Environmental variables for production build not being exposed

I am stuck following along with the book at the above reference page. The text says to add two new .env files, but never references them elsewhere in the code. Also, the use of the ‘docker build’ command seems to circumvent the docker-compose.yml file, so the environmental variables are never loaded. I have implemented a successful work-around which is to put all of the environmental variables in the Dockerfile.prod using ENV var=val, but of course this is a huge security risk.