Check Mode: Dry-Run with --check

In check mode, a changed status means 'this task would change the host'. It is a prediction, not an action that happened.

Check mode works because idempotent modules already compare current state to desired state. It simply reports the diff and stops short of acting.

Pair check with --diff to see line-by-line changes to files and templates, like a git diff of what the run would write.

Some modules cannot simulate their work. Raw command and shell are skipped in check mode by default, since they cannot predict a result.

Set check_mode: false on a task to run it for real even during a dry run, handy for read-only commands that gather data.

The opposite, check_mode: true, makes a task always simulate, even on a normal run. Useful to keep a risky task preview-only.

A dry run can mislead when a later task depends on an earlier one that was only simulated. The chain may not reflect reality.

Run --check on a stable host to detect drift: any reported change means something on the server no longer matches your playbook.

Because it changes nothing, --check is safe to run against production at any time to audit what a deploy would do first.

Use --check for a safe dry run and --diff to see the details. It predicts changes, helps spot drift, and never touches your hosts. 🔍