Check Mode: Dry-Run with --check

Sometimes you want to know what a playbook would change before it touches anything. Check mode gives you that safe preview.

Add --check to ansible-playbook for a dry run. Ansible reports what it would do but makes no real changes on the hosts.

In check mode, a changed status means 'this task would change the host'. It is a prediction, not an action that happened.

Check mode works because idempotent modules already compare current state to desired state. It simply reports the diff and stops short of acting.

Pair check with --diff to see line-by-line changes to files and templates, like a git diff of what the run would write.

Some modules cannot simulate their work. Raw command and shell are skipped in check mode by default, since they cannot predict a result.

Set check_mode: false on a task to run it for real even during a dry run, handy for read-only commands that gather data.

The opposite, check_mode: true, makes a task always simulate, even on a normal run. Useful to keep a risky task preview-only.

A dry run can mislead when a later task depends on an earlier one that was only simulated. The chain may not reflect reality.

Run --check on a stable host to detect drift: any reported change means something on the server no longer matches your playbook.

Because it changes nothing, --check is safe to run against production at any time to audit what a deploy would do first.

You run ansible-playbook site.yml --check against a live server before deploying.

Use --check for a safe dry run and --diff to see the details. It predicts changes, helps spot drift, and never touches your hosts. 🔍