Stop your Ansible persistent connections from keeping sockets alive forever

Technical Briefing | 8/2/2026

You probably think your Ansible playbook finishes when the task output clears, but that is rarely the case. If you have ever seen your SSH connection count climb to the hundreds while debugging a CI runner, you know exactly what I mean. Ansible defaults to persistent connections to save cycles, but it often forgets to prune the orphans when things get messy.

Why ControlPersist is a double-edged sword

SSH multiplexing is fantastic for performance until your runner hits a timeout and leaves a socket dangling. These background sessions don’t just consume file descriptors; they can lock up sensitive files or keep your authentication agent busy, making future runs hang indefinitely. If your CI logs show a connection refusing to close despite the task being marked complete, this is likely why.

ls -l /tmp/ansible-ssh-* | xargs -n 1 -I {} fuser {}

• Use the ControlPersist timeout setting in ssh_config to force a kill after 60 seconds
• Set ControlMaster to auto to let the master handle socket lifecycle more gracefully
• Clear stale socket files in your CI cleanup job to prevent cross-run pollution

Fixing this isn’t just about resource hygiene, it is about keeping your state machine sane. If you find your CI nodes constantly saturated with idle SSH processes, stop relying on the default SSH behavior and tune the ControlPersist timer to something shorter than your total execution limit. That way, when the network blips, your infrastructure cleans up after itself instead of waiting for a manual purge.