diff --git a/lib/manager/composer/lock-file.js b/lib/manager/composer/lock-file.js
index 2946160ac8aee900daf6b49f2b2f050c9f160c4c..bc9bc77f1fb15b6795a1ed8d9085d56be30bbbad 100644
--- a/lib/manager/composer/lock-file.js
+++ b/lib/manager/composer/lock-file.js
@@ -1,6 +1,7 @@
 const { exec } = require('child-process-promise');
 const fs = require('fs-extra');
 const upath = require('upath');
+const os = require('os');
 
 const hostRules = require('../../util/host-rules');
 
@@ -15,6 +16,10 @@ async function getLockFile(
   config
 ) {
   logger.debug(`composer.getLockFile(${packageFileName})`);
+  process.env.COMPOSER_CACHE_DIR =
+    process.env.COMPOSER_CACHE_DIR ||
+    upath.join(os.tmpdir(), '/renovate/cache/composer');
+  await fs.ensureDir(process.env.COMPOSER_CACHE_DIR);
   const lockFileName = packageFileName.replace(/\.json$/, '.lock');
   const existingLockFileContent = await platform.getFile(lockFileName);
   if (!existingLockFileContent) {
@@ -50,7 +55,14 @@ async function getLockFile(
       const localAuthFileName = upath.join(cwd, 'auth.json');
       await fs.outputFile(localAuthFileName, JSON.stringify(authJson));
     }
-    const env = { HOME: process.env.HOME, PATH: process.env.PATH };
+    const env =
+      config.global && config.global.exposeEnv
+        ? process.env
+        : {
+            HOME: process.env.HOME,
+            PATH: process.env.PATH,
+            COMPOSER_CACHE_DIR: process.env.COMPOSER_CACHE_DIR,
+          };
     const startTime = process.hrtime();
     const cmd =
       ('composer update ' + updatedDeps.join(' ')).trim() +