ekklesiaandClaude Opus 5
30a924d945
Two layers for the button, because one is not enough: while a session is running PowerDevil holds logind's handle-power-key inhibitor and acts on the button itself, so a logind drop-in alone would be overruled. logind covers the machine before the session starts, after it ends, and if PowerDevil is not running. Verified: after the drop-in is installed and logind reloaded, it reports ignore for the power, suspend, hibernate and lid keys, and the running session was not disturbed by the reload. Holding the button still cuts the power. That is firmware, below any operating system, and it is deliberately left alone as the only recovery a person standing at a wedged machine has. The maintenance terminal is Meta+Ctrl+Alt+Shift+K, declared in the package rather than seeded into a teacher's configuration, where an update could not reach it. KGlobalAccel read it and registered the component; invoking it opened a working shell. It needed a wrapper. The classroom's Kiosk policy sets shell_access=false and Konsole honours it — measured: with the classroom configuration in its cascade Konsole starts and says "Program to run not set." The restriction is worth keeping everywhere else, so it is lifted for this one process by leaving the classroom's configuration directory out of its cascade. It grants no privilege: the classroom user has no sudo rule, and that restriction was always a barrier in the interface rather than a privilege boundary. Konsole's own entry is shadowed and hidden from /usr/local/share, so nothing is patched and Konsole's package stays maintainable. Nothing is pinned to the panel; a task button appears only while a terminal is open, and closing it returns the bar to three launchers. Co-Authored-By: Claude Opus 5 <[email protected]>
99 lines
4.3 KiB
Docker
99 lines
4.3 KiB
Docker
# Classroom v2 test lab: a full Debian 13 Plasma 6 desktop, running under
|
|
# systemd, inside a container. It exists because the development host is
|
|
# itself a VM with no /dev/kvm, so a real virtual machine cannot be created
|
|
# here. See docs/classroom-v2-experiment.md.
|
|
#
|
|
# docker build -f tools/lab/Dockerfile.plasma -t classroom-v2-lab:plasma .
|
|
# tools/lab/lab up
|
|
#
|
|
FROM debian:trixie
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
ENV container=docker
|
|
|
|
# systemd, so the session is supervised the way it would be on a real machine
|
|
RUN apt-get update && apt-get install -y systemd systemd-sysv dbus dbus-user-session \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# The desktop under test.
|
|
RUN apt-get update && apt-get install -y \
|
|
plasma-desktop plasma-workspace kwin-wayland \
|
|
plasma-nm plasma-pa \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Software rendering, X11 apps, fonts, and the tools the lab drives it with.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libgl1-mesa-dri libglx-mesa0 mesa-utils-bin libegl-mesa0 \
|
|
xwayland \
|
|
fonts-noto-core fonts-dejavu-core fonts-liberation \
|
|
kde-cli-tools qdbus-qt6 \
|
|
sway swaybg grim wtype foot \
|
|
python3 python3-gi gir1.2-gtk-3.0 \
|
|
curl ca-certificates gnupg procps psmisc less vim-tiny socat jq \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN useradd -m -u 1000 -s /bin/bash classroom \
|
|
&& usermod -aG video,render,audio classroom \
|
|
&& passwd -d classroom \
|
|
&& mkdir -p /run/user/1000 && chown classroom:classroom /run/user/1000 \
|
|
&& systemctl enable systemd-logind
|
|
|
|
# Linger so the classroom user's systemd instance starts with the container,
|
|
# which is exactly how the appliance would run.
|
|
RUN mkdir -p /var/lib/systemd/linger && touch /var/lib/systemd/linger/classroom
|
|
|
|
STOPSIGNAL SIGRTMIN+3
|
|
CMD ["/sbin/init"]
|
|
|
|
# Screenshots. KWin's org.kde.KWin.ScreenShot2 only answers callers it
|
|
# recognises by path, and Spectacle is one of them, so this is the
|
|
# sanctioned way to capture a KWin session that has no outer compositor.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends kde-spectacle \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# The classroom's browser, from Google's own repository, the same way a
|
|
# classroom machine gets it. Testing the browser question on a different
|
|
# browser would not answer it.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends gnupg \
|
|
&& install -d -m 0755 /etc/apt/keyrings \
|
|
&& curl -fsS https://dl.google.com/linux/linux_signing_key.pub \
|
|
| gpg --dearmor --batch --yes --output /etc/apt/keyrings/google-chrome.gpg \
|
|
&& echo 'deb [arch=amd64 signed-by=/etc/apt/keyrings/google-chrome.gpg] https://dl.google.com/linux/chrome/deb/ stable main' \
|
|
> /etc/apt/sources.list.d/google-chrome.list \
|
|
&& apt-get update && apt-get install -y --no-install-recommends google-chrome-stable \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# VLC, CUPS and PipeWire: the rest of the classroom's runtime, so the
|
|
# desktop is judged with the room's real applications in it.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
vlc vlc-plugin-base cups cups-client cups-filters \
|
|
pipewire pipewire-pulse wireplumber pulseaudio-utils \
|
|
libnotify-bin \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# seatd, so wlroots can open input devices without a login session. The lab
|
|
# compositor needs a seat before it can offer the session under test a
|
|
# pointer to be clicked with.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends seatd \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# What a classroom would not install.
|
|
#
|
|
# plasma-desktop recommends a welcome tour, a software centre, a phone
|
|
# pairing daemon and a backup tool. None of them belong in a room a teacher
|
|
# walks into, and a classroom package would simply not pull them in; the lab
|
|
# removes them so it is testing the same desktop.
|
|
RUN DEBIAN_FRONTEND=noninteractive apt-get purge -y \
|
|
plasma-welcome plasma-discover plasma-discover-common \
|
|
plasma-discover-backend-fwupd kdeconnect kup-backup \
|
|
&& apt-get autoremove -y \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Quick Launch, for the one auxiliary button on the panel.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends plasma-widgets-addons \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Konsole, for the maintenance chord.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends konsole \
|
|
&& rm -rf /var/lib/apt/lists/*
|