How to locally export config from a remote environment?
Edit: Turns out drush has a config-pull command to handle exactly this:

https://drushcommands.com/drush-8x/config/config-pull/

However, it doesn't work with config_ignore as far as I can tell.

The original answer for posterity:

I've found that this bash command does the trick (on Mac OS X):

yes n | drush @site.env cim sync --preview=diff | \
sed -E 's/([\-]{3} ).*(\/.*.yml)/\1a\/config\/sync\2/' | \
sed -E 's/([\+]{3} ).*(\/.*.yml)/\1b\/config\/sync\2/' &gt; cim.patch &amp;&amp; \
interdiff -q cim.patch /dev/null &gt; cex.patch &amp;&amp; \
git apply cex.patch &amp;&amp; \
rm cex.patch cim.patch


We use the preview argument of drush config-import (passing in 'n' when it prompts to import), clean up path names with sed, reverse the patch from import to export, and finally apply it and clean up. Note that you have to be on the same git branch as production.

With drush 9, the output and yes functionality changes a little, so you can instead use:

drush @site.env cim sync --no --preview=diff 2&gt;/dev/null | \
sed -E 's/([\-]{3} ).*(\/.*.yml)/\1a\/config\/sync\2/' | \
sed -E 's/([\+]{3} ).*(\/.*.yml)/\1b\/config\/sync\2/' &gt; cim.patch &amp;&amp; \
interdiff -q cim.patch /dev/null &gt; cex.patch &amp;&amp; \
git apply cex.patch &amp;&amp; \
rm cex.patch cim.patch