a PRIVATE memo. Pick an expiry (1, 7 or 30 days, or never) when you create one. The docs say switching the instance to private mode does not revoke existing links, so review them if you ever change access.

Reach Memos from your phone or other devices (optional)#

Right now Memos answers only on the machine it runs on. You have two safe routes.

• Home network only: change the port line in docker-compose.yml from "127.0.0.1:5230:5230" to "5230:5230", run docker compose up -d, then open http://<server-lan-address>:5230 from the phone. This is plain HTTP, so use it only on a network you trust.
• A real address with HTTPS: follow the next section. This is the better route if you want it away from home or want a padlock.

Do not forward port 5230 on your router. Put HTTPS in front instead.

Put it behind HTTPS (with or without Traefik)#

This is for a server where you want https://memos.<your-domain> and no open host port. Local-only users can skip it. Both routes need a DNS record pointing to the server (or, for a home-only name, a way for your devices to resolve it).

The docs say to set MEMOS_INSTANCE_URL to the public URL and forward Host, X-Forwarded-Proto and X-Forwarded-For. Caddy and Traefik both do this.

Tip: On a fresh instance, a configured MEMOS_INSTANCE_URL starts Memos in public-access mode; without it, private. Because you created the admin and checked "Allow public access" in Step 3, the setting already exists and the URL will not change it. If you start a brand-new instance with the URL set, open Settings, then System, and switch public access off first.

With Traefik#

On a server that already runs Traefik v3 with the Docker provider, add labels and remove the host port.

This assumes an external Docker network called proxy and an entrypoint called https (use your own names). Create the network once:

docker network create proxy

Replace docker-compose.yml with this file:

services:
  memos:
    image: neosmemo/memos:26.11.0
    container_name: memos
    restart: unless-stopped
    environment:
      MEMOS_INSTANCE_URL: "https://memos.<your-domain>"
    volumes:
      - ./data:/var/opt/memos
    networks:
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
      - "traefik.http.routers.memos.rule=Host(`memos.<your-domain>`)"
      - "traefik.http.routers.memos.entrypoints=https"
      - "traefik.http.routers.memos.tls=true"
      - "traefik.http.services.memos.loadbalancer.server.port=5230"

networks:
  proxy:
    external: true

Start it with docker compose up -d in ~/docker_volumes/memos.

Check it worked. curl -I https://memos.<your-domain>/ returns an HTTP status line over HTTPS, and the page opens with a valid certificate.

Without Traefik: Caddy#

Choose this if you have no Traefik. Caddy gets and renews its own certificates.

Caddy's docs describe automatic Let's Encrypt certificates for a public domain, and tls internal for a local certificate at home. We run Caddy as a container, so the commands are the same on Linux, Windows and Mac. On Windows and Mac, Docker Desktop publishes ports 80 and 443 on your PC.

Create the Caddy folders. Per the Caddy image docs, we mount the conf folder at /etc/caddy, not the single Caddyfile (editors that change the file's inode break reloads):

mkdir -p ~/docker_volumes/caddy/{conf,data,config}
cd ~/docker_volumes/caddy

On Windows run New-Item -ItemType Directory -Force "$HOME\docker_volumes\caddy\conf", "$HOME\docker_volumes\caddy\data", "$HOME\docker_volumes\caddy\config".

Save this as ~/docker_volumes/caddy/docker-compose.yml. The image is caddy:2.11.8, the latest Caddy release on 5 November 2026 (tag checked on Docker Hub):

services:
  caddy:
    image: caddy:2.11.8
    container_name: caddy
    restart: unless-stopped
    ports:
      - "80:80/tcp"
      - "443:443/tcp"
      - "443:443/udp"
    volumes:
      - ./conf:/etc/caddy
      - ./data:/data
      - ./config:/config
    networks:
      - proxy

networks:
  proxy:
    external: true

Save this as ~/docker_volumes/caddy/conf/Caddyfile for a public domain:

memos.example.com {
    reverse_proxy memos:5230
}

For a home-only name, use tls internal instead:

memos.home.arpa {
    tls internal
    reverse_proxy memos:5230
}

Caddy passes Host through, adds X-Forwarded-For and X-Forwarded-Proto itself, and flushes event streams at once. No extra lines are needed.

Now change Memos to join the same proxy network. In ~/docker_volumes/memos/docker-compose.yml remove the ports: block, add MEMOS_INSTANCE_URL, and add the network, exactly as in the Traefik file above (without the labels:). Create the network if you have not (docker network create proxy), then start both stacks:

cd ~/docker_volumes/caddy && docker compose up -d
cd ~/docker_volumes/memos && docker compose up -d

For a home-only certificate, Caddy's docs say that in a container you install the root certificate on each device yourself. Locate it first, then copy it out:

docker exec caddy find /data -name root.crt
docker cp caddy:<path-from-find> ./caddy-root.crt

Install caddy-root.crt as a trusted root on each device. These are standard operating-system commands, not from the Memos or Caddy docs, and we did not run them:

# Linux (Debian/Ubuntu)
sudo cp caddy-root.crt /usr/local/share/ca-certificates/caddy-root.crt && sudo update-ca-certificates
# Mac
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain caddy-root.crt

# Windows, in an administrator PowerShell
certutil -addstore -f "ROOT" caddy-root.crt

Check it worked. curl -I https://memos.example.com/ returns an HTTP status line over HTTPS. For a home-only name, the browser shows a padlock only after the root is trusted on that device.

Tip: Let's Encrypt needs the DNS record to point at the server and ports 80 and 443 to reach it. A certificate error usually means the name in the Caddyfile differs from the DNS record.

Security and testing#

A notes app holds private things. These controls matter most.

Quick tests after each change:

cd ~/docker_volumes/memos
docker compose ps
docker compose logs --tail=100 memos

On Windows and Mac you can also run curl -I https://memos.<your-domain>/ in PowerShell or Terminal (curl.exe ships with Windows 10 and 11).

What leaves the machine: only what you choose to share, plus anything you configure, such as S3 storage, SMTP or an AI provider. The docs I read describe no telemetry; we did not audit the code.

Common mistakes#

These come from the official issue tracker, the docs' own warnings, and common AI assistant answers.

Tip: Before copying any Memos guide (including this one), check its date. Memos changed its version scheme, its API paths and its access settings in 2026, and posts from before 26.10 can be wrong in all three places.

Tip: A long note refused with a limit message is normal: since 26.10 the default is 8 KiB per memo and 32 MiB per file. Raise it under Settings, then Usage limits, instead of splitting your note.

Tip: When something fails after an upgrade, run docker compose logs --tail=100 memos before you change anything. Most errors above print there with the exact text.

Troubleshooting#

The exact error texts we saw in reports:

database schema "0.30.1" is too old to upgrade directly; minimum supported schema is 0.31.8.
First upgrade to v0.31.0

WARN /var/opt/memos is not writable, using current directory
ERROR failed to migrate error="attempt to write a readonly database (1544)

Fixing a data folder that is not writable#

The container runs as UID 10001 and tries to change the ownership of the mounted folder on start. If that silently fails (some NAS and network mounts), do it yourself, or run the container as your own user. Linux:

sudo chown -R 10001:10001 ~/docker_volumes/memos/data
cd ~/docker_volumes/memos && docker compose up -d

Or add your own IDs to the compose file under environment: (id -u and id -g show them):

    environment:
      MEMOS_UID: "1000"
      MEMOS_GID: "1000"

On Windows and Mac, Docker Desktop handles bind-mount permissions; if it still fails, move the folder to a normal location under your user profile.

Known bugs (open, November 2026)#

• Issue #6525: after two quick changes to one memo (pin then unpin, for instance), the page can show the older state. The server saved the second change; reload the page.
• Issue #6455: tag renaming in the tag view disappeared in 0.31. Editing a tag in each memo still works.
• Issue #6342 (feature request): a first-time SSO sign-in cannot link to an existing account with the same username yet.

Run docker compose ps and docker compose logs --tail=200 memos first.

Updates and backups#

Back up first. Memos runs database migrations when it starts, and the docs say downgrading afterwards is not supported: your backup is the rollback path.

Linux#

The docs' offline method: stop Memos, archive the data folder, start it again. On Linux the files belong to UID 10001, so use sudo:

cd ~/docker_volumes/memos
docker compose stop
mkdir -p backups
sudo tar -czf "backups/memos-$(date +%F).tar.gz" -C data .
sudo chown "$USER": backups/memos-*.tar.gz
chmod 600 backups/memos-*.tar.gz
docker compose start

Keep a copy of the archive on another machine. For 03:00 nightly, put the commands in a script and add a crontab -e entry. If you cannot stop the container, the docs show an online backup with sqlite3 "<data>/memos_prod.db" ".backup <file>" plus a separate tar of assets (needs sqlite3 on the host).

Windows (PowerShell)#

cd "$HOME\docker_volumes\memos"
docker compose stop
New-Item -ItemType Directory -Force backups | Out-Null
tar -czf "backups\memos-$(Get-Date -Format yyyy-MM-dd).tar.gz" -C data .
docker compose start

tar ships with current Windows 10 and 11. To schedule it, save the lines as backup.ps1 and register it in Task Scheduler (schtasks /Create /SC DAILY /ST 03:00 /TN "Memos backup" /TR "powershell -NoProfile -File <path-to>\backup.ps1"). We did not run these.

Mac (Terminal)#

Same commands as Linux. If tar says permission denied, add sudo. For a nightly run, use cron as on Linux.

Restore test. Unpack one archive into a new empty folder, never over the live one, and check the files:

mkdir -p /tmp/restore-test && sudo tar -xzf ~/docker_volumes/memos/backups/memos-<date>.tar.gz -C /tmp/restore-test
ls /tmp/restore-test

You should see memos_prod.db and assets (the layout from the official backup page). For a real restore: docker compose down, move data aside, unpack the archive into a new data folder, docker compose up -d, and sign in. Never start an older Memos version on a database a newer one has already migrated.

Update. Read the release notes, change the tag in docker-compose.yml, then:

cd ~/docker_volumes/memos
docker compose pull
docker compose up -d
docker compose logs --tail=100 memos

The docs' required path: from 0.31.0 or newer you can go straight to 26.10 or later. From 0.22 to 0.30, install 0.31.0 first and start it successfully. From before 0.22, go through 0.25.3 and then 0.31.0. After the upgrade, check that you can sign in, an old memo opens, and attachments load.

Performance and resources#

The docs publish no memory or CPU figures, so this guide gives none. The image is about 24 to 26 MB compressed. Measure your own server:

• Resources: docker stats memos shows live CPU and memory.
• Database: SQLite is the default and the docs call it a good fit for a single node. It uses WAL mode, a 10 second busy timeout and serialises writes. The docs list about 100 GB as a practical database size.
• Bigger setups: MySQL or PostgreSQL via MEMOS_DRIVER and MEMOS_DSN. The maintainers test PostgreSQL 18.
• Behind a proxy: keep it compatible with long-lived event streams and do not buffer them (Caddy handles this).

FAQ#

Is Memos free to use? Yes, under the MIT licence.

Is the project still maintained? Yes. Release 26.11.0 came out on 1 November 2026. It uses calendar versions since 26.10; older releases were 0.x.

Can I use it on a Raspberry Pi? The docs list linux/arm64 (Raspberry Pi 4 and newer) and linux/arm/v7 (Pi 2 and 3). We did not test it.

Is there a phone app? The README names a web clipper for Chrome and Firefox and a Telegram bot, and no native app. Use the web page in your phone's browser. Reaching it from the phone needs one of the two routes above.

Does it send my data to the project? The docs I read describe no telemetry. Nothing leaves unless you configure S3, email, an AI provider, webhooks or sharing.

Can I move my notes to another instance? Yes. Settings, then Export & Import, makes a ZIP of one account's memos. It is not a full backup: it leaves out other users, settings and Space memberships, so keep the folder backup too.

Sources#

• Memos release 26.11.0, README, Dockerfile, entrypoint.sh and LICENSE - read November 2026
• Memos docs: Getting Started, Docker, Docker Compose, Reverse Proxy, Environment Variables, Security, Authentication, Instance Settings, Users & Roles, Sharing, Backup & Restore, Upgrade, Performance Tuning, Troubleshooting, FAQ and Export & Import - read November 2026
• Memos web UI strings and settings sections at 26.11.0 - read November 2026
• Memos image on Docker Hub (tags 26.11.0 and stable checked) - November 2026
• Caddy release v2.11.8, Caddy Docker image, reverse_proxy, tls directive and automatic HTTPS - read November 2026
• Docker Desktop for Windows and for Mac system requirements - read November 2026
• GitHub issues #5551, #6007, #6023, #6123, #6342, #6370, #6389, #6455, #6515 and #6525 - read November 2026

Related guides: Caddy as a reverse proxy, restic Docker backups, BookStack, a self-hosted wiki and authentik single sign-on.

Checked against the official docs on 2026-11-05.