Check the car and harness before choosing openpilot
Buying the wrong harness will stop an openpilot installation before the software gets a chance to help. The project connects comma hardware to a supported car to provide driver assistance. Its README separates the device, software, vehicle, and harness requirements, and points buyers to a vehicle compatibility list. Start there. An open repository doesn't make an unsupported steering or braking system compatible.
The source checkout we measured was 60.8 MB, with 3,540 files and roughly 774,362 source lines. That's useful access for someone studying vehicle integration or contributing code, but the laptop checkout and the in-car installation are different jobs. The README recommends prebuilt release branches for users and labels nightly branches unstable. I would follow that distinction rather than pick a development branch because its name sounds newer.
What happened when we ran it
Our sandbox installed openpilot commit c8fb906 in 27 seconds and built it in 8 seconds on October 1, 2026. Installation added 63 packages and occupied 412 MB. The measurement setup was an unprivileged Debian container using ghcr.io/astral-sh/uv:python3.12-bookworm, with 3 CPUs, 8 GB of RAM, and no secrets. Both recorded steps succeeded. The result gives a contributor a concrete starting point for the path the lab exercised.
Tests were skipped because the lab found no test script or target. Pip-audit reported 0 known vulnerabilities. The scan recorded 9 CI workflow files, no Dockerfile, and no tests directory. These are observations from that run, not a claim that upstream has no testing. A successful build and a clean dependency audit cannot establish how the software behaves when connected to a vehicle. Those 412 MB cover the installed sandbox environment. We did not measure steering behavior, driver monitoring accuracy, or road performance, and there is no vehicle result to report. The missing test target leaves our verification narrower than the green build might suggest. Anyone comparing this page with a driving demonstration should keep that boundary in mind: the container result answers whether our recorded setup path completed.
The supported hardware route is the practical starting point
The official in-car setup requirements direct users to a comma four, the release installer, a supported vehicle, and the matching harness. Other hardware is possible, according to the README, but that route is not plug-and-play. If you want to use the software rather than become a hardware integration contributor, that difference should settle the initial choice.
The 27-second install doesn't include fitting the device or checking your car's supported configuration. Nor does it answer which release branch matches your hardware. The README gives separate branch routes for comma four, comma 3X, and chestnut. Follow the instructions for the actual device you own. A generic shell quick start cannot replace the physical connection instructions or the compatibility notes attached to your vehicle.
Driver supervision remains part of the operating model
Comma's safety concepts describe a system in which the driver must remain attentive and able to take control. The documentation also describes driver override behavior. That is a purchase constraint: someone looking for a way to stop watching the road is shopping for a capability openpilot does not promise. Assess the documented assistance boundaries before deciding whether it solves your particular driving problem.
Our 8-second build supplies no evidence about those safety behaviors in a car. The repository's licensing section calls the software alpha quality for research purposes and places legal responsibility on the user. I would take that wording seriously even alongside the polished device setup. Access to source is valuable for inspection, but it does not turn a sandbox build into an independent assessment of road safety.
Driving data uploads need an explicit decision
The README says openpilot uploads driving data to comma by default and allows users to disable collection. Its logging description includes road-facing camera footage, vehicle messages, and location data. Driver-facing camera and microphone logging require an explicit opt-in. Those details matter if the car belongs to an employer, carries clients, or is shared with people who have different expectations about recording.
The lab's 63-package installation ran without secrets and says nothing about account setup or the data settings on a deployed device. Comma connect provides access to uploaded data, according to the README. Read the data and account terms before enabling the service, and decide whether its default collection matches how you use the car. That is part of setup effort even though no compiler is involved.
October activity shows maintenance, with friction for older logs
Researchers have a separate reason to inspect their data before committing. Issue 38610 on older driving logs reports deprecated field names and a driver-monitoring stream containing zeros in comma2k19 data. A related pull request proposes migration changes, but an open proposal isn't a shipped fix. If that dataset is your reason for choosing openpilot, verify the required signals before designing the analysis around them.
The repository was pushed on October 11, 2026, and recent issue and pull-request activity continued that week. GitHub reported 63,856 stars and 130 open issues and PRs combined. Its latest published GitHub release was v0.11.1, dated June 5, 2026. The newer push and discussion dates give better evidence of ongoing work than judging the project solely by the age of that release tag. The 8-second build belongs to our October 1 checkout, so it does not verify subsequent changes.
For a robotics team building its own autonomous vehicle, Autoware and Apollo are more relevant comparisons than a consumer device installation. For a supported-car owner, openpilot's documented hardware route is the reason to consider it. Our 27-second install is encouraging for source exploration. Your buying decision should start with the exact compatibility entry and end with whether you accept the supervision and data requirements.