Search code examples
mongodbfirebasefirebase-realtime-databasegoogle-cloud-firestoreself-hosting

Why can't I use Firebase Local Emulator Suite as a self-hosted solution?


I currently use Firebase as my solution for creating most applications. A new client needs a solution that will not be connected to the internet for the majority of the day.

Because I have my own CMS tool built out that uses firebase, I thought it would be a good idea to make use of the firebase emulators. But while reading this documentation I saw a note that said

Note: Do not attempt to use these emulators as "self-hosted" versions of Firebase services. They are built for accuracy, not performance or security, and are not appropriate to use in production.

I can't find articles talking about why this is exactly a problem though, can anyone see why my solution would have issues?

Question Answered Below, here's my update I decided to move over and use MongoDB as my local data storage solution


Solution

  • [Firebaser here] The Firebase Emulators are NOT built for use as self-hosted replacements for Firebase. They are for testing. Using them in production is a very bad idea for the following reasons:

    1. Performance - the Realtime Database and Firestore emulators don't have a persistent storage layer. They keep all data in memory. They don't have efficient indexes or any sophisticated database technology at all. So as your data set grows it will get slow and if the emulators ever crash you will likely lose all data.
    2. Security - these emulators are intentionally insecure. For instance the two database emulators will accept literally any properly-shaped OAuth token as an admin credential and let that user perform any database action. They also accept unsigned JWTs as user tokens so basically anyone who has a JWT-creation library can imitate any other user. There is no way to secure them against this, this is by design to facilitate easy testing.
    3. Support - if you do try to use them in production and run into a problem, we will not help you. In fact we'll be a little annoyed, since we asked you not to do that :-)