Scaffold a project
Start by opening your terminal to create a new folder for the project, then
create a docker-compose.yml file within it:
Open the docker-compose.yml file and add the following content:
Note that we’re setting the CUBEJS_DEV_MODE environment variable to true to
enable development mode. This is
handy for local development but not suitable for
production.
Development mode is an authentication bypass. Cube is in development mode when
CUBEJS_DEV_MODE=true, and also under cubejs dev-server, the cubejs-dev-server bin
or the devServer option, which turn it on with the variable unset. It switches off
JWT verification on the
REST (JSON) and
GraphQL APIs: they then accept requests with
no token at all.Development mode also mounts Playground and its
supporting endpoints with no authentication whatsoever. Anyone who can reach the
instance is handed a ready-to-use API token, and can mint further ones carrying any
security context signed with your API secret — and so query every data API as any user,
bypassing member-level access
control and row-level
security. The same endpoints
read your data model files and the table schema of every connected data source, and
overwrite your data model and your .env. With CUBEJS_DEV_MODE=true and no
CUBEJS_SQL_PASSWORD
set, the SQL API accepts any credentials as well, allowing arbitrary SQL against
connected data sources.This is intentional. Development mode is designed to run on a developer’s local
machine for ease of use and debugging. Never run it where anyone else can reach it,
never expose it to the internet, and never use it in production. Using development
mode in the Cube cloud platform is highly discouraged — it bypasses the platform’s
security model.To keep it off, set CUBEJS_DEV_MODE=false. Leaving it unset is not enough on its own:
cubejs dev-server and the cubejs-dev-server bin turn development mode on for
themselves exactly when the variable is unset, and code that embeds
@cubejs-backend/server-core directly can do the same with the devServer option it
passes to CubejsServerCore. An explicit false overrides the two commands; for an
embedder, leave devServer unset as well. NODE_ENV has no effect either way. If you’re using Linux as the Docker host OS, you’ll also need to add
network_mode: 'host' to your docker-compose.yml.
Start the development server
From the newly-created project directory, run the following command to start
Cube:
Using Windows? Remember to use PowerShell or
WSL2 to run the command below. Connect a data source
Head to http://localhost:4000 to open the Developer
Playground.
The Playground has a database connection wizard that loads when Cube is first
started up and no .env file is found. After database credentials have been set
up, an .env file will automatically be created and populated with credentials.
Want to use a sample database instead? Select PostgreSQL and use the
credentials below: orders table. After selecting the table, click Generate Data Model
and pick either YAML (recommended) or JavaScript format:
Finally, click Build in the dialog, which should take you to
the Build page.
You’re now ready for the next step, querying the
data.
