Kiosk mode — nothing but our application¶
The requirement is short and has no exceptions: after switching on, the device shows our application, and nothing else can be reached from it. Not by swiping, not through an error dialogue, not after a crash, not after a power cut in the middle of an update.
That is not a design preference. A tablet from which a visitor can reach a browser is a computer in a hospital corridor, and it will be treated like one.
What has to hold, and how each is verified¶
Every line here is a state that can be checked in front of the device. A technician who cannot demonstrate one of them has not finished.
| Requirement | Verified by |
|---|---|
| The application starts automatically at power-on, without a login | pull the plug, plug it back in, watch the screen |
| No system bar, no navigation bar, no notifications | try to swipe in from every edge |
| The home and recent-apps gestures do nothing | try them |
| A crash of the application restarts it, it does not fall back to the desktop | kill the process, watch the screen |
| No browser address bar is reachable | try every long-press on the surface |
| The screen does not sleep into a lock screen | wait out the display timeout |
| Software updates do not show an operating-system dialogue | run one |
| Sound and volume cannot be silenced from outside the application | try the hardware buttons |
The three layers, and why all three are needed¶
Kiosk lockdown fails in practice not because one mechanism is missing, but because only one is used and the other two are assumed.
The launcher. Our application is registered as the home application, so there is nothing to return to. This is the layer that survives a crash: if the process dies and the system falls back to home, home is us again.
The lockdown. Screen pinning / lock task mode prevents leaving the running application by gesture or button. This is the layer that stops the curious visitor.
The supervisor. A service watches the application process and restarts it if it is gone. This is the layer that survives an update that goes wrong at three in the morning.
Any one alone leaves a hole. The launcher alone is defeated by a swipe. The lockdown alone is defeated by a crash. The supervisor alone is defeated by somebody who simply presses home.
The second screen¶
Devices with a second display (uServe) must show the operator surface on the primary screen and the face on the secondary — never the other way round, and never a mirrored desktop. A mirrored desktop on the outward-facing screen is the single most visible way to look unfinished.
On the server side¶
The uGo server runs as a system service, starts with the device, and survives a terminated session. This is separate from kiosk mode and just as important: on 25.08.2026 two of three devices in the fleet died at once because their processes belonged to an SSH session and the session ended.
Everything that runs permanently belongs in a service unit with
Restart=always and WantedBy=multi-user.target. Nothing that has to survive
the night may be started by hand.
What is deliberately still reachable¶
Two things, and only these:
The technician page, over the network, behind the technician password. Not from the screen of the device — a service technician has a laptop.
A physical way back, documented and known to service, for the case where a device has to be re-imaged. It is never a gesture on the screen, because anything reachable by gesture is reachable by a visitor.