Stop 05 · Scripting & Programming for DevOpsTopics · 4/8

Writing Idempotent Scripts

In short

Your script failed halfway at step 6. Can you just run it again? If it's idempotent, yes. If not, you might get duplicate users, double config lines or a broken server.

A script is idempotent if running it multiple times produces the same result as running it once — critical for automation scripts and infrastructure code that might be re-run after a partial failure.

The mascot taps a glowing lift call button again and again while one lift door slides open.

Think of it like this

The lift call button

You press the lift button once. Your impatient friend presses it five more times. Still only one lift comes. Pressing again changes nothing once the request is made. An idempotent script behaves the same: run it once or ten times, you end up in the same state.

Watch it happen

Lines in /etc/hosts after each run

127.0.0.1 localhost

1/5Start: the hosts file has only the localhost line.

The big ideas

What you need to know

Check, then act

Before creating anything, check whether it already exists. Only change what's actually different.

Use idempotent flags

mkdir -p, ln -sfn and many install commands are safe to repeat. Prefer them over plain versions.

Describe the end state

Tools like Ansible and Terraform describe what should exist, and work out the changes. That's idempotency built in.

Test by running twice

Run your script two times in a row. If the second run changes anything, it isn't idempotent yet.

See it in code

Walk through the code

bash

1# Not idempotent: every run adds another copy2echo "10.0.1.5 db.internal" | sudo tee -a /etc/hosts3 4# Idempotent: only add the line if it's missing5grep -qxF "10.0.1.5 db.internal" /etc/hosts \6  || echo "10.0.1.5 db.internal" | sudo tee -a /etc/hosts7 8mkdir -p /opt/app/logs                       # fine if it exists9ln -sfn /opt/app/releases/v2 /opt/app/current10id deploy &>/dev/null || sudo useradd --system deploy

1/4Appending blindly duplicates the line on every run.

grep -qxF means quiet, match the whole line, and treat the pattern as plain text rather than a regex.

Save yourself the pain

Common mistakes

Oops

Using useradd or createdb in a script without checking first, so the rerun crashes.

Do this instead

Check existence first (id user, or a SELECT query) and skip creation when it's already there.

Oops

Using sed -i to append text, which adds it again on every run.

Do this instead

Manage whole config files from a template, or check for the line before adding it.

Your mission

Make a script rerun-safe

~25 min

Quick check

Which command is idempotent?

Go deeper

1Take a script you've written and check whether running it twice causes an error or duplicate effect.
2Practice adding a check-before-act pattern (e.g. 'if this doesn't exist, create it') to make a script idempotent.
3Learn why idempotency matters even more for infrastructure automation than for one-off scripts.