The .env file Symfony 4 commits, and the one it does not deploy

Symfony 4 puts a .env file in the repository root and reads it through Dotenv, which is convenient locally and is not how the framework expects production to work.

# .env — committed, contains defaults, no secrets
APP_ENV=dev
DATABASE_URL=mysql://[email protected]:3306/app

# .env.local — gitignored, overrides, never deployed
DATABASE_URL=mysql://dev:[email protected]:3306/app

# production: real environment variables, and
$ composer dump-env prod     # compiles .env into .env.local.php

The compiled file is a plain PHP array, so there is no parsing per request — which is the reason to do it rather than a security measure. Real environment variables always win over anything in a file, so a container platform that injects them needs no dotenv at all. The convention that .env is committed surprises people coming from Laravel, where it is the opposite; the distinction is that Symfony’s is defaults and Laravel’s is configuration.