The .env.local.production File: Purpose, Usage, and Best Practices
Tooling considerations
- dotenv and similar libraries can be told to load a specific filename; frameworks like Next.js and CRA have built-in behaviors for .env, .env.local, .env.production, etc., and will not automatically pick up a nonstandard filename.
- For Docker, mount or COPY the file in during image build or runtime, but prefer build-time ARGs and runtime ENV to avoid baking secrets into images.
- In CI, inject variables from the CI provider rather than committing files; if you must use files, generate them during the pipeline from secure variables.
Dangerous omission - this will NOT ignore .env.local.production
.env.*
If you mistakenly commit this file, you are committing secrets that are intended for production-like behavior—potentially including API keys that have broad permissions on your staging or live infrastructure.
Vite
Vite uses dotenv under the hood but has a slightly different loading order.
- Supported: Yes, via
--mode production. - Syntax:
.env.production.local - Important: Vite requires the
VITE_prefix for variables exposed to the client.
