Readiness: OctoPrint 3D Printer Control Station

Verdict: Ready with caveats · 2026-09-03 · est. parts cost $266–$806 (the 3D printer itself is $169–$649 of that; the control station on its own is roughly $97–$157) Cybersecurity — software & network: Do not place on an open network

This is the cold check for this lab — there is no previous report, so everything below is the baseline the next check will measure drift against. The station is almost entirely commodity hardware and every required part can be ordered today: the Raspberry Pi 4 Model B is in stock at $55.00, the official 5.1 V / 3 A power supply at $8.00, and the printer cable at $2.26. Two of the snapshot's example part numbers are not catalog numbers and were replaced by their catalog siblings (details in Substitutes). The one real problem is the optional Raspberry Pi Camera Module 3, which is out of stock at every authorized distributor checked with 9–26 week factory lead times; the snapshot itself accepts any UVC USB webcam instead, and those are plentiful. Three items are cheap and in stock but arrive with one unverified attribute each — the power supply's output connector, the cable's shielding, and UVC compliance of any specific webcam — none of which blocks the build, all of which the instructor should confirm at the cart.

Action required

Cybersecurity — software & network

Do not place on an open network — The image ships documented default SSH credentials and an unauthenticated camera stream on port 8080, and OctoPrint's own security policy declares exposure beyond a private trusted network unsupported — network isolation is the control here, not a patch.

What this means for your lab

Treat this station as an appliance that anyone on the same network can reach. As shipped, the OctoPi image has a published default login (user 'pi', password 'raspberry') for remote shell access, and the webcam stream on port 8080 has no password at all — so a person on the campus network could watch the printer's camera, and, if the default password has not been changed, log into the machine and send commands to the printer, including moving the head and heating the nozzle and bed. The web interface is reachable over plain HTTP on port 80, and the HTTPS option uses a self-signed certificate that will make every browser warn students to click through a security error. OctoPrint's own maintainers state that the software is built only for private, trusted networks and that putting it on the open internet is unsupported and dangerous. Practical steps before students use it: change the default password on first boot, put the station on an isolated or segmented lab network rather than the general campus network or the internet, never forward ports to it from outside, and talk to campus IT before connecting it. Build stations from a Debian 12 or Debian 13 based image — a Debian 11 (Bullseye) build no longer receives security updates at all. One more thing to know rather than to fix: because the image installs whatever version of OctoPrint and its libraries is current on the day it is built, two stations built months apart are not running the same software, so record what each one has and re-check it after every rebuild.

Not checked

• tornado (OctoPrint web layer): the only exact pin available to check, 6.4.2, applies solely to Python 3.8 builds (python_version>='3.8' and python_version<'3.9'); a current build takes the range tornado>=6.5.1,<6.6 instead, and the version it resolves to was not determined this run — so the advisories recorded against 6.4.2 in the evidence do not describe this lab
• OctoPrint Python dependency stack (62 range-specified rows): specified as ranges rather than pins; no exact version exists in the project to check against the advisory database
• mjpg-streamer: installed from a moving master.zip branch archive; no version to check and no advisory database covers this source-only C project
• CustomPiOS: unpinned git clone with no tag or commit hash recorded
• Python 3 runtime: the virtualenv is built from the image's system python3; that version was not determined this run
• Raspberry Pi OS Lite armhf image: downloaded through the rolling 'latest' alias, so no image release is pinned; only its Debian base was established
• Image build APT packages (gawk, util-linux, qemu-user-static, git, p7zip-full, python3, jq, sudo) and the runtime apt set (nginx, haproxy, ffmpeg, avahi-daemon, imagemagick, avrdude): installed unpinned by apt; the versions depend on the distribution snapshot at build time and were not determined this run
• Vagrant (> 1.9), VirtualBox, vagrant-nfs_guest, nfs-kernel-server, Docker builder image: build-host tooling only, never on the station; '> 1.9' is a minimum constraint, not a version, so no support-status lookup was possible
• Development toolchain (ruff, djLint, prettier, pre-commit): development-only dependencies with no versions stated in the sources; not present on a student station
• BrowserStack, PyVmMonitor, Sentry: hosted third-party services, not versioned software shipped with the lab

Parts

Substitutes

Verify any substitute against its datasheet or the seller's product page before ordering — the comparisons above rest only on the evidence gathered in this check.

Other dependencies

• Fabrication: none required. The snapshot records no PCB layouts, Gerber files, schematics or STL/STEP files — the station is built entirely from commercial off-the-shelf modules and a pre-manufactured printer. Nothing to check.
• Raspberry Pi OS download host (https://downloads.raspberrypi.org/) — reachable. The release-notes file at this host was fetched successfully during this check.
• Upstream Git repositories — both reachable. github.com/OctoPrint/OctoPrint listed 35 entries at its root and github.com/guysoft/OctoPi listed its src/modules/octopi directory during this check.
• OctoPi distribution download endpoints — not checked. No reachability evidence was gathered for octopi.octoprint.org/latest, the GitHub releases mirror, octopi.gnethomelinux.com, the unofficialpi.org 32-bit and 64-bit nightly build directories, or the two rpi-imager-octopi.json manifests. These are the links an instructor actually downloads the image from, so they are worth a manual click before a class.
• Libre Computer image thread (hub.libre.computer/t/debian-12-bookworm-and-11-bullseye-for-libre-computer-boards/230) — not checked.
• Documentation and community sites — not checked: docs.octoprint.org, plugins.octoprint.org, community.octoprint.org, octoprint.org/security.

Watch list

• Raspberry Pi Camera Module 3 — the only part already in trouble. Zero stock at Newark, Mouser and DigiKey with 9-week and 26-week factory lead times and a High supply-chain risk rating on SC1223. Expect it to still be scarce at the next check; the USB webcam path is the durable answer.
• Raspberry Pi 4 Model B — SC0193(11) returned no stock figure at all this run, and the orderable line is the dual-RAM SKU SC0193(13). Pi 4 board availability and SKU naming have moved before; re-confirm which SC0193 variant is stocked and what RAM it carries.
• SanDisk SDSQUA4-032G-GN6MA — already at zero stock across authorized distribution and rated "Med" supply-chain risk. It will likely stay a retail-only purchase; watch that the Class 10 / UHS-I retail price band stays near $7–$22.
• Libre Computer Le Potato — could not be priced from a primary source this check. If the alternative board matters to the course, establish a real supplier and price before the next run so there is a baseline to compare.
• Consumer 3D printer — the retail band ($169–$649) is stable, but the risk is compatibility rather than price: new consumer models increasingly ship closed firmware without a serial G-code USB port. Confirm serial G-code support for whichever model the program standardises on.