A touchscreen kiosk on Ubuntu Frame

24 June 2022

If you want a machine that boots straight into one fullscreen application and nothing else, Ubuntu Frame is the neat way to do it. It is a Wayland display server from Canonical, shipped as a snap, built for exactly this: a single graphical app, fullscreen, no desktop, no window chrome, no way out. Point a web kiosk snap at it and you have a touchscreen that only ever shows your page.

Install Ubuntu Frame

sudo snap install ubuntu-frame

Set it to run as a daemon so it starts at boot and owns the display:

sudo snap set ubuntu-frame daemon=true

You can set the idle/splash background colours so a freshly booted screen does not just sit black while things come up:

sudo snap set ubuntu-frame config="
wallpaper-top=0x92006a
wallpaper-bottom=0xdd4814
"

Show a web page

For a web kiosk, the WPE WebKit kiosk snap renders a URL fullscreen on top of Frame. Install it and point it at your page:

sudo snap install wpe-webkit-mir-kiosk
sudo snap set wpe-webkit-mir-kiosk url=https://example.com
sudo snap restart ubuntu-frame

That is the whole kiosk: Frame owns the screen, the WPE snap draws your page on it, and there is no desktop behind either of them.

An on-screen keyboard

A touchscreen with any kind of input needs a keyboard. Ubuntu Frame has a matching on-screen keyboard snap. Install it, connect it to the Wayland socket Frame exposes, and run it as a daemon:

snap install ubuntu-frame-osk
snap connect ubuntu-frame-osk:wayland
sudo snap set ubuntu-frame-osk daemon=true

It pops up when a text field is focused and gets out of the way otherwise.

Lock the hardware down

Software that only shows one app is not a kiosk if someone can plug in a keyboard and alt-tab out of it. On a public-facing unit, stop the machine accepting USB human-interface devices (keyboards, mice) that were not already present. A udev rule that refuses to authorise new USB HID devices does this:

# /etc/udev/rules.d/99-disable-usb-hid.rules
SUBSYSTEMS=="usb", DRIVERS=="usbhid", ACTION=="add", ATTR{authorized}="0"

Reload udev so it takes effect:

sudo service udev restart

After this, plugging in a USB keyboard does nothing, while the built-in touchscreen keeps working.

Finish the lockdown with the usual physical and account hardening: disable the other TTYs so there is no console to drop to, give the machine no desktop user to log into, and make sure the only thing autostarting is Frame and your app. The combination, Frame owning the display, one app on top, no on-device keyboard accepted, no console, is what turns a PC into something you can safely leave in a public space.