Bash strict mode: writing ops scripts that fail loudly

set -euo pipefail is the start, not the whole story. Traps, quoting, and safe temp files for scripts that run as root.

Bash's defaults were designed for an interactive shell, where carrying on after a failed command is the friendly choice. In a script that runs as root, or in a pipeline that deploys, those defaults are a way of failing quietly: a failed cd is ignored, an unset variable expands to an empty string, and a pipeline's status is whatever its last stage returned. Three flags reverse each of those, and understanding where they do not apply matters as much as setting them.

The header, and what each flag decides

#!/usr/bin/env bash
set -euo pipefail
shopt -s inherit_errexit      # bash 4.4+: -e also applies inside $(...) substitutions
IFS=$'\n\t'                    # word-split on newline and tab only, never on spaces
 
# -e            a command that fails (non-zero) ends the script
# -u            an unset variable is an error, not an empty string
# -o pipefail   a pipeline fails if any stage fails, not only the last one

-u is the flag that catches rm -rf "$BUILD_DIR/" when BUILD_DIR was never exported: without it the expression is rm -rf /. -o pipefail is what makes curl … | tar xz fail when the download fails rather than when the archive turns out to be a 404 page. -e is the one with exceptions, and the exceptions follow a pattern:

Where set -e does not fire

The last row is the one that surprises people who already know the others: local out=$(risky) succeeds because local succeeded, whatever risky returned. For the handful of commands whose failure the script cannot tolerate, an explicit check reads better than trusting the flag, and set -E with a trap … ERR gives a single place to log the failing line before the script exits.

Cleanup that runs however the script leaves

With -e the script can exit from any line, so cleanup at the bottom is cleanup that is skipped. A trap on EXIT runs on normal completion, on an error exit and on Ctrl-C, which makes it the place for removing temporary files and releasing locks. Use mktemp for the paths it removes, so two runs never collide on a hard-coded /tmp/myapp and an attacker cannot pre-create the path.

tmp="$(mktemp -d)"
trap 'rm -rf -- "$tmp"' EXIT                       # runs on success, error and interrupt
trap 'echo "failed at line $LINENO: $BASH_COMMAND" >&2' ERR
set -E                                             # ERR trap fires in functions and subshells too
 
curl -fsSL "$URL" -o "$tmp/archive.tgz"
tar -xzf "$tmp/archive.tgz" -C "$tmp"

Quoting and arrays

An unquoted expansion is split on IFS and glob-expanded before the command sees it, so a path with a space becomes two arguments and a value of * becomes every file in the directory. Quote every expansion, including the ones inside $(…), and build argument lists as arrays, not space-joined strings, because an array is the only Bash structure that can carry an argument containing a space. None of this validates input: strict mode stops your typos, and it does nothing about a value that arrives from outside containing ; rm -rf / if some later line passes it to eval or an unquoted sh -c.

# splits and globs on the contents of $path
rm -rf $path/*
 
# quoted scalar, array for the argument list
rm -rf -- "$path"/*
args=(--config "app prod.conf" --force)
mycmd "${args[@]}"
 
# read lines safely, whatever they contain
while IFS= read -r line; do
  printf '%s\n' "$line"
done < "$input"

Let a machine review it

ShellCheck finds the local masking a status, the unquoted expansion, the [ ] test that should be [[ ]] and the cd without a check, at review time rather than at 03:00, but not all at the same level, which decides what a gate sees. On a nine-line deploy script with all four mistakes, 0.11.0 at --severity=warning reported only SC2155 (the local); the unquoted cd $1 is SC2086 at info level, [ ] versus [[ ]] is the optional check require-double-brackets (off unless -o enables it), and SC2164 for the unchecked cd is suppressed when the script sets -e, because the shell already handles it. Running it in CI on every script under bin/ and ci/ is the only enforcement mechanism that survives staff turnover; run it at --severity=info (or the default, style) so the quoting findings count, and add -o require-double-brackets if that rule matters to the team. It is a static check, so it catches the mistakes in the table above that strict mode cannot see at runtime; logic errors are still the runtime flags' job.

When a strict script fails in production: recovery in order of preference

Related posts

Quick reference