Enterprise Kiosk Capabilities

Virtual TTY consoles (TTY1-6) and X11 VT-switching shortcuts (Ctrl+Alt+F1-F7) are permanently masked. Openbox window manager runs without escape keybindings. USB storage automounting is blocked, preventing unauthorized execution.

A system-level URLBlocklist covers every http and https address. Workstations access only the domains explicitly approved in your organization console. DevTools, downloads, extensions, and print dialogs are permanently disabled.

The root filesystem mounts read-only with a volatile tmpfs overlay (overlayroot="tmpfs:recurse=0"). Browser caches, temporary logs, and session files live strictly in RAM. Thin clients with small flash SSDs experience zero write cycles.

Every workstation maintains an authenticated WebSocket connection to its organization's dedicated Cloudflare Durable Object (OrgHub). Remote commands (lock, navigate, reload, reboot, shutdown) are pushed to connected workstations the moment you send them.

Assist users directly from your browser without opening firewall ports. RemoteRelay pairs the operator console's browser with the workstation's loopback x11vnc session over WebSockets encrypted with TLS, relayed through Cloudflare.

Complete internationalization support for workstation UI, top bar, lock curtain, and setup wizard. Full right-to-left (RTL) layout switching for Arabic, Hebrew, and Urdu. Translation catalogs synchronize over the air.

Delegate operational tasks without risking security. Pre-defined roles (Operator, Assistant, Content Manager, Sub-Admin) enforce strict permission boundaries. Staff can never escalate permissions beyond what their creator holds.

Provide end users with an intuitive, clean grid of approved services. Administrators configure app tiles with high-resolution thumbnails, descriptions, and categories. Users click to launch without typing complex URLs.