Prerequisites

What each machine needs:

Step	Controller	Remote endpoint
Install Python	✓	✓
Create a virtual environment	✓	✓
Install Git	✓
Allow remote endpoint traffic		✓

Install Python

Orcraft runs on Python 3.14 or newer. Where to install it from:

OS	Install from
Windows	python.org: the Python install manager, its three questions answered with the defaults; or the classic installer, the smaller link beside the button, with Add python.exe to PATH selected
Linux	The package manager: `sudo add-apt-repository -y ppa:deadsnakes/ppa && sudo apt update && sudo apt install -y python3.14 python3.14-venv`
macOS	python.org: the macOS installer

Then open a new terminal and verify:

On Windows, first make sure PowerShell does not block the activation script. Run this in the terminal you work in; it applies to that terminal only:

Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned

Then run these in the folder you want to work from:

Step	Windows	Linux	macOS
Create	`python -m venv .venv`	`python3.14 -m venv .venv`	`python3 -m venv .venv`
Activate	`.venv\Scripts\activate`	`source .venv/bin/activate`	`source .venv/bin/activate`

Activate the environment in every new terminal before running Orcraft.

The controller clones the tutorial suite, and any suite kept in a repository, with git:

OS	What to do
Windows	`winget install --id Git.Git -e`, or Git for Windows with its defaults
Linux	`sudo apt install git` on Debian and Ubuntu; another distribution's package manager otherwise
macOS	Accept Apple's command line tools, which the first `git` call offers

Then open a new terminal and verify:

git --version

Needed only for remote endpoints. On each one, open the port it listens on and allow ping from the controller.

Endpoint OS	What to do
Windows	`New-NetFirewallRule -DisplayName 'Orcraft Endpoint' -Direction Inbound -Protocol TCP -LocalPort 50051 -Action Allow` in a PowerShell run as administrator
Linux	`sudo ufw allow 50051/tcp` with `ufw`; `firewalld`, `nftables` or `iptables` open the port their own way
macOS	Allow incoming connections when macOS prompts the first time the endpoint runs

Using a different port? Select it with -port, use that number in the rule, and enter the same port when adding the endpoint in the controller.

The controller pings each endpoint before connecting to it. Most networks already allow this - do this only if an endpoint shows Offline:

Endpoint OS	What to allow
Windows	`Set-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv4-In)" -Enabled True -Profile Any` in a PowerShell run as administrator (the ICMPv6 rule the same way on an IPv6 network)
Linux	ICMP in `ufw`, `firewalld`, `nftables` or `iptables`
macOS	Incoming ping in the firewall; "Block all incoming connections" must be off

Next: Getting started. Preparing an offline, minimal or managed machine? See the System reference.