Bash Defensive Patterns

Defensive idioms for Bash that changes real systems. Pick each guard by intent and keep its reason next to the code.

set Flags by Intent

Comment the intent beside the flags so nobody cargo-cults the wrong one.

set -euo pipefail   # orchestration/deploy: any failed step aborts the run
set -uo pipefail    # drop -e: steps may fail without aborting (optional installs, fail-open heartbeats)
set -u              # long-running/interactive loop: -e would kill on a benign non-zero

A thin wrapper sets no flags and ends with exec so the wrapped tool's exit code reaches the supervisor verbatim:

exec tool "$@"      # no set flags; propagate the real exit code to systemd