---
title: "A touchscreen kiosk on Ubuntu Frame"
date: "2022-06-24"
path: "/216-a-touchscreen-kiosk-on-ubuntu-frame.html"
section: "/ramblings"
description: "Turning an Ubuntu machine into a locked-down fullscreen touchscreen kiosk with Ubuntu Frame, a web kiosk snap and an on-screen keyboard."
---

If you want a machine that boots straight into one fullscreen application and nothing else, Ubuntu Frame is the neat way to do it. It is a Wayland display server from Canonical, shipped as a snap, built for exactly this: a single graphical app, fullscreen, no desktop, no window chrome, no way out. Point a web kiosk snap at it and you have a touchscreen that only ever shows your page.

## Install Ubuntu Frame

```bash
sudo snap install ubuntu-frame
```

Set it to run as a daemon so it starts at boot and owns the display:

```bash
sudo snap set ubuntu-frame daemon=true
```

You can set the idle/splash background colours so a freshly booted screen does not just sit black while things come up:

```bash
sudo snap set ubuntu-frame config="
wallpaper-top=0x92006a
wallpaper-bottom=0xdd4814
"
```

## Show a web page

For a web kiosk, the WPE WebKit kiosk snap renders a URL fullscreen on top of Frame. Install it and point it at your page:

```bash
sudo snap install wpe-webkit-mir-kiosk
sudo snap set wpe-webkit-mir-kiosk url=https://example.com
sudo snap restart ubuntu-frame
```

That is the whole kiosk: Frame owns the screen, the WPE snap draws your page on it, and there is no desktop behind either of them.

## An on-screen keyboard

A touchscreen with any kind of input needs a keyboard. Ubuntu Frame has a matching on-screen keyboard snap. Install it, connect it to the Wayland socket Frame exposes, and run it as a daemon:

```bash
snap install ubuntu-frame-osk
snap connect ubuntu-frame-osk:wayland
sudo snap set ubuntu-frame-osk daemon=true
```

It pops up when a text field is focused and gets out of the way otherwise.

## Lock the hardware down

Software that only shows one app is not a kiosk if someone can plug in a keyboard and alt-tab out of it. On a public-facing unit, stop the machine accepting USB human-interface devices (keyboards, mice) that were not already present. A udev rule that refuses to authorise new USB HID devices does this:

```text
# /etc/udev/rules.d/99-disable-usb-hid.rules
SUBSYSTEMS=="usb", DRIVERS=="usbhid", ACTION=="add", ATTR{authorized}="0"
```

Reload udev so it takes effect:

```bash
sudo service udev restart
```

After this, plugging in a USB keyboard does nothing, while the built-in touchscreen keeps working.

Finish the lockdown with the usual physical and account hardening: disable the other TTYs so there is no console to drop to, give the machine no desktop user to log into, and make sure the only thing autostarting is Frame and your app. The combination, Frame owning the display, one app on top, no on-device keyboard accepted, no console, is what turns a PC into something you can safely leave in a public space.