Is Endless OS really free for classrooms?

Yes. Endless OS is free to download and use. They also have a dedicated Endless Key program providing educational content on USB drives for low-connectivity environments. Commercial support contracts are available but not required.

Can a child bypass the DNS filtering by changing network settings?

A standard (non-admin) user cannot change system network settings in GNOME or most desktop environments — those panels require administrator authentication. For extra assurance, also set the DNS override at the router level so it applies regardless of machine configuration.

Does GCompris work offline?

Yes. When installed from your distro's repository, GCompris-Qt is fully offline. Some activities in the Flatpak or demo version may require an internet connection or paid unlock, which is why installing from the official repo is recommended.

How do I prevent kids from installing Flatpak apps directly?

Malcontent's parental controls can restrict the GNOME Software Center and Flatpak installations. You can also remove the Flatpak user remote for the child's account: run flatpak --user remote-delete flathub as that user, which prevents user-level Flatpak installs without affecting system-wide apps.

What's the best setup for a shared classroom computer used by multiple kids?

Create one shared standard account (e.g., 'student') rather than individual accounts, or use Endless OS which is designed for this scenario. Apply all restrictions to that account, disable automatic login, and set a simple PIN for the student account that teachers know but isn't a secret from kids — the goal is preventing accidents, not secrets.

A Linux Setup for Kids and Classrooms

Setting up a Linux machine for children or a classroom means more than installing a distro and hoping for the best. You want age-appropriate software, accounts that can't accidentally delete system files, and some guardrails around what kids can access. This guide walks through choosing the right distro, installing the best educational software, locking down user accounts, and applying parental controls — all using current, supported tools.

Choosing the Right Distro

Two solid starting points exist depending on your situation:

Endless OS — Purpose-built for education and low-connectivity environments. It ships with hundreds of apps pre-installed, uses an immutable OSTree base (the system partition is read-only), and exposes a simple GNOME-based shell stripped of unnecessary complexity. Ideal for classrooms where you need zero-maintenance deployments. Download the installer from endlessos.com; it runs as a full OS, not a live CD experiment.
Ubuntu LTS (24.04) — Better if you need more control, IT manageability, or a familiar base. Everything in this guide works on Ubuntu, Debian, and Fedora unless noted.

Endless OS is the hands-off choice. Ubuntu gives you more rope. Pick accordingly.

Creating a Restricted Child Account

Never let children use an administrator account. Create a standard (non-sudo) user from the start.

Using the command line

# Debian/Ubuntu
sudo adduser kidname
# No sudo group membership — standard user by default

# Fedora/RHEL/Rocky
sudo useradd -m -s /bin/bash kidname
sudo passwd kidname

# Arch
sudo useradd -m -G users kidname
sudo passwd kidname

Verify the account has no sudo access:

groups kidname
# Output should NOT contain sudo, wheel, or admin

On Endless OS, account creation is handled through Settings → Users. New accounts are standard by default — no terminal work required.

Installing Educational Software

GCompris

GCompris is a high-quality educational suite covering mathematics, science, geography, reading, logic, and more — with activities targeting ages 2–10. It's available in every major repo.

# Debian/Ubuntu
sudo apt install gcompris-qt

# Fedora
sudo dnf install gcompris-qt

# Arch
sudo pacman -S gcompris-qt

The -qt variant is the actively maintained modern rewrite. The older gcompris package (GTK-based) is unmaintained — avoid it.

The Tux Suite

The Tux suite is a collection of Linux mascot-branded educational games with proven classroom track records:

Tux Paint — Drawing program designed for young children, with stamps, sound effects, and age-appropriate tools.
TuxMath — Arcade-style math practice (addition through division).
Tux Typing — Touch-typing tutor aimed at kids.

# Debian/Ubuntu — install all three
sudo apt install tuxpaint tuxmath tuxtype

# Fedora
sudo dnf install tuxpaint tuxmath tuxtype

# Arch (AUR for some; use your AUR helper)
yay -S tuxpaint tuxmath tuxtype

Tux Paint has a configuration file that locks down features for younger children. To prevent kids from exiting Tux Paint or accessing the file system through it:

# Create or edit Tux Paint config for the child account
mkdir -p /home/kidname/.tuxpaint
cat > /home/kidname/.tuxpaint/tuxpaint.conf <<EOF
nokeyboard=yes
noquit=yes
fullscreen=yes
EOF
chown -R kidname:kidname /home/kidname/.tuxpaint

Additional Recommended Software

KDE Edu suite — Includes Kalzium (chemistry), Marble (geography), KStars (astronomy), and more. Install kdeedu on Debian/Ubuntu or kde-edu on Fedora.
Scratch — MIT's visual programming environment. Run it via the Flatpak for the most current version: flatpak install flathub edu.mit.Scratch
Chromium — Pairs well with parental controls configured below.

Applying Parental Controls

GNOME Parental Controls (Malcontent)

On GNOME desktops (Ubuntu, Fedora Workstation, Endless OS), the Malcontent framework provides built-in parental controls accessible through a GUI. It integrates with systemd and the session to restrict app usage and set screen time limits.

# Debian/Ubuntu
sudo apt install malcontent malcontent-ui

# Fedora
sudo dnf install malcontent

After installing, open Settings → Parental Controls (you'll need to authenticate as admin). From there you can:

Block access to specific applications by toggling them off per-user.
Set an age rating filter — apps rated above the selected age are hidden from the child's account.
Restrict the software center so kids can't install new applications.

Endless OS has Parental Controls built in under Settings without any extra install step.

Web Content Filtering with a DNS Sinkhole

Application-level controls don't touch the browser. The most effective browser-level filter for a classroom is to point DNS at a filtering resolver. Set this on the router so it applies to every device, or configure it per-machine via systemd-resolved.

# Edit the resolved configuration
sudo nano /etc/systemd/resolved.conf

Add or change the [Resolve] section:

[Resolve]
DNS=1.1.1.3 1.0.1.3
FallbackDNS=

Cloudflare's 1.1.1.3 / 1.0.1.3 are their family-safe resolvers that block malware and adult content. Restart resolved to apply:

sudo systemctl restart systemd-resolved

Restricting sudo and Administrative Commands

Standard user accounts already can't run sudo. Reinforce this by ensuring the child's account is absent from /etc/sudoers and any sudoers drop-in files:

sudo grep -r kidname /etc/sudoers /etc/sudoers.d/
# Should return nothing

Locking the Shell (Optional)

For very young children or public kiosk-style deployments, set the child's shell to nologin to prevent terminal access while keeping GUI login intact:

sudo usermod -s /usr/sbin/nologin kidname

The graphical session still launches normally; only interactive shell access is blocked.

Setting Up a Curated Application Launcher

On GNOME, hide irrelevant or risky applications from the child's app grid by creating a curated set of desktop entries. The simplest approach is to use Malcontent's app blocking (described above) to hide everything except the educational apps you've installed. Alternatively, on KDE Plasma, use Kiosk mode (part of kde-config-tablet or the KDE Plasma Kiosk framework) to lock the desktop layout.

For classrooms on Ubuntu, the Ubuntu Advantage / MAAS tooling or a simple login script that sets XDG_DATA_DIRS to a curated path can limit what appears in application menus without modifying system files.

Verification

Before handing the machine to a child, run through this quick checklist logged in as the child account:

Open a terminal (if one is accessible) and run sudo -l — it should deny permission or prompt for a password that doesn't work.
Open the software center and confirm it's either absent or restricted.
Visit a known adult-content URL in the browser — it should be blocked if DNS filtering is active.
Launch GCompris, Tux Paint, and at least one other educational app and confirm they open correctly.
Check that Tux Paint runs fullscreen and the quit button is absent (if you applied the config above).

Troubleshooting

GCompris activities are greyed out

The free version of GCompris-Qt includes all activities but marks some as requiring the paid unlock for offline use. The package from your distro's repo is fully unlocked — if you see greyed activities, confirm you installed gcompris-qt from the official repo, not a Snap or Flatpak that may be the demo build.

Parental Controls option missing from GNOME Settings

The Parental Controls panel only appears when malcontent-ui is installed and you're logged in as an administrator. Confirm both conditions are met, then log out and back in.

DNS filtering not working

Check whether your network manager is overriding resolved.conf. Run resolvectl status and look at the DNS server listed for your active interface. If it shows the router's IP instead of 1.1.1.3, configure the DNS override at the network connection level via NetworkManager: Settings → Network → (connection) → IPv4 → DNS, enter 1.1.1.3, 1.0.1.3, and disable automatic DNS.

Child account can still access the terminal via keyboard shortcut

On GNOME, remove or remap terminal shortcuts under Settings → Keyboard → Keyboard Shortcuts while logged in as admin. You can also uninstall terminal emulators from the system entirely if this is a dedicated kids machine.