Readiness report

Duckietown Duckiebot DB21 · 2026-09-03 18:36 · complete · 19 searches, 15 pages fetched

Download PDF

Cybersecurity — software & network: Do not place on an open network · 5 findings

Details in the Cybersecurity section of the report below.

Readiness: Duckietown Duckiebot DB21

Verdict: Ready with caveats · 2026-09-03 · est. parts cost $524–$817 Cybersecurity — software & network: Do not place on an open network

This is the cold check for this lab — no previous report exists, so every price and stock figure below is the baseline the next run will measure drift against. The robot is a commercial product and you can buy it today: the vendor lists the complete DB-J kit from $429 and sells every custom part separately, so nothing in the bill of materials is unobtainable. Three caveats keep it out of a clean "Ready". The Jetson Nano Developer Kit — the only compute module this lab's software supports — sits on a platform line NVIDIA has formally closed, and now reaches buyers only through marketplace sellers at $95–$387.89. Every Duckietown-specific part (Hut, bumpers, chassis, battery, harnesses) has exactly one supplier worldwide, with no second source to fall back on. And six of the ten representative fastener part numbers recorded in the snapshot are stocked by no ECIA-authorized distributor — all commodities with easy equivalents, but the documented part numbers are going stale.

Action required

Part Problem Recommended action
NVIDIA Jetson Nano Developer Kit Platform end-of-life: NVIDIA's Jetson Linux R32.7.6 page states "Jetson Linux R32.7.6 with JetPack 4.6.6 marks the final release for Jetson Linux R32 and JetPack 4". No authorized-distributor stock found; marketplace prices range $95.00–$387.89 for nominally the same kit. Buy now for any class you intend to run in the next few years, and buy spares — supply only tightens from here. Verify each listing is a new, authentic 4GB unit (official SKU 945-13450-0000-100 was priced at $175.00). Plan the eventual migration to the vendor's DB26-J (Jetson Orin Nano, $749) as a lab rebuild, not a part swap.
Spacer M6 x 12 x 1.5 mm The snapshot's representative part number is mis-specified, not merely unstocked: Essentra 17W06001 is a "FLAT WASHER, .500 ID, .600 OD" — a 12.7 mm bore that cannot accept an M6 fastener. ECIA shows 0 distributors with stock and a 4-week factory lead time. Ignore the recorded part number and buy any M6 x 12 x 1.5 mm nylon or metal washer, which is what the lab actually requires. Correct the part number in the lab's documentation.
Nylon screw M2 x 8, nylon screw M2.5 x 12, nylon nut M2.5, nylon nut M2, metal nut M3, metal screw M3 x 30 Six representative MPNs (Essentra 012008005303, 012512005303, 042500000003, 042000000003, Würth 709303000, Bulten M3X30 DIN 7985) returned no DigiKey product and no ECIA-authorized distributor. All are commodities with wide latitude in the snapshot. Buy a nylon metric assortment (from $5.71) plus an M2.5-specific kit for the 14-off screw line, and standard DIN 7985 M3 x 30 mm stainless screws (from $1.45).
Camera mount Easy ordering mistake: the vendor's chassis page states "The camera mount is not included in this chassis set", and the camera's calibration geometry depends on this bracket. Order it separately from "Duckiebot (DB-J) individual chassis components" ($7) whenever you buy the $45 chassis set.
Duckiebattery Specification conflict: the snapshot calls for "minimum 4.5 A total output capacity across ports", but the vendor's own page for the actual part says "2x USB type A 5V at up to 4A combined". Use the genuine Duckiebattery ($69). Do not size a third-party power bank against the snapshot's 4.5 A figure — it appears to be an error in the lab's documentation.

Cybersecurity — software & network

Do not place on an open network — Two unauthenticated network services (a remote Docker daemon that grants root-equivalent control and an open ROS 1 message bus) sit on an end-of-life ROS release, and none of it has a fix beyond network isolation.

Component Version How known Support status
Ubuntu Linux (NVIDIA JetPack / L4T on Jetson Nano) 18.04 inferred (Not stated in the lab's own files; inferred from the Jetson Nano platform the snapshot specifies — the final JetPack/L4T line that supports the Nano ships a filesystem based on Ubuntu 18.04) extended/LTS support only until 2028-04-26
ROS Noetic Ninjemys noetic inferred (snapshot: the lab's documentation names ROS Noetic Ninjemys; no version file pinning it was fetched) unsupported since 2025-05-01
Docker Engine not determined not determined —
Duckietown Shell (dts) not determined unpinned (snapshot: host CLI whose dependencies are resolved and pulled dynamically at run time) —
ruamel.yaml 0.18.5 read from project (dependencies-py3.txt (duckietown/dt-core@ente)) —
comptests-z6 6.0.4 read from project (dependencies-py3.txt (duckietown/dt-core@ente)) —
procgraph-z6 6.1.9 read from project (dependencies-py3.txt (duckietown/dt-core@ente)) —
ros-node-utils 2.0.0 read from project (dependencies-py3.txt (duckietown/dt-core@ente)) —
compmake-z6 6.1.5 read from project (dependencies-py3.txt (duckietown/dt-core@ente)) —
filterpy 1.4.5 read from project (dependencies-py3.txt (duckietown/dt-core@ente)) —
simple-pid 2.0.1 inferred (dependencies-py3.txt declares the range <=2.0.1, not an exact pin; 2.0.1 is the ceiling of that range) —
numpy-quaternion 2023.0.4 read from project (dependencies-py3.txt (duckietown/dt-core@ente)) —
dt-apriltags 3.1.7 read from project (dependencies-py3.txt (duckietown/dt-core@ente)) —
duckietown-utils-ente 7.0.0 read from project (dependencies-py3.txt (duckietown/dt-core@ente)) —
lib-dt-modeling 0.0.5 read from project (dependencies-py3.txt (duckietown/dt-core@ente)) —
lib-dt-motion-planning 0.0.1 read from project (dependencies-py3.txt (duckietown/dt-core@ente)) —
lib-dt-computer-vision not determined unpinned (dependencies-py3.txt installs it from git branch @ente with no commit hash, so the code installed changes over time) —
lib-dt-state-estimation not determined unpinned (dependencies-py3.txt installs it from git branch @ente with no commit hash, so the code installed changes over time) —
ROS and system APT packages (dependencies-apt.txt) not determined unpinned (24 of 24 entries in dependencies-apt.txt carry no version constraint; whatever the distribution serves at build time is installed) —
Component Finding Severity Fix available?
Docker Engine The robot's Docker daemon is reachable over the network so the workstation can drive containers with docker -H .local, and the lab's files describe no authentication or TLS on that port — an unauthenticated Docker daemon lets anyone who can reach it run code as root on the robot. posture Mitigation only — keep the robots on an isolated lab network or VLAN, and enable Docker's TLS client-certificate authentication (port 2376) instead of the plain TCP socket (2375).
ROS and system APT packages (dependencies-apt.txt) Dependencies unpinned: 24 of 24 in dependencies-apt.txt — including the network-facing ros-noetic-* packages — so the versions actually installed change with the distribution and have no checkable security state. posture Mitigation only — pin versions / use the lockfile
ROS distributed network ROS 1 master and node traffic crosses the network to remote diagnostic tools with no authentication or encryption, so anyone on the same network can read the robot's camera and sensor topics or publish to its motor topics. posture Mitigation only — run the robots on an isolated network segment and do not expose the ROS master beyond it.
ROS Noetic Ninjemys ROS Noetic reached end of life on 2025-05-01, so the middleware the whole robot runs on receives no further security fixes from upstream. posture No — requires platform migration
SSH service An SSH daemon listens on port 22 and the lab's documentation hands students a standard account name (duckie@.local) while never stating what the password is, so a vendor default may be in place across every robot in the class. posture Mitigation only — set a unique strong password or key-only authentication on every robot before it joins a network.

What this means for your lab

Treat these robots as untrusted devices and keep them off the campus network. Each Duckiebot answers to SSH on the usual port with a standard student account whose password the course materials never state, and its Docker service accepts commands over the network with nothing in the lab's setup requiring a password or certificate — between them, anyone else on the same Wi-Fi can log in or start their own software on the robot with full administrative rights. The ROS messaging the robot uses for its camera, sensors and motors is also unauthenticated, so a bystander on that network can watch the camera feed or send the robot driving commands. Nothing here is a flaw in the robot's own Python libraries: all eleven pinned Python packages were checked against the vulnerability database this run and came back clean. The problems are the setup and its age — the ROS Noetic release everything runs on stopped receiving security fixes in May 2025, and the Ubuntu base is past its ordinary support window. The practical answer is a dedicated, isolated Wi-Fi network or VLAN for the Duckiebots that does not reach the rest of the campus, a unique password set on every robot before it is switched on in a shared space, and a conversation with campus IT before any of these devices touch an institutional network.

Not checked

  • ROS and system APT packages (24 entries in dependencies-apt.txt): Unpinned — no exact version to check against an advisory database.
  • simple-pid: dependencies-py3.txt declares a range (<=2.0.1) rather than an exact pin, so no single version could be checked.
  • lib-dt-computer-vision, lib-dt-state-estimation: Installed from a git branch (@ente) with no commit hash; there is no released version to look up.
  • Docker Engine: Version not stated anywhere in the lab's files.
  • Duckietown Shell (dts): Version not stated; its dependencies are resolved dynamically at run time.
  • Ubuntu Linux / JetPack board-support package: The lab's files do not state the JetPack or L4T version, so only the Ubuntu base could be placed on a support cycle and the vendor kernel and drivers were not checked.

Parts

Compute, Carrier Boards, and Active Electronics

Part Spec/Package Status Stock Price Source
NVIDIA Jetson Nano Developer Kit 2GB or 4GB SBC, 5 V rail, 2–4 A Obsolete platform; available but overpriced Marketplace only; no authorized stock found $175.00 (SKU 945-13450-0000-100) — range $95.00–$387.89 Google Shopping
Duckietown Hut v3.15 Custom carrier / motor+LED driver PCB Readily available (sole source) Listed $35.00 Duckietown store
Front Bumper (FB) PCB Custom curved LED PCB Readily available (sole source) Listed $14.00 Duckietown store
Back Bumper (BB) PCB Custom curved LED PCB Readily available (sole source) Listed $14.00 Duckietown store
Inertial Measurement Unit (IMU) I2C breakout, 3.3 V not checked — ships in kit, no standalone SKU — — —
Time of Flight (ToF) Range Sensor VL53L0X/VL53L1X family, I2C not checked — ships in kit, no standalone SKU — — —
Jetson Nano Camera Module Wide-angle CSI-2, cable attached Readily available (sole source) Listed $24.00 Duckietown store
DC Motors with Encoders (x2) 5 V DC, 137 ticks/rev, metal or plastic shaft Readily available (sole source) Listed $10.00 each Duckietown store
Auxiliary Status Screen I2C OLED/LCD module not checked — ships in kit, no standalone SKU — — —
Shutdown Button Momentary NO push button + harness not checked — ships in kit, no standalone SKU — — —
DC Cooling Fan 5 V, 40x40x10 mm axial Readily available In stock $1.85 — 2-pack $9.49 Google Shopping

Power Supply, Networking, and Storage

Part Spec/Package Status Stock Price Source
Duckiebattery 10 Ah at 3.7 V (37 Wh); 2x USB-A 5 V up to 4 A combined; pass-through Readily available (sole source) — see spec note in Action required Listed $69.00 Duckietown store
Wi-Fi Dongle USB-A, 802.11ac dual band Plausible, unverified — Linux for Tegra driver support not confirmed In stock $12.99 (Cudy AC1300) — range $7.99–$29.99 Google Shopping
Micro SD Card, 64 GB Class 10 U3 MicroSDXC, UHS-I U3 Readily available In stock $29.23 (SanDisk Extreme SDSQXVF-064G-AN6MA) — from $12.99 Google Shopping
Micro SD to USB Adapter USB-A card reader Readily available In stock $5.99 (Lexar USB 3.2) Google Shopping

Chassis Structural Components and Mechanics

The vendor sells the chassis two ways: the Complete Duckiebot Chassis (DB-J) at $45 (three sheets of acrylic), or individual chassis components from $7.

Part Spec/Package Status Stock Price Source
Bottom deck Laser-cut acrylic plate Readily available Listed In $45 chassis set Duckietown store
Lower lateral supports (x2) Vertical side plates Readily available Listed In $45 chassis set Duckietown store
Middle deck Horizontal mounting deck Readily available Listed In $45 chassis set Duckietown store
Upper-left lateral support Vertical structural plate Readily available Listed In $45 chassis set Duckietown store
Upper-right lateral support Vertical structural plate Readily available Listed In $45 chassis set Duckietown store
Back support Vertical rear plate Readily available Listed In $45 chassis set Duckietown store
Top deck Top mounting platform Readily available Listed In $45 chassis set Duckietown store
Back pattern plate AprilTag mounting plate Readily available Listed In $45 chassis set Duckietown store
Motor mounts (x2) Gearmotor brackets Readily available Listed In $45 chassis set Duckietown store
Camera mount Angled calibrated bracket Readily available — NOT in the chassis set Listed From $7 (individual components) Duckietown store
Omni-wheel (rear caster) Omnidirectional caster; v3 uses an updated design not checked — in kit, not in the chassis set, no standalone SKU — — —
Front wheels (x2) Rubber-treaded drive wheels on D-shafts not checked — in kit, no standalone SKU — — —

Wiring Harnesses and Interconnects

All ten harness lines appear in the vendor's published "What's in the box" contents for the DB-J kit, but none is sold under a standalone SKU in the public catalogue, so none could be independently priced this run. Obtain them as vendor spares.

Part Spec/Package Status Stock Price Source
Camera cable CSI-2 FFC, 15-pin 1.0 mm pitch not checked separately — the $24 camera ships "with attached cables of appropriate length for each robot model" — — —
Jetson to Battery cable USB-A to DC barrel, ≥ 3 A not checked — no standalone SKU — — —
Battery to HUT (Ext5V) power cable USB-A to polarized connector, ≥ 2 A not checked — no standalone SKU — — —
HUT to Battery charging cable Charging harness not checked — no standalone SKU — — —
HUT to BB cable Multi-conductor keyed harness not checked — no standalone SKU — — —
Motor to HUT cables (x2) 6-wire motor + encoder harness not checked — no standalone SKU — — —
FB to ToF cable 4/6-pin I2C interconnect not checked — no standalone SKU — — —
HUT to FB, IMU cable (x3) I2C + power harness not checked — no standalone SKU — — —
Screen to HUT cable 4-wire I2C ribbon not checked — no standalone SKU — — —
Button to HUT cable 2-wire harness not checked — no standalone SKU — — —

Fasteners, Hardware, and Spacers

Part Spec/Package Status Stock Price Source
Metal stand-off M2.5 x 18 mm + 6 mm M-F (x3) Würth Elektronik 970180244, Active Readily available 1,126 $0.81 DigiKey
Metal hexagon stand-off M3 25 mm F-F (x3) Würth Elektronik 970250324, Active Readily available 824 $0.92 DigiKey
Spacer M6 x 12 x 1.5 mm (x2) Snapshot example Essentra 17W06001 is a ".500 ID, .600 OD" flat washer — does not match M6 Representative MPN mis-specified; requirement itself is a commodity 0 across 5 ECIA distributors, 4-week lead time $0.04943 (17W06001, spec mismatch) DigiKey / ECIA
Nylon screw M2 x 8 mm (x4) Essentra 012008005303 — no product, no ECIA distributor Exact MPN unavailable; commodity substitute — Assortment from $5.71 Google Shopping
Nylon screw M2.5 x 12 mm (x14) Essentra 012512005303 — no product, no ECIA distributor Exact MPN unavailable; commodity substitute — M2.5 Nylon Screw/Nut Kit (100) $14.99 Google Shopping
Round head tapping screws metal 3 x 20 mm (x2) Self-tapping, 3 mm x 20 mm not checked — no lookup dispatched — — —
Metal screw M3 x 30 mm (x4) Snapshot example Bulten M3X30 DIN 7985 — no product, no ECIA distributor Exact MPN unavailable; commodity substitute — $1.45 (DIN 7985A stainless) Google Shopping
Metal screw M3 x 12 mm (x30) DIN7985M3X12A2-70 (Honeywell), Active, "PAN HEAD MACHINE SCREW; ISO 7045" Available; no stock figure reported Not reported $0.6006 DigiKey
Metal nut M3 (x30) Würth Elektronik 709303000 — no product, no ECIA distributor Exact MPN unavailable; commodity substitute — In metric assortment from $5.71 Google Shopping
Nylon nut M2.5 (x16) Essentra 042500000003 — no product, no ECIA distributor Exact MPN unavailable; commodity substitute — M2.5 Nylon Screw/Nut Kit (100) $14.99 Google Shopping
Nylon nut M2 (x4) Essentra 042000000003 — no product, no ECIA distributor Exact MPN unavailable; commodity substitute — In metric assortment from $5.71 Google Shopping

Tools, Calibration Artifacts, and Ephemera

All seven ship with the kit; none was separately priced this run.

Part Spec/Package Status Stock Price Source
Cross screwdriver PH0 / PH1 Phillips not checked — commodity, no lookup dispatched — — —
Camera calibration pattern Rigid 1:1 printed checkerboard/AprilTag target not checked — printable artifact, no hosted file located — — —
Back pattern sticker AprilTag 36h11, per-vehicle ID not checked — vehicle-specific, not a generic purchase — — —
FCC label sticker Regulatory label not checked — informational only — — —
Duckies (x2) Miniature rubber ducks not checked — commodity, no lookup dispatched — — —
Instructions card Printed leaflet not checked — ships with kit — — —
Duckietown Stickers (x2) Adhesive decals not checked — cosmetic only — — —

Substitutes

For part Substitute Differences Verified Judgment
NVIDIA Jetson Nano Developer Kit Jetson Orin Nano, as the vendor's DB26-J $749, or the Orin Nano Super Developer Kit $399.00 Different GPU architecture (Ampere vs the Maxwell GPU the dt-core image relies on), different Tegra driver line, different JetPack major version. The snapshot requires "an NVIDIA Jetson Nano (2GB or 4GB) or pin-compatible Jetson carrier". verified: end-of-life status of the JetPack 4 / L4T R32 line supporting Jetson Nano (NVIDIA L4T R32.7.6 release page, fetched this run); retail prices (Google Shopping, this run). not verified: mechanical or electrical pin compatibility of any Orin carrier with Hut v3.15 — no parametric evidence obtained. HARD STOP as a part-level swap. The DB26-J is a whole-lab migration path, not a drop-in replacement for this BOM.
Spacer M6 x 12 x 1.5 mm Any M6 x 12 x 1.5 mm nylon or metal washer The snapshot's own latitude is "any nylon or metal washer with matching M6 clearance and 1.5 mm thickness". The recorded MPN (17W06001, ".500 ID, .600 OD") does not meet that spec — a generic M6 washer meets it better than the documented part. verified: lifecycle, price and distributor stock for 17W06001 and 17W06001B (DigiKey + ECIA, this run). not verified: dimensional match to M6 x 12 x 1.5 mm — the only dimensional data returned contradicts it, and DigiKey returned no parameters block for either part. Acceptable. The documented part number is the defect; the requirement itself is a hardware-store commodity.
Nylon screw M2 x 8 mm; nylon nut M2; metal nut M3 Nylon/metric fastener assortment, 150 pcs M2–M5, $5.71; also 150 pcs kit $8.55 Thread sizes and non-conductive nylon material match the snapshot's stated latitude ("any non-conductive nylon M2 x 8 mm screw", "standard M3 hex nut"). No electrical or mechanical requirement beyond thread and material. verified: the exact MPNs are stocked by no ECIA-authorized distributor (DigiKey + ECIA, this run), and these assortments are currently offered at the listed prices (Google Shopping, this run). not verified: that any specific assortment contains the M2 x 8 mm length or the M3 nut count needed — no product page was fetched. Acceptable with a caveat: confirm the length and count breakdown on the listing before ordering for a class set.
Nylon screw M2.5 x 12 mm; nylon nut M2.5 M2.5 Nylon Screw/Nut Kit (100), $14.99; Adafruit black nylon M2.5 screw and stand-off set, $16.95 M2.5 thread and nylon material match the snapshot's latitude. This is the highest-count nylon line in the BOM (14 screws, 16 nuts), so a dedicated M2.5 kit is the sensible buy rather than a mixed assortment. verified: exact MPNs unstocked (DigiKey + ECIA, this run); kit prices current (Google Shopping, this run). not verified: that either kit contains the 12 mm length specifically — no product page was fetched. Acceptable with a caveat: check the 12 mm length is included before ordering.
Metal screw M3 x 30 mm DIN 7985A stainless M3 pan head, $1.45; stainless DIN 7985 M3 x 30 mm, $2.02 Same DIN 7985 pan-head standard and M3 x 30 mm dimensions the snapshot names; stainless rather than an unstated Bulten finish. The snapshot's latitude is "standard M3 x 30 mm pan or socket head machine screw". verified: no authorized-distributor listing for the representative MPN (DigiKey + ECIA, this run); DIN 7985 M3 x 30 mm stainless screws currently offered at the listed prices (Google Shopping, this run). not verified: head drive type and material grade of the specific listings — neither product page was fetched. Acceptable. Dimensionally and standards-wise a match to what the lab specifies.

Verify any substitute against its datasheet or product listing before ordering — the "not verified" claims above were not confirmed by this check.

Other dependencies

  • Online hardware store — live. https://get.duckietown.com/products/duckiebot-db21 was fetched this run and returns the DB-J product with its full published contents; the vendor's catalogue prices it from $429. The specific ?variant=41543707099311 id recorded in the snapshot was not separately confirmed — variant ids are volatile, so order from the product page rather than the stored deep link.
  • A newer robot model now exists. The vendor lists Duckiebot (DB26-J) at $749: "This DB26J model is the latest of the Jetson line and supports Jetson Orin Orin Nano Developer kits." Worth tracking as the eventual replacement platform for this lab.
  • PCB fabrication — not applicable in practice. The snapshot records that Gerbers, schematics and layer counts for the Hut, FB and BB boards are absent from the source repository. That is not a blocker: all three are sold as finished goods at the prices above, so there is a purchase path rather than a fabrication path.
  • Chassis fabrication — not applicable in practice. The snapshot records that CAD vector drawings are not included in the package. The vendor sells the finished chassis; its product page describes the $45 complete set as three sheets of acrylic.
  • Camera calibration pattern — not checked. A printable artifact requiring exact 1:1 scale on rigid, non-reflective stock. No hosted file was located or fetched this run.
  • Back pattern sticker (AprilTag 36h11) — not checked. Tied to a per-vehicle ID rather than a catalogue item.

Watch list

  • NVIDIA Jetson Nano Developer Kit — the single biggest risk to this lab. Its software line is formally closed, no authorized distributor stocks it, and marketplace prices already span $95.00–$387.89 for nominally the same product. Expect prices to climb and authenticity to get harder to judge. Buy spares now.
  • Duckiebattery — sole-sourced, and no generic power bank can be shown from search evidence to meet the simultaneous-high-current and USB-diagnostics requirements the dt-core battery driver expects. A supply gap here has no workaround.
  • Every Duckietown-proprietary part (Hut v3.15, FB/BB bumper PCBs, chassis set, camera, motors, and all ten harnesses) — one vendor worldwide, no second source. The harnesses are the weakest link: they are not even individually listed in the public catalogue.
  • The snapshot's fastener part numbers — six of ten representative MPNs are already unstocked by every ECIA-authorized distributor, and the M6 spacer number is simply wrong. These should be corrected in the lab's documentation rather than re-checked each run.
  • Wi-Fi dongle driver support — the substitution hinges on in-kernel Linux for Tegra support, which was not verified this run. If the kit's original dongle becomes unavailable, confirm the chipset against the kernel before buying a class set.
  • Omni-wheel revision — the snapshot notes the DB21J4(v3) revision after September 2025 uses an updated omnidirectional wheel design; confirm which revision a replacement matches.