Minimal CUPS for Local-Only Printing without Network Access?

[ghost]

No Network Access CUPS Configuration?

For a strictly local (no network discovery, no sharing, or network access) CUPS installation with driverless printing support, what packages can users safely remove or install with dummy packages?

Setup

• debian 13
• Any linux with systemd

Other info related

• I already disabled cups-browsed service
• I only print via USB printer cable

---

Is this table about what is safe to remove correct?

Package	What It Does	Safe to Remove?
cups	Meta-package that pulls in the full CUPS suite	No — keep this
cups-daemon	The core CUPS scheduler (cupsd)	No — absolutely required
cups-client	CLI utilities (lpadmin, lp, lpq, etc.)	No — needed for queue management
cups-common	Common data files and MIME types	No — required by daemon
cups-core-drivers	Driverless printing support (IPP Everywhere, AirPrint)	No — essential for driverless
cups-server-common	Server configuration files and web interface templates	No — required by cups-daemon
libcups2t64	Core CUPS library	No — required by everything
libcupsimage2t64	Image processing library for CUPS	No — required for filtering
cups-filters	Legacy print job filters (PDF → raster, etc.)	Keep — needed for non-PDF input
cups-filters-core-drivers	Driverless PPD generation and driverless utility	No — critical for driverless printing
libcupsfilters1t64	Library for cups-filters	No — required by filters
cups-ipp-utils	IPP developer/admin tools (ipptool, ippfind, ippserver)	Yes — only needed for IPP debugging or network printer discovery
cups-ppdc	PPD compiler and manipulation utilities	Yes — only needed to compile/build PPDs
cups-pk-helper	PolicyKit helper for GUI printer management	Yes — only needed for GUI tools like system-config-printer
printer-driver-hpcups	HP-specific printer driver	Yes — only needed for legacy HP printers that aren't IPP Everywhere

sudo apt remove --purge cups-ipp-utils cups-ppdc cups-pk-helper printer-driver-hpcups
sudo apt autoremove

Then mkdir -p /etc/systemd/system/cups.service.d/ to add 99-cups-nonet.conf

[Service]
# Network Isolation
PrivateNetwork=yes
IPAddressDeny=any
RestrictAddressFamilies=AF_UNIX
SocketBindDeny=any
RestrictNamespaces=yes

# Filesystem & Process Isolation
ProtectSystem=strict
ReadWritePaths=/etc/cups /var/log/cups /var/spool/cups /var/cache/cups /run/cups
ProtectHome=yes
PrivateTmp=yes
NoNewPrivileges=yes

---

Upstream Hardening?

Has upstream provided any default hardening the shipped CUPS service? If they have can someone point me to this?