Ansible: Shell vs Command Module

Ansible is one of the most popular automation tools used for configuration management and deployment. One of the key features of Ansible is its ability to execute commands on remote systems. To perform these operations, Ansible provides several modules—two of the most commonly used ones being shell and command.

What is the shell Module?

The shell module in Ansible allows you to execute shell commands on remote systems. This means that the command you specify will be passed to the system's shell (typically /bin/sh or /bin/bash) for execution. The shell module is useful when you need to leverage shell-specific features, such as pipes, redirects, or chaining commands together.

Example:

- name: Run a shell command

  ansible.builtin.shell: |

    mkdir -p /tmp/my_dir

    echo "Hello, World!" > /tmp/my_dir/hello.txt

    cat /tmp/my_dir/hello.txt | grep "World"

What is the command Module?

The command module, on the other hand, is used to execute commands directly without invoking the shell. It is more restrictive than the shell module in that it does not support shell-specific features like pipes (|), redirects (>), or complex shell commands. The command module simply executes the command exactly as specified.

Example:

- name: Run a simple command

  ansible.builtin.command: /bin/echo "Hello, World!"

Key Differences Between shell and command Modules

Let’s now dive into the key differences between these two modules and understand when to use each one.

1. Shell Features Support

• shell Module: Supports shell-specific features such as pipes (|), redirects (>), background processes (&), and environment variable expansion. Useful for tasks that require more complex shell syntax, like chaining multiple commands together or processing output from one command and passing it to another.

Example:

- name: Run a shell command with a pipe

  ansible.builtin.shell: "echo 'Hello, Ansible!' | grep 'Ansible'"

• command Module: Does not support shell features. It simply runs the command as is without interpreting it in a shell. This makes it safer and faster, but also more restrictive.

Example:

- name: Run a command without pipes or redirects

  ansible.builtin.command: /bin/echo "Hello, World!"

2. Security Considerations

• shell Module: Since the shell module invokes the system's shell, it can be more prone to security risks like shell injection. If user input is passed directly into a shell command, an attacker could manipulate the input and execute unintended commands. Always be cautious when using the shell module with dynamic or user-generated input.
• command Module: The command module does not invoke the shell, making it more secure than the shell module. It simply executes the command and is less vulnerable to shell injection attacks. It’s a safer choice when you do not need shell-specific features.

3. Performance

• shell Module: Because the shell module invokes the shell for each command, there can be a small performance overhead when executing complex tasks. If you're running multiple commands or using shell-specific features, this overhead can add up, especially in large playbooks.
• command Module: The command module is faster in comparison since it directly runs the command without invoking the shell. It’s ideal for executing simple commands without any need for shell features.

4. Use Case

• shell Module: Use the shell module when you need to execute multiple commands at once, chain commands together, or use shell-specific features like piping or redirecting output. It is also the module to use when dealing with scripts that require a shell to execute.
• command Module: Use the command module for simple, straightforward commands that don’t need any shell-specific functionality. If you need to execute binaries or scripts that don't require pipes or redirection, the command module is your best bet.

When to Use Which Module?

When to Use ansible.builtin.shell:

• You need to chain multiple commands together using &&, ||, or ;.
• You need to use shell-specific features, like piping, redirects, or environment variable expansion.
• You’re running a script that depends on the shell to work correctly.

When to Use ansible.builtin.command:

• You are running simple commands or standalone executables that don’t need shell features.
• You need to avoid potential security risks from shell injection.
• You want the command to execute as quickly as possible without the overhead of invoking the shell.

Example Scenarios

Example 1: Using shell for Complex Commands

- name: Create a directory and list its contents

  ansible.builtin.shell: |

    mkdir -p /tmp/my_dir

    echo "Hello, World!" > /tmp/my_dir/hello.txt

    cat /tmp/my_dir/hello.txt | grep "World"

• Here, shell is necessary because we are using pipes (|) to filter the output of cat.

Example 2: Using command for Simple Commands

- name: Run a command to create a directory

  ansible.builtin.command: mkdir -p /tmp/my_dir

• This is a simple command that doesn’t need any shell-specific features, so command is the best choice.