Array-based Config vs Environment Variable Mapping for Production Secrets

Direct answer

Use environment-variable mapping for production secrets and keep non-secret settings in cached array configuration. In a containerized Laminas deployment, this hybrid approach preserves the opcode-cache benefits of config_cache_enabled while keeping credentials out of source control. Reading environment variables at bootstrap does not meaningfully degrade the config cache.

Why env vars do not defeat config caching

config_cache_enabled serializes the merged configuration array into a PHP file that is loaded and opcode-cached. Environment variables are injected by the container runtime before the PHP process starts; the bootstrap only performs a small lookup and type cast. That overhead is negligible compared with file I/O or database access, so the cached array still delivers its performance benefit for the bulk of your configuration.

Confirmed behavior vs operational assumptions

Confirmed: the merged config cache stores an array, not live environment lookups. Operational assumption: the exact bootstrap overhead depends on your mapping code and PHP version, but it is typically orders of magnitude smaller than the cost of parsing uncached config files on every request.

Recommended containerized setup

1. Store non-secret values (routes, module lists, feature flags) in standard array config and let config_cache_enabled serialize them.
2. Inject database credentials, API keys, and tokens as environment variables via your container orchestrator.
3. In a local config or bootstrap listener, read those variables and cast them explicitly (for example, (bool) or (int)) before merging into the service manager.
4. Regenerate the config cache whenever the mapping logic or config structure changes; secret values themselves do not require cache invalidation because they are resolved at bootstrap.

Verification steps

• Confirm the cache file exists in your configured cache directory and contains the expected non-secret keys.
• Inspect or log the merged configuration array at runtime to verify that secrets are present and correctly typed.
• Check the cache file timestamp after a deployment that changes mapping code to ensure regeneration occurred.

One diagnostic detail that changes the recommendation

Do you need to rotate credentials without restarting containers? If so, environment variables alone are insufficient because they are fixed at process start; a runtime secret store or sidecar would be required.