I tried out the 1.0 version of Drupal CMS and it has some room for improvement as they say. For those who weren't aware, "Drupal CMS" is a Drupal distribution that comes with preinstalled modules, recipes for creating different types of sites, and other enhancements designed to make it more friendly for non-developers. Recipes are a yml file plus maybe code, and they're similar to what the Features module produced for D7 and before.
I tried it out using the composer option. I should not have run launch-drupal-cms . sh since it downloaded ddev. I don't need that since I already have apache2/mysql. But, at least ddev worked this time unlike the previous time I tried to install it. It loaded the site in the browser and I used a recipe to create an events site.
The sidebar with things to do is a good touch, except after adding an event that sidebar it didn't come back (it's at the 'Dashboard' link).
After adding an event I clicked to the homepage and, if I didn't know why, I'd wonder why my event wasn't showing. I'd wonder why there's no calendar nor an obvious way to set that up. And, as someone else pointed out, if I were a WP person I'd be really turned off by the non-snazziness of the theme.
As I've said a few times, what they need to do is set up a table at a mall or something. Watch regular people struggle with this: they might succeed at posting an event, but they'll be perplexed at what to do next.
Later, I tried the Project Browser and I was able to download & install a module when running under ddev, despite my user owning the 'contrib' directory.
Then, things took a turn for the dangerous. I had placed the site in the htdocs directory for my apache2 installation. I loaded the site in apache2 and it was as if I hasn't installed the site at all: I had to create a MySQL database and install it into that. That resulted in the regular Drupal installer adding the db info to settings.php.
Then, I went back to project browser again and it (thankfully) says 'Unable to download modules via the UI". I haven't looked into how CMS is supposed to be used, but I can easily see some people changing the permissions for the 'contrib' directory and getting hacked.
In addition, how I was able to reinstall the site is similar to how another site was hacked before: MySQL had gone down and someone was able to install Drupal into SQLite. Thankfully they didn't do anything. I realize ddev is just meant for local use, but it's easy to see newbies running into problems with CMS in various ways.