Readiness: Donkey Car Self-Driving RC Platform

Verdict: Ready with caveats · 2026-09-03 · est. parts cost $420–$580 (required items; 3D-printed parts and the optional LiPo kit excluded) Cybersecurity — software & network: Do not place on an open network

This is the cold check for this lab — there is no previous report, so the prices and stock levels below establish the baseline that future checks will measure drift against. Every part on the required bill of materials can be bought today and nothing is obsolete, but two of the three most expensive lines have moved away from what the lab's own build page assumes. The specified chassis (Exceed Magnet 1/16 Truck / HSP-94186) returned no US retail listing in two separate shopping passes, and the Donkey Car build page itself says these cars are "often ... out of stock" and that the HSP-94186 "can be found on AliExpress but takes about a month to get to the US" — a documented alternative, the WL Toys 144010, is plentiful but costs more and needs 3D-printed body-post adapters. The Raspberry Pi 5 8GB is in deep stock (17,329 pcs at DigiKey) but at $175.00 against the $60 the build page budgets, and no ECIA-authorized distributor shows stock against the snapshot's order code SC1112. Everything else — the PCA9685 driver, the wide-angle camera, jumper wires, power bank, SD card and fasteners — is readily available at sensible prices. Plan on a chassis decision and roughly double the documented budget.

Action required

Cybersecurity — software & network

Do not place on an open network — The driving interface is an unauthenticated web service exposing a camera stream and vehicle control to everyone on the subnet, and the project offers no authentication to switch on - only network isolation.

What this means for your lab

Treat the car as an open device on whatever network you join it to. Donkey Car's driving interface is a small web server on port 8887 that hands out a virtual joystick and a live camera feed, and nothing in the lab's materials asks anyone to log in first - so any person on the same Wi-Fi can open it in a browser, watch the camera, and steer the vehicle. The car also has SSH switched on, and optionally a remote-desktop (VNC) service, protected only by whatever password each student typed while writing the SD card. The software itself is in reasonable shape: the operating system (Debian 13) and Python 3.13 are both still supported, and the versions this check could pin down came back clean apart from one low-severity PyTorch issue that only touches the machine you train models on. The bigger practical problem is that the project fixes almost none of its dependency versions, so what a student installs today and what they install next month may differ, and neither can be checked in advance. Practical steps: put these cars on their own network segment or a dedicated access point rather than the campus network, insist on strong individual passwords at imaging time (SSH keys are better), leave VNC off unless a student actually needs a desktop, and talk to campus IT before connecting the cars to anything shared.

Not checked

• donkeycar (core application): Version is dynamic in pyproject.toml (version = {attr = "donkeycar.version"}), so no release version could be read from the manifest to check.
• uv (Astral): No version stated in the snapshot or any fetched file; installed from a live install script.
• tornado and 44 other unpinned PyPI dependencies (pillow, requests, pandas, matplotlib, opencv-contrib-python, kivy, paho-mqtt, pyserial and the rest): Declared in pyproject.toml with no version constraint, so there is no version to check against OSV.
• matplotlib and pandas: The snapshot recorded pins of 3.7.* and 2.0.*, but pyproject.toml as fetched this run declares both with no version constraint, so the snapshot's versions were not checked - the manifest has changed since the snapshot was written.
• python3-libcamera, python3-picamera2 (apt): Unpinned apt packages whose version comes from the Raspberry Pi OS release; no version stated in the sources.
• Raspberry Pi OS package inventory: Only the two apt packages the lab names were considered; the OS image's own package set was not enumerated.
• setuptools / wheel (build backend): build-system.requires lists both with no version constraint.

Parts

Substitutes

Verify any substitute against its own datasheet or product page before ordering — the comparisons above are only as good as the evidence gathered on the date of this report.

Other dependencies

• Donkey Car documentation portal (https://docs.donkeycar.com) — live; the full build page was fetched this run and still documents the parts list, print settings and PCA9685 wiring the snapshot records.
• Donkey Car source repository (https://github.com/autorope/donkeycar) — live; repository root listed this run (13 entries, default branch main).
• Donkey Car documentation repository (https://github.com/autorope/donkeydocs) — live; README fetched this run.
• Thingiverse model thing:2566276 (top plate, roll cage and chassis adapter STLs) — not checked; the page downloaded but returned no readable text (JavaScript-rendered), so the model's continued availability could not be confirmed automatically. Verify by hand before a class relies on it.
• Donkey Car Store (https://donkeycar-701334.square.site) — not checked; downloaded but no readable text, so pre-printed part availability is unconfirmed.
• NitroRCX Exceed vehicle catalog (https://www.nitrorcx.com/1rcelca.html) — not checked; downloaded but no readable text.
• DIY Robocars Waveshare PiRacer Pro guide — live, fetched this run; it quotes the pre-assembled PiRacer Pro at $268 and warns it ships with outdated Donkey Car software.
• DIY Robocars 1/28-scale build guide — live, fetched this run; quotes a complete 1/28 build at "less than $150".
• Mini RC Hat store page (https://diyrobocars.myshopify.com/products/mini-rc-hat-for-raspberry-pi-zero-2-w) — live and in the catalog at $24.00 (needed only for the 1/28-scale variant).
• Raspberry Pi camera documentation (https://www.raspberrypi.com/documentation/accessories/camera.html) — not checked; the fetch was blocked.
• Astral uv installer (https://astral.sh/uv/install.sh) — not checked this run.
• Fabrication — FDM printing in PLA only (0.2–0.3 mm layers, 0.5 mm nozzle, no supports, roll cage printed inverted); post-processing means re-drilling the M2, M2.5 and M3 through-holes and clearing the roll-bar side slots. No custom PCB gerbers exist for this build, so there is no board-fab dependency.

Watch list

• The chassis. This is the line most likely to break the lab. The specified Exceed Magnet / HSP-94186 already has no US retail presence, and the substitute (WL Toys 144010) is a different manufacturer on a different product cycle. Re-check both before every cohort, and keep printed adapters on hand.
• Raspberry Pi 5 8GB pricing. At $175 against a documented $60, and with zero authorized-distributor stock on the SC1112 order code, this is the single biggest cost risk. Watch whether the DigiKey price moves and whether other distributors restock.
• The wide-angle camera cable. The Pi 5 uses a 22-pin 0.5 mm FPC while the Pi 4 uses a 15-pin 1.0 mm one; which cable ships in the Camera Module 3 Wide box was not verified this run. Confirm before a bulk order.
• Power bank output current. No listing stated a continuous output rating. The Pi 5 wants 5 V at 3–5 A, and several cheap Anker 10,000 mAh units are USB-C input only. Verify the specific model each time.
• 3D model hosting. Thingiverse and the Donkey Car Store could not be read automatically two ways this run. If the model ever disappears, the whole mechanical build stops — keep a local copy of the STLs.