I have an instance of Magento 2.2.3 on my development server, and my env.php file includes the following:
'system' =>
array (
'default' =>
...
'web' =>
array (
'unsecure' =>
array (
'base_url' => 'https://my.dev.site/',
'base_link_url' => '{{unsecure_base_url}}',
),
'secure' =>
array (
'base_url' => '{{unsecure_base_url}}',
'base_link_url' => '{{secure_base_url}}',
),
'default' =>
array (
'front' => 'cms',
),
),
...
This env.php file is not versioned. My config.php file is versioned. However, when I run setup:upgrade or app:config:import, all 'system' values in env.php are merged with config.php's values, and stored in system_config_snapshot in the database's flag table.
This causes a 500 Internal Server Error when my colleague on a different server attempts to use her instance of Magento. The base_url in the configuration snapshot does not match her config, so she is forced to upgrade or import; which in turn causes my server to crash since my config no longer matches the snapshot.
My understanding of the env.php file is that it is system-specific, so I'm not sure why this one section of the file ('system') is getting extracted and merged with config.php's values in the database's config snapshot. Does anyone have any ideas?