Circuit Breaker
What it is
A circuit breaker is a resilience pattern that temporarily stops calls to a failing or unhealthy dependency. It protects callers from repeatedly waiting on work that is unlikely to succeed.
Why it matters
In the chain Service A → Service B → Service C, a slow Service C can cause requests in Service B to wait until their timeouts expire. Those waiting requests consume threads, connections, memory, and queues. Service B then slows or fails, and Service A starts timing out too: a cascading failure.
How it works
In the CLOSED state, calls flow normally while the breaker observes failures, including timeouts. After a configured threshold, it moves to OPEN and fails fast rather than calling the dependency. The caller can return a fallback, cached result, a clear error, or degrade a nonessential feature.
After a cooldown, the breaker enters HALF-OPEN and permits a limited number of trial calls. Successful trials close the circuit; continued failures reopen it. Timeouts, bounded retries, bulkheads, and sensible fallback behavior complement the circuit breaker.
Example
If Service C becomes extremely slow, Service B opens its circuit after repeated timeouts. Requests from Service A receive a prompt fallback or failure from Service B instead of accumulating waiting work. This preserves resources and confines the outage.
Trade-offs and limitations
Thresholds that are too aggressive can reject healthy traffic during short disruptions; thresholds that are too lenient protect the system too late. A fallback must be safe and honest about freshness. The pattern does not repair Service C; it limits the blast radius while it recovers.
Related topics
- Timeouts
- Retries with backoff
- Bulkheads